BitSight Technologies Startup Diligence Research Report
Positive on market relevance and strategic validation, gated by private financial, legal, technical, and customer diligence. Investment judgment should depend on verified ARR growth, retention, margin, cash runway, data rights, model accuracy, partner economics, and current valuation stack.
BitSight Technologies Startup Diligence Research Report
BitSight appears to be a mature private cyber risk intelligence company with strong public validation: 2021 unicorn status, substantial funding, broad product portfolio, large self-reported datasets, 3,500+ customers, named enterprise case studies, Moody's/Microsoft partnerships, analyst recognition, active 2026 launches, and a public CEO transition. The investment-critical gap is that financials, cap table, contracts, legal clearance, customer concentration, and technical/model validation are not public.
Audited financials, ARR, margins, burn, backlog, debt, customer revenue, and projections are not public.
Diligence request: Require full financial data room.
2021 valuation is stale and not equivalent to current common-equity value or liquidity.
Diligence request: Review current 409A, secondary trades, preferences, and debt.
Ratings, AI attribution, CTI enrichment, DVE, and SPM prioritization claims lack public raw-model audit evidence.
Diligence request: Conduct technical and model-risk diligence.
Scanning, credentials, dark-web monitoring, and ratings can raise privacy, consent, and reputational issues.
Diligence request: Review data rights, privacy assessments, DPAs, and dispute logs.
Named customers and aggregate metrics do not disclose top-customer revenue or retention.
Diligence request: Request top-customer ARR and renewal schedule.
Open-web review cannot clear litigation, IP, insurance, contracts, or regulator matters.
Diligence request: Require counsel diligence package.
BitSight competes across multiple security categories; analyst recognition does not prove pricing power.
Diligence request: Review win/loss, pricing, and market-share data.
Moody's and Microsoft validate the business but may create revenue/data/distribution dependencies.
Diligence request: Obtain partner economics, terms, and attribution.
Public evidence supports a 2021 financing/valuation history and private status, but not audited financials, projections, cap table, debt, or customer revenue.
not publicly verifiable confidence: high
No audited statements, budget-vs-actuals, product/channel/geography sales, backlog, or AR aging were public.
| item | public status | importance |
|---|---|---|
| Audited financials | Not found | Revenue/margin/burn validation. |
| Revenue by customer/product/channel | Not found | Concentration and GTM economics. |
| Cap table/debt/preferences | Not found | Ownership and proceeds. |
partially verified confidence: medium
Product launches, partnerships, and insurance growth are visible; projections and assumptions are not.
not publicly verifiable confidence: high
Private status and investor names are public; share counts, options, warrants, debt, and preferences are not.
partially verified confidence: medium
Funding history is partially public but database totals differ.
| round | date | amount usd m | note |
|---|---|---|---|
| Seed | 2011-04-15 | 1.35 | Forge reported. |
| Series A | 2013-06-05 | 27.87 | Forge reported. |
| Series B | 2015-06-25 | 25.75 | Forge reported. |
| Series C | 2016-09-15 | 40 | Forge reported. |
| Series D | 2018-06-28 | 60 | Forge reported. |
| Series E | 2021-09-13 | 250 | Forge $2.39B post-money; CB list $2.40B. |
Reconcile to legal financing documents.
BitSight has a broad cyber risk intelligence portfolio; public sources support product existence and positioning, not pricing, margin, or independently tested efficacy.
partially verified confidence: medium
Products include Security Ratings, TPRM, SPM, CTI, and supply-chain/dark-web intelligence, with self-reported large datasets.
| product | use case | evidence |
|---|---|---|
| Security Ratings | External cyber score | Daily 300-820 score; 40M+ orgs. |
| TPRM | Vendor/supplier monitoring | 40M+ companies; 72K+ vendor profiles. |
| SPM | Exposure/resilience management | 2026 AI asset mapping/prioritization launch. |
| CTI/Dark web | Threat/credential/supply-chain intelligence | APT/malware/credential/IOC scale claims. |
| area | claim | test |
|---|---|---|
| Data scale | 540B+ events; 4B+ IPs; credentials | Audit data rights, freshness, ingestion. |
| Ratings | Objective daily score | Review correlation, disputes, false positives. |
| TPRM ROI | 70% onboarding and 75% breach-probability claims | Trace to cohorts/study methodology. |
| CTI/dark web | Threat/credential coverage | Check provenance, legality, actionability. |
Inferred from public pages.
Customer evidence is strong at aggregate/logo level and includes named case studies, but top customers, revenue concentration, churn, supplier spend, and severed relationships are private.
partially verified confidence: medium
Public pages show aggregate customer metrics and named use cases, not top-15 customers by revenue/application.
| proof point | segment | claim |
|---|---|---|
| 3,500+ customers | Aggregate | Company metric. |
| 38% Fortune 500 / 180+ agencies | Enterprise/government | Company metrics. |
| Schneider Electric | Energy/industrial | 52,000 third parties; TPRM/SPM. |
| AVEVA | Industrial software | Posture/audit/insurance/TPRM use. |
| Axis Max Life | Insurance | SPM/TPRM and 810 score. |
verified confidence: medium
Moody's and Microsoft are public strategic relationships.
| partner | scope | verify |
|---|---|---|
| Moody's | $250M investment; integrations; 350M+ org signals. | Economics, exclusivity, data rights. |
| Microsoft | Security Copilot threat briefing agent. | Commercial model, adoption, data terms. |
| Insurance carriers/brokers | 30% H1 FY2026 insurance growth. | ARR baseline, retention, concentration. |
not publicly verifiable confidence: high
Customer revenue and any 5%+ concentration are not public.
not publicly verifiable confidence: low
No public list of severed relationships was found.
not publicly verifiable confidence: low
Top suppliers and purchase amounts are not public.
BitSight has analyst recognition but competes in a crowded set of ratings, TPRM, CTI, and exposure-management markets.
partially verified confidence: medium
Forrester recognition supports position; CB Insights and comparison pages show competitor pressure.
| entity | overlap | source |
|---|---|---|
| UpGuard | TPRM/security ratings | CB competitor. |
| RSA Security | Risk/security software | CB competitor. |
| Cynomi / Halo Ai | Cyber risk workflows | CB competitors. |
| Recorded Future | CTI | CB competitor. |
| SecurityScorecard/alternatives | Ratings/TPRM | Compare-page context. |
| basis | strength | question |
|---|---|---|
| Data quality | Forrester excerpts cite data/source criteria. | Can raw data accuracy be verified? |
| Customer trust | 3,500+ customers and enterprise metrics. | What are retention and churn? |
| Partners | Moody's/Microsoft integrations. | How much ARR is partner-sourced? |
| Product breadth | Ratings, TPRM, SPM, CTI, dark web. | Which modules monetize? |
Illustrative only.
Public GTM evidence includes direct demos/resources, customer stories, partner distribution, product PR, analyst recognition, and insurance vertical momentum; quotas/CAC/pipeline are private.
partially verified confidence: medium
Marketing emphasizes cyber risk intelligence, AI, analyst validation, customer stories, ROI resources, and product launches.
| date | signal | implication |
|---|---|---|
| 2025-10-09 | Insurance business +30% H1 FY2026 | Request baseline/economics. |
| 2026-02-10 | Dark Web Intelligence launch | Test adoption/model performance. |
| 2026-03-19 | SPM launch | Test monetization. |
| 2026-04-09 | Forrester Leader recognition | Review full report and win/loss. |
partially verified confidence: medium
Named customers and insurance growth are public; expansion pipeline is private.
partially verified confidence: medium
Public routes include direct demos, resources/free reports, Moody's/Microsoft channels, insurance vertical, and expansion across customer base.
| channel | signal | metric |
|---|---|---|
| Direct enterprise | Demo CTAs, resources, case studies. | Website-to-demo and direct pipeline. |
| Moody's | Integrations and 350M+ org signals. | Partner-attributed ARR. |
| Microsoft | Security Copilot partnership. | Usage/leads/commercial terms. |
| Insurance vertical | 30% growth claim. | Baseline revenue and margin. |
Not a measured conversion funnel.
not publicly verifiable confidence: low
Sales compensation, quotas, cycle length, ramp, and hiring plan are not public.
not publicly verifiable confidence: low
Budget adequacy is not public.
Public evidence shows TRACE researchers and 2026 product launches around SPM, supply-chain dark-web intelligence, and AI prioritization; R&D cost and validation remain private.
verified confidence: medium
TRACE page supports security research, data science, and vulnerability research functions.
| function | evidence | need |
|---|---|---|
| TRACE research | Analysts, threat researchers, data scientists listed. | Budget, size, roadmap. |
| Vulnerability research | Named personnel on TRACE page. | Disclosure process and liability controls. |
| AI/data science | AI mapping/prioritization claims. | Model governance and validation. |
Not an internal org chart.
partially verified confidence: medium
Recent launches show SPM and dark-web/supply-chain intelligence pipeline.
| initiative | timing | dependency |
|---|---|---|
| SPM | 2026-03-19 launch | AI asset mapping, benchmarking, workflows. |
| Dark Web Intelligence | 2026-02-10 launch | Deep/dark/open web data, DVE scoring. |
| Microsoft Security Copilot | Partner page | BitSight AI/data lake integration. |
| Insurance data products | H1 FY2026 release | Moody's RMS and carrier workflows. |
Governance is visible through board/investor disclosures and a CEO transition; headcount, compensation, stock plans, employee relations, and turnover are private.
partially verified confidence: medium
Full organization chart is not public; board/investor list is public.
| group | public claim | need |
|---|---|---|
| CEO | John Clancy appointed CEO 2026-04-07. | Employment terms and KPIs. |
| Former CEO/advisor | Steve Harvey stepped down; remains advisor. | Transition/retention plan. |
| Board | 10 board names listed publicly. | Committees, voting rights, conflicts. |
| Investors | Includes Warburg Pincus, Moody's, Menlo, Flybridge and others. | Ownership/preferred terms. |
partially verified confidence: medium
Workday showed 28 open roles across several geographies; historical/projected headcount is not public.
| indicator | signal | interpretation |
|---|---|---|
| Open jobs | 28 jobs found. | Hiring activity, not total headcount. |
| Locations | Portugal, Israel, USA, Lisbon, Singapore, remote. | Multi-jurisdiction HR complexity. |
| Work model | Remote work first. | Talent reach plus compliance complexity. |
| Recruiting fraud | Warning about fake job offers/domains. | Operational/reputation control item. |
partially verified confidence: medium
CEO transition release gives John Clancy background and Steve Harvey advisory role; full executive bios are not structured publicly.
not publicly verifiable confidence: low
Compensation and benefits are not public.
not publicly verifiable confidence: low
Option pool, grants, strikes, and vesting are not public.
inconclusive confidence: low
No public employee-relations problems found; careers page warns about recruiting fraud.
not publicly verifiable confidence: low
No turnover data public; CEO transition is the main public leadership event.
Open-web legal diligence is inconclusive; public evidence shows an IP claim and public legal/security pages, while litigation, insurance, contracts, and regulatory clearance remain private.
inconclusive confidence: low
No definitive pending lawsuits verified from open-web sources; Docket Alarm signal is limited.
| area | evidence | status |
|---|---|---|
| Lawsuits against | Docket Alarm open search: no motions found. | Inconclusive; counsel search needed. |
| Lawsuits initiated | No verified active cases in public pass. | Inconclusive. |
| Patents | Company claims 75+ patents; patent-application filter visible. | Partially verified; USPTO/IP schedule needed. |
| Regulatory | No public agency problem verified; data practices warrant review. | Inconclusive. |
Not attorney opinion.
inconclusive confidence: low
No company-initiated pending lawsuits verified publicly.
not publicly verifiable confidence: low
Software-company environmental risk appears limited publicly; remote/global employment compliance is not public.
partially verified confidence: medium
Company claims 75+ patents; detailed IP schedule and encumbrances are not public.
not publicly verifiable confidence: low
BitSight's own insurance coverage schedule is not public.
not publicly verifiable confidence: low
Material customer, partner, data, cloud, and supplier contracts are not public.
| category | signal | request |
|---|---|---|
| Partner contracts | Moody's/Microsoft public. | Agreements, economics, data rights. |
| Customer contracts | Case studies/aggregate customers. | Top MSAs, DPAs, SLAs. |
| Insurance | No schedule public. | D&O, cyber, E&O, claims history. |
| Compliance pages | Security, terms, Modern Slavery links. | SOC2/ISO, privacy, regulator materials. |
inconclusive confidence: low
No public agency problem verified; data collection, credentials, ratings, and dark-web products require privacy/regulatory review.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists BitSight as a 2021 unicorn at about $2.40B. | verified high | SRC-001 |
| EC-002 | Private-market databases report BitSight founded 2011 in Boston and total funding around $397M-$405M. | partially verified medium | SRC-002SRC-003 |
| EC-003 | BitSight is private with no public ticker or exchange-traded stock price. | verified high | SRC-004 |
| EC-004 | BitSight publicly positions itself as an AI-powered cyber risk intelligence platform. | verified high | SRC-005SRC-006 |
| EC-005 | BitSight states large data/customer/patent scale metrics. | partially verified medium | SRC-005SRC-006 |
| EC-006 | TPRM claims monitoring scale and quantified efficiency/risk-reduction benefits. | partially verified medium | SRC-007 |
| EC-007 | Security Ratings are described as daily 300-820 scores over tens of millions of organizations. | verified medium | SRC-008 |
| EC-008 | CTI claims broad coverage of threat actors, malware, IOCs, and credentials. | partially verified medium | SRC-009 |
| EC-009 | BitSight reports 3,500+ customers and broad enterprise/government penetration. | partially verified medium | SRC-010 |
| EC-010 | Schneider Electric is a named customer using BitSight for supply-chain risk. | verified high | SRC-011 |
| EC-011 | AVEVA describes BitSight supporting security posture, audits, insurance, and TPRM. | verified medium | SRC-012 |
| EC-012 | Axis Max Life Insurance reports SPM/TPRM use and a BitSight score of 810. | verified medium | SRC-013 |
| EC-013 | Moody's is a strategic investor and distribution/data partner. | verified high | SRC-014 |
| EC-014 | Microsoft partnership supports Security Copilot threat-intelligence workflows. | verified medium | SRC-015 |
| EC-015 | BitSight reported 30% H1 FY2026 insurance-business growth. | partially verified medium | SRC-016 |
| EC-016 | BitSight launched Security Posture Management in March 2026. | verified medium | SRC-017 |
| EC-017 | BitSight launched Dark Web Intelligence for Supply Chains in February 2026. | verified medium | SRC-018 |
| EC-018 | BitSight says Forrester named it a Leader in Cybersecurity Risk Ratings Platforms, Q2 2026. | verified medium | SRC-023SRC-024 |
| EC-019 | Public competitor references include UpGuard, RSA Security, Cynomi, Halo Ai, Recorded Future, and SecurityScorecard/alternatives context. | partially verified medium | SRC-002SRC-024 |
| EC-020 | BitSight discloses board members and investors on its team page. | verified high | SRC-020 |
| EC-021 | John Clancy was appointed CEO effective April 7, 2026, succeeding Steve Harvey. | verified high | SRC-019 |
| EC-022 | BitSight states remote-work-first hiring and public open roles across multiple geographies. | verified medium | SRC-021SRC-022 |
| EC-023 | TRACE page lists security researchers, analysts, and data scientists. | verified medium | SRC-027 |
| EC-024 | Open-web legal search is inconclusive and does not clear litigation/IP risk. | inconclusive low | SRC-025SRC-006 |
| EC-025 | Core financial statements, cap table, debt, projections, and revenue by customer are not public. | not publicly verifiable high | SRC-002SRC-003SRC-004 |
| EC-026 | Public legal/security pages exist, but contracts, insurance, and regulatory clearance are private. | partially verified medium | SRC-026 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.