Halcyon Startup Diligence Report
Proceed only to confirmatory diligence. A credible thesis depends on proving durable enterprise ARR, low churn, defensible ransomware-specific efficacy, scalable ROC/warranty economics, strong channel execution, clean IP/security/legal posture and a cap table that makes the headline valuation economically meaningful ([EC-009, EC-010, EC-012, EC-019]).
Halcyon Startup Diligence Report
Eligibility passes: public sources support Halcyon as an active private cybersecurity unicorn and no public IPO, acquisition or shutdown was found in reviewed sources ([EC-001, EC-002, EC-003, EC-022]). The investability question is not eligibility; it is whether private diligence can substantiate ARR quality, customer retention, product efficacy, warranty risk, management transition and cap-table terms behind the $1B headline ([EC-004, EC-011, EC-015, EC-020, EC-021]).
No audited financials, ARR, margins, churn, burn, cash, debt, backlog or sales-efficiency metrics were public; Form D revenue range declined to disclose.
Diligence request: Open full QoE/revenue-quality diligence with audited financials, ARR bridge, cohort retention, burn/runway and sales productivity.
CrowdStrike, SentinelOne, Sophos and Rubrik publicly market overlapping ransomware prevention, endpoint, MDR or recovery capabilities.
Diligence request: Conduct win/loss, pricing, channel conflict and buyer-reference diligence.
The $1B valuation headline is public, but cap table, preferences, option pool, side letters, secondary sales and Form D/press amount reconciliation are not.
Diligence request: Request financing documents, cap table, liquidation waterfall, 409A, investor rights, side letters and round reconciliation.
Halcyon’s core claims around preventing/recovering from ransomware and zero customer ransom/disruption outcomes are company-provided and not independently audited publicly.
Diligence request: Run technical validation, customer incident-reference checks, warranty claims review and third-party testing.
Named customers and testimonials are public, but no ARR concentration, renewal, churn, NRR or cohort data are public.
Diligence request: Request top-customer ARR, contracts, renewal status, churn/NRR cohorts and independent reference calls.
Public policies, SLA and DPA exist, but SOC/ISO, pen tests, subprocessor list, litigation schedule, insurance and executed contract terms are not public.
Diligence request: Counsel/security review of contracts, SOC/ISO/pen tests, insurance, privacy, subprocessors, litigation and regulatory materials.
Public sources show Jon Miller as prior CEO/signatory while the current company page lists Aaron Mick as COO & Interim CEO; geography references vary among Austin, San Diego and Rancho Santa Fe.
Diligence request: Request board minutes, CEO transition rationale, employment agreements, legal entity/geography/tax nexus memo and retention plan.
Partner program, Dell relationship and sales hiring are public, but partner-sourced ARR, attach rate, CAC, quota and funnel conversion are not.
Diligence request: Request channel contracts, pipeline attribution, quota/attainment, sales capacity model and Dell attach-rate economics.
Public evidence supports Halcyon as an active private unicorn with a $1B Series C headline and SEC Form D financing trail, but revenue, margins, burn, cash, debt and cap-table economics remain private ([EC-001, EC-002, EC-003, EC-004, EC-020]).
not publicly verifiable confidence: low
No audited financials, management accounts, backlog, AR aging or product/geography gross-profit data were public; Form D revenue range was declined to disclose ([EC-004, EC-005, EC-006]).
| metric area | public signal | verification status | private diligence request |
|---|---|---|---|
| Revenue / ARR | SEC Form D revenue range declined to disclose; no ARR in reviewed public sources | not_publicly_verifiable | Audited financials, ARR bridge, bookings, deferred revenue, revenue recognition memo |
| Gross margin / services mix | Product includes technology, 24/7 ROC service and warranty; no gross margin disclosed | not_publicly_verifiable | Gross margin by product/service, ROC staffing model, warranty reserve and support cost |
| Cash / burn / runway | Large 2024/2025 financing signals but no cash balance or burn disclosed | not_publicly_verifiable | Cash, monthly burn, runway, debt, plan-vs-actual and board-approved budget |
| Sales efficiency / quota | Greenhouse open roles skew to sales; no quota, CAC or productivity metrics public | not_publicly_verifiable | Sales capacity, quotas, pipeline, CAC payback, win/loss and partner-sourced ARR |
Financial quality is the largest public-evidence gap.
not publicly verifiable confidence: low
Public sources describe financing and hiring expansion but not a forecast, sales plan, foreign operations plan, pricing model or capex/working-capital assumptions ([EC-008, EC-016, EC-020]).
partially verified confidence: medium
SEC and press sources identify financing events and public stakeholders, but outstanding shares, investor ownership, option pool, debt instruments, warrants and liquidation preferences are not public ([EC-001, EC-002, EC-003, EC-004]).
| stakeholder | public position | evidence | diligence caveat |
|---|---|---|---|
| Evolution Equity Partners / Richard Seewald | Series C lead; Richard Seewald joined board per announcement and appears as related person in 2025 Form D | Series C release; 2025 Form D related persons | Ownership %, board rights, side letters, liquidation preference |
| Bain Capital Ventures / Enrique Salem | Series B lead; Series C participant; Enrique Salem listed as director/related person | SecurityWeek and Form D | Pro rata, information rights, preferences |
| SYN Ventures / Jay Leek | Series A lead and Jay Leek chairman/related person | Series A release and Form D related persons | Founder/investor governance, rights and board composition |
| Founders and executives | Jon Miller and Ryan Smith co-founders; Jon signed 2025 Form D as CEO; company page lists Aaron Mick as COO & Interim CEO | Company page and SEC Form D | Founder vesting, employment terms, current authority and transition history |
No public stockholder schedule, fully diluted share count, option pool, debt or SAFEs/notes were available.
partially verified confidence: medium
Financing history is public at a high level, but tax, accounting policies, revenue recognition, financing terms and use of proceeds are private ([EC-002, EC-004, EC-005, EC-006, EC-007, EC-008]).
| date | round or event | amount or offering | lead or participants | valuation or terms | verification status |
|---|---|---|---|---|---|
| 2023-04-20 / 2023-05-08 | Series A / Form D notice | Press: $50M; SEC: $43.75M offering, $42.25M sold | SYN Ventures; Dell Technologies Capital; Corner Capital; other strategic investors | Not public | partially_verified - reconcile discrepancy |
| 2023-12-18 / 2023-12-19 | Series B / Form D notice | $40M sold/reported | Bain Capital Ventures | Not public | verified for amount; valuation not public |
| 2024-11-25 / 2025-01-06 | Series C / Form D notice | Press: $100M; SEC: $127.79M offering, $125.28M sold | Evolution Equity Partners; Bain Capital Ventures; SYN Ventures; Harmony Group; Corner Capital; Dropbox Ventures; ServiceNow Ventures; existing investors | $1B headline valuation; preferences/secondary not public | partially_verified - reconcile Form D amount |
Public sources support funding history but not cap-table economics.
Halcyon publicly offers a purpose-built anti-ransomware platform with prevention, DXP, key capture/decryption, ROC and warranty elements, but product efficacy, roadmap, pricing and unit economics require technical/customer diligence ([EC-009, EC-010, EC-020]).
partially verified confidence: medium
The product/SKU evidence is visible on company pages, but growth rates, market share, profitability, independent efficacy and pricing are not public ([EC-009, EC-010, EC-020]).
| product or sku | audience | public features | evidence status | diligence request |
|---|---|---|---|---|
| Anti-Ransomware Platform / prevention | Enterprise and mid-market endpoint/security teams | AI engine trained on ransomware, vulnerable driver protection, EDR tamper protection, living-off-the-land detection | partially_verified | Architecture, detection logic, false positives, OS coverage, independent tests |
| Data Exfiltration Protection (DXP) | Security operations, privacy/legal risk teams | Outbound-flow monitoring, anomalous data movement detection, ransomware C2/volumetric features | partially_verified | Network coverage, data classification, tuning, incident examples |
| Encryption Detection + Key Capture | Incident response and IT recovery teams | Capture key material, create decryption keys, expert-led recovery via agent/ROC | partially_verified | Technical limits by ransomware family, key escrow/security, recovery SLAs, customer proof |
| 24/7 Ransomware Operations Center (ROC) | Security teams needing managed detection/response and recovery | 24/7/365 ransomware expert monitoring and recovery assistance included | partially_verified | Staffing, escalation, runbooks, SOC certifications, response-time history |
| Ransomware warranty / guarantee | CFO/CISO risk owners and cyber-insurance buyers | Expert-led incident response and recovery services if attack bypasses defenses; marketed as no extra charge | partially_verified | Warranty contract, exclusions, reserve, claims history, insurance/reinsurance |
Product existence is public; efficacy and economics are not.
| commercial item | public evidence | risk or gap | diligence request |
|---|---|---|---|
| List price / packaging | Get-a-quote and demo CTAs; no public tier price found | Pricing power, discounting and ACV cannot be benchmarked publicly | Price book, discount schedule, ACV distribution, renewal uplift |
| Order-form subscription model | Terms define fees by order form and subscription period | Actual customer terms may diverge from public standard terms | Executed MSA/order forms, side letters, termination/renewal terms |
| Warranty / guarantee costs | Warranty marketed publicly; claims history not disclosed | Potential reserve/liability if guarantee is broad | Warranty terms, reserves, incident costs, cyber-insurance backing |
| Competitor pricing comparison | CrowdStrike page exposes per-endpoint units; Halcyon price not public | Competitive pricing pressure unknown | Win/loss price benchmarks against CrowdStrike, SentinelOne, Sophos, Rubrik and MDR providers |
No public price list was identified.
| claim area | public evidence | verification status | validation needed |
|---|---|---|---|
| AI/ML ransomware models | Series C release says models trained on ransomware samples | partially_verified | Training corpus, model governance, efficacy tests, false-positive/negative rates |
| EDR tamper protection | Anti-ransomware page cites Microsoft Defender, CrowdStrike, SentinelOne, Palo Alto Cortex tamper/sabotage detection | partially_verified | Integration list, OS/agent conflicts, test results |
| DXP data-theft detection | DXP page describes anomalous outbound data movement and C2/volumetric detection | partially_verified | Coverage by protocol, false positives, privacy impact, incident runbooks |
| Key capture/decryption | Key capture page describes seed/symmetric key capture and ROC-led decryption | partially_verified | Ransomware-family coverage, encryption edge cases, customer examples |
A private technical diligence track should be mandatory.
Halcyon has visible customer testimonials, case studies, sectors and partnerships, but public evidence does not disclose revenue concentration, churn, NRR, contract terms, top suppliers or severed relationships ([EC-011, EC-012, EC-013, EC-014, EC-021]).
partially verified confidence: medium
Named and role-based testimonials identify several customers and verticals, but top-15 customer rankings and purchase timing are private ([EC-012]).
| customer or reference | public use case or quote | verification status | unverified items |
|---|---|---|---|
| Rocket Software / Mike Raeder, CISO | Added critical protection for high-risk endpoints and gaps in layered defense | partially_verified | Contract value, deployment scope, renewal, reference confirmation |
| CACC Cargolinx | Selected Halcyon after POC across prevention, behavior detection and key capture; deployed with minimal disruption | partially_verified | ARR, airline-partner requirements, technical outcomes |
| Industrial Refrigeration Pros | Deployed via Microsoft Intune to secure most of network within days | partially_verified | Endpoint count, price, operational results |
| City government | ≈1,000 endpoints, blocked all but one test variant and recovered remaining case in five minutes | partially_verified | Independent validation, test design, production deployment evidence |
| OceanAir Federal Credit Union / Delaware Valley University / Shasta Community Health Center / healthcare insurer | Public testimonials cite MTTR improvement, no unplanned downtime, easy deployment and key capture peace of mind | partially_verified | Customer concentration, retention, legal approval, renewal status |
Public evidence verifies marketing permission/testimonials, not financial quality.
partially verified confidence: medium
Public strategic relationships include a partner program and Dell relationship, but terms and contribution are not public ([EC-013, EC-014]).
| partner or relationship | nature | public evidence | diligence gap |
|---|---|---|---|
| Dell | Technology/OEM/channel relationship through Dell Trusted Workspace and commercial PCs | Halcyon + Dell page says Halcyon is available on Dell commercial PCs | Attach rate, revenue share, exclusivity, support responsibilities |
| Resellers | Partner program path for direct resale and joint selling | Partner page names resellers and deal registration/enablement | Partner list, sourced ARR, discount/rebate schedule |
| MSSPs | Managed-service channel | Partner page names MSSPs among supported partner types | MSSP contracts, SLAs, service handoffs, margin |
| Incident response partners | IR channel for containment/recovery | Partner page says IR partners use Halcyon to help customers contain and recover from ransomware | IR partner roster, referral fees, insurance/claims coordination |
| Technology partners | Integrations / ecosystem | Partner page names technology partners; platform pages cite EDR and backup adjacencies | Supported integrations, certification, API/SDK terms |
Partnership evidence is public but economic contribution is not.
not publicly verifiable confidence: low
Revenue by customer and any customers above 5% of revenue are not publicly disclosed ([EC-021]).
not publicly verifiable confidence: low
No public source identified severed customer, partner or supplier relationships; this requires management and customer diligence ([EC-021, EC-024]).
partially verified confidence: low
Public supplier/dependency signals include Dell, Microsoft Intune in a case study, existing EDR adjacencies and hosted-platform references, but cloud/vendor spend and contracts are private ([EC-009, EC-012, EC-014, EC-017]).
| supplier or dependency | role | public evidence | concentration risk |
|---|---|---|---|
| Dell | Commercial-PC/OEM distribution and endpoint channel | Dell Trusted Workspace / on-the-box availability | Channel dependency and support obligations unknown |
| Microsoft Intune | Customer deployment mechanism cited in Industrial Refrigeration Pros case | Customer page says deployment via Microsoft Intune | MDM integration and support scope unknown |
| Existing EDR/XDR vendors | Adjacent/augmentative endpoint controls | Product pages mention Microsoft Defender, CrowdStrike, SentinelOne and Palo Alto Cortex tamper/sabotage protection | Integration conflicts and co-sell/compete dynamics unknown |
| Cloud hosting / data subprocessors | Hosted platform services and personal-data processing | SLA references hosted services; DPA references subprocessors but public subprocessor list not found | Cloud/provider outage, data residency and subprocessors not verified |
Private vendor list and cloud architecture are required.
Halcyon’s ransomware-specific focus is distinctive, but broad endpoint, XDR, MDR and cyber-recovery incumbents publicly market overlapping ransomware capabilities ([EC-009, EC-019]).
partially verified confidence: medium
Public competitor pages show overlap from CrowdStrike, SentinelOne, Sophos and Rubrik; Halcyon’s differentiation depends on purpose-built ransomware focus, key capture, DXP, ROC and warranty proof ([EC-019, EC-009, EC-010]).
| company | public overlap | differentiator or pressure | evidence status |
|---|---|---|---|
| Halcyon | Prevention, DXP, key capture, ROC, warranty | Focused ransomware-only positioning and key-capture claim | Partially verified by company sources |
| CrowdStrike | Ransomware protection, endpoint monitoring, proactive threat hunting | Large platform incumbent; claims 100% ransomware protection in SE Labs test | Competitor marketing verified |
| SentinelOne | Endpoint prevention, detection and response | Broad Singularity platform and marketplace; autonomous security positioning | Competitor marketing verified |
| Sophos | Endpoint ransomware prevention and rollback | CryptoGuard rollback and default-on endpoint controls | Competitor marketing verified |
| Rubrik | Ransomware recovery and immutable backup | Strong recovery/backup buying center; adjacent or complementary | Competitor marketing verified |
Requires win/loss and pricing diligence.
| axis |
|---|
| Ransomware-specific focus |
| Recovery depth |
| Platform breadth |
| Proof and trust |
Scores are analyst judgments based on public materials.
Analyst positioning; validate with win/loss.
Public GTM signals include enterprise quote/demo motion, partner program, Dell channel, research-led marketing and sales hiring, but funnel metrics, CAC, quota productivity and partner economics are private ([EC-013, EC-014, EC-016, EC-018, EC-020]).
partially verified confidence: medium
Halcyon positions directly to ransomware risk owners and uses partner/OEM/content channels, but channel performance is not public ([EC-013, EC-014, EC-018, EC-020]).
| channel |
|---|
| Direct enterprise sales / quote motion |
| Partner program |
| Dell/OEM route |
| Content/threat intelligence |
| Public sector / international field sales |
Public GTM signals are strong but quantitative funnel data is absent.
partially verified confidence: low
Public testimonials support referenceability, but major-customer relationship trends and pipeline are not public ([EC-012, EC-021]).
partially verified confidence: medium
Direct sales, partners, Dell/OEM, research content and regional/public-sector hiring are public avenues; quantitative productivity is not ([EC-013, EC-014, EC-016, EC-018]).
| signal |
|---|
| Sales hiring |
| Customer testimonials |
| Research-led marketing |
| No public pricing |
No private pipeline report or sales-efficiency model was available.
not publicly verifiable confidence: low
Sales compensation, average quota, sales cycle and hiring plan are not public; only job postings are visible ([EC-016]).
not publicly verifiable confidence: low
Budget sufficiency is not public; recent financing provides capacity signal but no burn/budget evidence ([EC-002, EC-016]).
Public R&D signals include veteran technical founders, product leaders, research center, live threat intelligence and kernel hiring; roadmap, development cost, security architecture and IP assignments are private ([EC-015, EC-016, EC-018, EC-009]).
partially verified confidence: medium
The company page identifies technical/product leaders and a research-oriented origin story; actual R&D org structure and budget are not public ([EC-015, EC-016]).
| person or role |
|---|
| Jon Miller |
| Ryan Smith |
| Kris Lamb |
| Clark Lindsey |
| Research Center team / threat intelligence |
Personnel roster requires HR/legal validation.
Actual reporting lines not public.
partially verified confidence: medium
Public pipeline signals include DXP, key capture/decryption, Dell PCs and Research Center outputs; development cost, release schedule and critical-technology risk are private ([EC-009, EC-014, EC-018]).
| pipeline item |
|---|
| Ransomware Research Center / Threat Actor Index / Attack Map |
| DXP |
| Encryption key capture/decryption |
| Dell ransomware-resilient PCs |
| Kernel and federal sales hiring |
No private roadmap, development cost or release schedule available.
Public sources show experienced cybersecurity leadership, active hiring and remote/global operations, but CEO-transition, address/geography differences, total headcount, compensation and attrition require private diligence ([EC-015, EC-016, EC-025]).
partially verified confidence: low
A full org chart is not public; company page provides senior leadership roles but not reporting lines ([EC-015]).
| name |
|---|
| Aaron Mick |
| Jon Miller |
| Ryan Smith |
| Scott Stout |
| Jeff St. Clair |
| Jeff Williams |
| Kris Lamb / Oliver Newbury / Tom Lee / Ryan Schultz / Tim West / Mitch Plonski |
Management roster is public but background checks and employment terms remain private.
Public page lists roles but not reporting structure.
partially verified confidence: medium
Historical/projected headcount is private; careers/Greenhouse provide only remote/global and open-role signals ([EC-016, EC-025]).
| signal |
|---|
| Remote/global team |
| Open roles count |
| Sales-weighted hiring |
| Engineering hiring |
Point-in-time public job board; not total headcount.
partially verified confidence: medium
Company page provides public biographies for founders and leaders; background checks and employment terms are private ([EC-015]).
not publicly verifiable confidence: low
Key employment agreements, compensation and benefits are not public ([EC-016]).
not publicly verifiable confidence: low
Option pool, incentive stock plan and equity grants are not public ([EC-003, EC-004]).
not publicly verifiable confidence: low
No public employee-relations problem schedule was identified; this is not publicly verifiable ([EC-024]).
partially verified confidence: low
Turnover data is private; public sources show a CEO-title transition and active hiring but not departures or attrition ([EC-015, EC-016]).
| transition signal |
|---|
| CEO-title change |
| Geography/address inconsistency |
| Personnel turnover data |
Turnover cannot be validated publicly.
Halcyon has public SEC/Form D, privacy, terms, SLA and DPA artifacts and some trademark-search signals, but litigation, regulatory actions, insurance, official IP status, SOC/ISO/security reports and customer contract terms are not publicly verifiable ([EC-017, EC-023, EC-024]).
not publicly verifiable confidence: low
No substantive lawsuit against Halcyon was captured in surface web searches, but no official docket/counsel search was available ([EC-024]).
| case or search |
|---|
| Surface web search for "Halcyon Tech, Inc." lawsuit/court |
| Customer/product liability or warranty claims |
| Privacy/security incidents |
No counsel docket search was available.
not publicly verifiable confidence: low
No company-initiated litigation was publicly verified; IP enforcement/oppositions are inconclusive because official trademark records were not retrieved ([EC-023, EC-024]).
| case or search |
|---|
| Surface web search for Halcyon Tech plaintiff matters |
| IP/trademark opposition/enforcement |
No official docket search.
not publicly verifiable confidence: low
As a remote-first software company, public environmental/safety signals are minimal; employee safety, remote-work, incident-response and office obligations are not public ([EC-016, EC-025]).
inconclusive confidence: low
Trademark snippets indicate public marks tied to Halcyon Tech, Inc., but official USPTO status and patents were not verified ([EC-023]).
| asset |
|---|
| HALCYON word mark |
| DXP mark |
| ROC mark |
| HALCYON RANSOMWARE FIREWALL mark |
| Patents / proprietary technology |
Official IP counsel review is required.
not publicly verifiable confidence: low
Insurance coverage is not public; warranty/guarantee exposure is public but claims/reserves and insurance backing are not ([EC-010, EC-011]).
partially verified confidence: medium
Public standard terms, SLA and DPA exist, but actual customer, partner, Dell and supplier contracts are private ([EC-017, EC-014]).
not publicly verifiable confidence: low
Public sources show SEC Form D filings and privacy/SLA/DPA artifacts; no regulatory agency problems were publicly verified, and official/legal searches remain incomplete ([EC-003, EC-017, EC-024]).
| area |
|---|
| Privacy |
| DPA / GDPR / state privacy |
| SLA |
| Standard subscription terms |
| Regulatory / agency actions |
| Insurance / warranty backing |
Public legal artifacts are not a clean legal opinion.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists Halcyon as a $1B United States Enterprise Tech unicorn that joined on 2024-11-25. | verified high | SRC-001 |
| EC-002 | Halcyon announced a $100M Series C led by Evolution Equity Partners, with the round valuing the company at $1B and bringing total raised to $190M. | verified high | SRC-002SRC-009 |
| EC-003 | SEC EDGAR identifies Halcyon Tech, Inc. as a Delaware corporation with Austin, Texas business address and three Form D filings. | verified high | SRC-003 |
| EC-004 | The 2025 Form D reports a $127.79M offering, $125.28M sold, revenue range declined to disclose, and related persons including Jon Miller, Ryan Smith, Jay Leek, Nicholas Warner, Enrique Salem and Richard Seewald. | verified high | SRC-004 |
| EC-005 | The December 2023 Form D reports $40M sold and revenue range declined to disclose. | verified high | SRC-005 |
| EC-006 | The May 2023 Form D reports a $43.75M offering with $42.25M sold and revenue range declined to disclose. | verified high | SRC-006 |
| EC-007 | Halcyon announced a $50M Series A led by SYN Ventures to accelerate a ransomware resilience platform. | verified medium | SRC-007 |
| EC-008 | SecurityWeek reported Halcyon raised $40M Series B led by Bain Capital Ventures and planned to expand engineering, R&D and sales. | verified high | SRC-008 |
| EC-009 | Halcyon positions its platform as AI/ML-trained anti-ransomware technology, with key capture and DXP capabilities. | partially verified medium | SRC-002SRC-011SRC-012SRC-013SRC-014 |
| EC-010 | Halcyon publicly describes a platform bundle of anti-ransomware technology, 24/7 Ransomware Operations Center and ransomware warranty. | verified medium | SRC-011 |
| EC-011 | Halcyon claims no significant customer disruptions, exfiltration, backup restores, ransom payments or warranty claims to date. | partially verified medium | SRC-002SRC-009 |
| EC-012 | Halcyon publicly lists customer testimonials and case studies across software, healthcare, logistics, industrial refrigeration, finance, education and government. | partially verified medium | SRC-015SRC-010 |
| EC-013 | Halcyon has a public partner program for resellers, MSSPs, incident response and technology partners. | verified medium | SRC-016 |
| EC-014 | Halcyon publicly markets a Dell relationship for ransomware-resilient PCs through Dell Trusted Workspace. | verified medium | SRC-017 |
| EC-015 | Halcyon was formed in 2021 by cybersecurity veterans and lists a leadership team, but public sources show an apparent CEO-title transition. | partially verified medium | SRC-018SRC-002SRC-004 |
| EC-016 | Public personnel signals show a remote-first team, San Diego/Austin office references and 14 open roles skewed toward sales. | verified medium | SRC-019SRC-020 |
| EC-017 | Halcyon publishes privacy, subscription, SLA and DPA artifacts, including a 99% hosted-platform availability commitment. | partially verified medium | SRC-021SRC-022SRC-023SRC-024 |
| EC-018 | Halcyon operates a public Ransomware Research Center with attack map, threat actor index, reports and alerts. | verified medium | SRC-025 |
| EC-019 | Halcyon faces competition or adjacency from major endpoint and cyber-resilience vendors with ransomware capabilities. | verified medium | SRC-026SRC-027SRC-028SRC-029 |
| EC-020 | Public pricing for Halcyon was not found; the website routes buyers to quotes, demos and order forms. | not publicly verifiable low | SRC-011SRC-012SRC-022 |
| EC-021 | Public customer revenue concentration, churn, retention and backlog are not disclosed. | not publicly verifiable low | SRC-015SRC-002 |
| EC-022 | Public financing and operating sources support active private-company status, with no public IPO/acquisition/shutdown evidence found in the reviewed sources. | verified medium | SRC-001SRC-003SRC-004SRC-010SRC-018SRC-020SRC-032 |
| EC-023 | Public trademark evidence is incomplete: web search surfaces Halcyon Tech trademark records, but official USPTO API access required a key during this research. | inconclusive low | SRC-030SRC-031 |
| EC-024 | No comprehensive public litigation, regulatory-action or employment-dispute schedule was available. | not publicly verifiable low | SRC-032SRC-021SRC-024 |
| EC-025 | Public sources show geography inconsistency: CB/SEC and SecurityWeek emphasize Austin, while the company page says technically headquartered in San Diego/remote. | inconclusive medium | SRC-001SRC-003SRC-008SRC-018SRC-019SRC-024 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.