Methodology
How companies get on the list, where the facts come from and how we measure size. Edited by Laura Martisiute.
Who is on the list
The directory lists 860 companies that sell security products, security services or both. We choose each one from our own research and from public company data, such as stock exchange listings and annual reports. A company appears once, however many products it sells.
Companies that have been bought stay on the list. Their profile shows who owns them now.
Where the facts come from
| Fact | Where it comes from |
|---|---|
| What a company sells | Company websites and other public pages, listed on each profile |
| Where it is based | Company websites and other public pages, listed on each profile |
| When it was founded | Wikidata, or other public pages listed on each profile |
| Who owns it | Wikidata and acquisition announcements |
| Revenue | Annual reports filed with the SEC |
| Staff numbers | Annual reports filed with the SEC, or Wikidata |
| Deals | Acquisition announcements and monthly M&A roundups |
Wikidata is a free database of facts run by the Wikimedia Foundation. Each profile lists the pages we used. If we cannot find a fact, we leave it blank rather than guess.
How categories are assigned
We put each company in the categories that match what it sells. A firm that runs penetration tests goes in Penetration testing. A vendor that sells a SIEM goes in SIEM. Many companies sell more than one thing, so they appear in more than one category. The first category on a profile is the one most of the business falls in.
There are 55 categories in 14 markets. The categories page lists them all.
How we measure size
Some pages put the biggest companies first. We measure size by revenue from the latest annual report a company has filed with the SEC, and we show the fiscal year next to each figure. We have revenue for 29 companies so far.
Most private companies do not publish revenue, so after revenue we rank by staff numbers. Companies we cannot measure either way come last. Companies that do not file with the SEC, such as many listed outside the US, may show no revenue even when they publish it at home.
Size is the only thing we rank by. We do not judge whether one company is better than another.
Who owns what
Every company is marked as public, owned or private. Public means its shares trade on a stock exchange and no other company owns it. Owned means a parent company or an investor, such as a private equity firm, owns it. Private means neither. The public companies list has 41 of them, and the owners list groups the owned companies by who owns them.
Deals and funding
The deals record holds 2,371 acquisitions from 2020 and 2,777 funding rounds from 2022. Acquisitions from 2021 onwards come from SecurityWeek’s monthly cybersecurity M&A round-ups, and those from 2020 from Cybersecurity Ventures’ quarterly M&A reports and Wikipedia lists. Funding rounds come from Return on Security’s weekly Security, Funded newsletter. These are dated to the month. A few recent deals added from the news are dated to the day. Each deal links to the announcement or report it came from. Smaller deals may be missing.
We do not republish these sources’ wording. The short line on each deal that says what the company does is our own, and the category is ours.
How profiles are written
An AI model drafts the description on each profile from the company’s own website, and suggests its categories. An editor checks the facts before the profile is published, and each profile shows the pages we used and when its facts were last checked. Owners, deals, funding rounds and revenue come from the sources above, not from the model. The editorial policy has the details.
Claim a profile
If you work for a company in the directory, use the Claim this profile button on its page. You can find the company in the full list. A claimed profile can carry your own description, products, customers and a contact.