Fundraising Fox

Halcyon

San Diego, US · Founded 2021 · 447 employees on LinkedIn · 7 known investors

Halcyon builds a dedicated anti-ransomware platform that operates across the full attack chain — from initial access to data exfiltration and encryption — adding a detection, protection, and recovery layer within an organization's existing security stack. It uses behavioral engines and an encryption-key capture capability to disrupt ransomware and recover data, and offers 24x7x365 detection and recovery services for enterprises.

Also known as Halcyon.ai

Founders & leadership

Halcyon was founded in 2021 by Jon Miller and Ryan Smith.

JMJon Miller
Jon MillerinChief Scientist & Co-Founder
RSRyan Smith
Ryan SmithinCTO & Co-FounderCTO and co-founder of Halcyon, which builds an anti-ransomware platform that adds detection, protection, and recovery capabilities to an organization's existing security stack. He attended Purdue University and holds a NASM personal trainer certification.
JSJeff St. Clair
Jeff St. ClairChief Revenue Officer

Investors · 7

Funding

SEC filings, press & company announcements

$21M disclosed across 1 of 2 rounds · 2026

Source: company announcements and press reports — follow each round's link for the claim.

Company profile

researched Aug 2026

Halcyon develops an anti-ransomware and cyber resilience platform positioned as a specialized layer distinct from general-purpose endpoint and threat-detection tooling. The platform is described as covering every stage of a ransomware attack, from pre-execution activity through data exfiltration to encryption, with the stated objectives of eliminating ransom payments, maintaining operational continuity and preventing data extortion.

The offering includes a File Resilience capability aimed at preventing encryption before it begins, native macOS support and integrations with Microsoft products. Halcyon bundles a managed 24/7 service it calls the Ransomware Operations Center (ROC), described as a ransomware-focused SOC included at no additional cost, together with recovery services and a services-based ransomware warranty. The company also runs the Halcyon Ransomware Research Center, a community-oriented research effort that publishes ransomware intelligence including a Threat Actor Index covering ransomware groups, their tactics and their targets, and produces survey and market research such as a 2026 security leadership survey on ransomware defense.

Business model

Halcyon sells a security platform to organizations, packaging software-based ransomware detection and disruption with an included managed 24/7 ransomware operations service, recovery assistance and a services-based warranty.

Traction

A 2026 UserEvidence survey of Halcyon customers reported that 68% said Halcyon stopped a ransomware threat that would have significantly impacted their business, 99% were confident in their ransomware resiliency after deployment versus 7% before, and 100% were less concerned about ransomware as a business risk. The company states it is used by companies worldwide.

Latest developments

Halcyon announced the launch of File Resilience, aimed at preventing ransomware encryption before it starts, together with native macOS support and deeper Microsoft integrations. It also published a 2026 security leadership survey on the ransomware defense gap in the AI era, and an Omdia technical validation of its platform was issued in February 2026.

Full profile — market position, technology, go-to-market

Market position

Halcyon presents itself as a dedicated anti-ransomware specialist adjacent to, and layered on top of, existing endpoint detection and response deployments. An Omdia technical validation of the Halcyon Anti-Ransomware Platform published in February 2026 argued that EDR solutions were not designed for ransomware-specific behaviors.

Halcyon positions itself as purpose-built for ransomware rather than broad-spectrum threat detection, arguing that EDR tools are not tuned to ransomware-specific behaviors and are bypassed by operators using valid credentials and legitimate administrative tools. Its stated differentiators are end-to-end coverage of the ransomware attack chain, an included managed Ransomware Operations Center, and a ransomware warranty covering recovery and business continuity.

Technology

The platform focuses exclusively on ransomware behaviors across the attack chain, from pre-execution through exfiltration and encryption, and includes a File Resilience capability designed to block encryption before it starts. It supports macOS natively and integrates with Microsoft environments.

Go-to-market

Direct enterprise sales driven by demo requests and product tours on the company website, supported by research and thought-leadership content from the Halcyon Ransomware Research Center, customer survey evidence and third-party analyst validation.

Enterprises and other organizations concerned with ransomware-driven business disruption, including security leadership teams that already operate EDR tooling.

Compiled by commissioned research from 1 cited public sources — announcements, filings, and press listed under research sources below.

Key figures

latest reported
Halcyon users confident in their ransomware resiliency after deploymentJan 202699%
Halcyon users confident in their ransomware resiliency before deploymentJan 20267%
Halcyon users less concerned about ransomware as a business riskJan 2026100%
Halcyon users reporting Halcyon stopped a ransomware threat that would have signJan 202668%
HeadcountAug 2026447

Company-reported or press-reported figures, each dated to when it was claimed — not independently audited.

Founder mafia

2 people who came through Halcyon went on to found or lead other companies.

Competitors · 8

by search overlap
Sentinel One346 shared keywordsSentinelOne provides an AI-powered cybersecurity platform for enterprises that integrates endpoint protection, threat detection, and incident response capabilities. The company serves large enterprises, including many Fortune 500 organizations, to protect against cyber threats at scale.
Crowdstrike330 shared keywordsCrowdStrike provides an AI-native cybersecurity platform that unifies endpoint, identity, cloud, SaaS, and AI protection to detect and stop breaches for enterprise organizations. It combines automated response with human-led security operations including managed detection and response, threat hunting, and security services.
Palo Alto Networks297 shared keywordsPalo Alto Networks provides cybersecurity platforms and services to protect organizations' digital infrastructure across cloud, network, and security operations. The company serves enterprise organizations, governments, financial institutions, utilities, and healthcare providers globally.
Huntress294 shared keywordsHuntress provides enterprise-grade cybersecurity solutions designed for businesses of all sizes, focusing on threat detection and response to protect organizations against hackers.
Netezza271 shared keywordsIBM is a global technology company whose business spans enterprise software (including Red Hat, HashiCorp, and Confluent), IT infrastructure such as mainframes, servers, and storage, and IT consulting services. The company is also investing heavily in quantum computing and AI-based enterprise offerings, including its Lightwell open-source software security clearinghouse and the Anderon quantum wafer foundry.
Check Point Software268 shared keywordsCheck Point Software Technologies is a cybersecurity company providing security products and solutions. This page is its investor relations section, containing annual reports, SEC filings, financial results, and corporate governance information.
Malwarebytes255 shared keywordsMalwarebytes provides consumer and small-business cybersecurity software, including antivirus and web protection, a privacy VPN, ad/tracker blocking, and identity theft monitoring with insurance. It also offers a browser extension that blocks unsafe content and detects tech support scams, plus a tool for checking suspicious links and screenshots.
Splunk215 shared keywordsSplunk offers a unified platform for security and observability that ingests and analyzes large-scale data across hybrid cloud environments. Its tools support security operations centers with analytics and automated response, and help teams monitor application and infrastructure performance.

Companies competing with Halcyon for the same Google search keywords, organic and paid, via search-intersection analysis.

Timeline · 1

launches, deals, and filings
Jan 2026
Halcyon launches File Resilience, with native macOS support and deeper Microsoft integrations

Halcyon announced File Resilience, a capability intended to prevent ransomware encryption before it starts, alongside native macOS support and expanded Microsoft integrations.

source ↗

Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.

In the news

Research sources · 1

primary sources listed

1 public sources were cited for this profile; the first-party ones are listed here.

Frequently asked questions

What does Halcyon do?
Halcyon is a cybersecurity vendor whose platform is dedicated to detecting, disrupting and recovering from ransomware attacks.
Who founded Halcyon?
Halcyon was founded by Jon Miller, Ryan Smith in 2021.
Who are Halcyon's investors?
Halcyon's investors include Dnx Ventures, Evolution Equity Partners, Gula Tech Adventures, Harmony Partners, Next47, Protagonist, Syn Ventures Seed Management Llc.
How much funding has Halcyon raised?
Halcyon has disclosed $21M raised across 1 of its 2 known rounds.
Where is Halcyon headquartered?
Halcyon is headquartered in San Diego, US.