LevelBlue

Market position

LevelBlue describes itself, and is described in third-party coverage, as the world's largest pure-play managed security services provider, built through consolidation of MSSP, XDR and DFIR assets during 2025. Its stated thesis is that enterprises run too many security tools — an average of 45-plus products — to staff effectively, and that a single provider spanning prevention, detection, response and recovery reduces integration gaps. Analysts have placed it in the 2026 Gartner Market Guide for Outsourced MSS, the 2026 IDC Worldwide Enterprise MDR/MXDR assessment as a Major Player, the 2025 Frost Radar for MDR and the 2025 IDC Worldwide XDR Software report.

LevelBlue positions itself on the scale and breadth of a pure-play managed security services portfolio combined with the SpiderLabs threat intelligence organization and a technology-agnostic approach, in which customers retain existing security stacks such as CrowdStrike or Microsoft while LevelBlue manages them, avoiding rip-and-replace cycles. The company also cites government-grade authorizations and globally recognized certifications, support for more than 360 telemetry sources, and recurring recognition by industry analysts including Gartner, IDC and Frost & Sullivan.

Technology

LevelBlue combines AI-driven analytics with human analysts across security operations platforms including USM Anywhere, an Open XDR platform derived from AlienVault's Unified Security Management product, and the Fusion Security Operations Platform. The Open Threat Exchange (OTX), introduced in 2012, provides community threat intelligence sharing. The company supports more than 360 telemetry sources and integrates with third-party platforms such as Microsoft Sentinel. Acquired technology includes Cybereason's XDR with its MalOp engine, which correlates related security events across endpoint, network and cloud telemetry into attack narratives, and Trustwave's DbProtect and AppDetectivePRO database security products.

Go-to-market

The company sells directly to enterprise and public sector buyers through solution specialists, with separate enterprise and public sector sales, support and breach-response channels, an RFP submission process, demo requests, free trials and training and certification programs. It maintains technology partnerships with security vendors — including designation as premier remediation partner for SentinelOne's Wayfinder Frontier AI Services — and markets through analyst recognition, case studies, threat research publications, webinars and its annual Threat Trends Report. USM Anywhere is positioned specifically for MSSP partners.

Enterprises and public sector organizations operating regulated, hybrid and high-risk environments, including US federal government agencies and their service providers and organizations with GovCloud, FedRAMP, GovRAMP, CUI, clearance, ITAR or CMMC requirements, as well as critical infrastructure operators. Named customers include Curtin University, Higgins Coatings, Melbourne Airport and Augmedix. USM Anywhere additionally targets other MSSPs.

Geography

Global headquarters are at 6010 West Spring Creek Pkwy, Plano, Texas. At launch the company operated four global security operations centers and three network operations centers monitored around the clock. Post-acquisition DFIR coverage spans North America, Europe and Asia-Pacific, and the Cybereason deal added a strong presence in Japan. Referenced customers include organizations in Australia such as Curtin University, Higgins Coatings and Melbourne Airport.

History

The business traces to AlienVault, founded in 2007 in Madrid, Spain by Julio Casal and Dominique Karg on the open-source OSSIM project begun in 2003. AlienVault launched its Unified Security Management (USM) platform and the Open Threat Exchange (OTX) in 2012, moved its main operations to San Mateo, California the same year, and raised more than $100 million in venture funding. AT&T acquired AlienVault in 2018 on undisclosed terms and rebranded its offerings as AT&T Cybersecurity in 2019. In 2023 AT&T announced a spin-out of the cybersecurity business with WillJam Ventures, and LevelBlue formally launched on May 6, 2024 at the RSA Conference in San Francisco, with AT&T retaining a minority stake and board representation and Robert McCullen serving as chairman and CEO.

In 2025 the company consolidated the sector through acquisitions: Stroz Friedberg and Elysium Digital in June, Trustwave in August (announced July), and Cybereason announced on October 14, 2025. The Cybereason transaction brought SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital onto LevelBlue's cap table and added Steven Mnuchin to its board.

Risks & controversies

Commentary on the strategy notes execution risk in integrating three major acquisitions completed within four months while maintaining service quality, unifying technologies, cultures and go-to-market approaches. The acquired Cybereason business had experienced internal conflicts, multiple rounds of layoffs, a failed IPO attempt, litigation from a former CEO against major investors, and a valuation decline from roughly $3 billion in July 2021 to $850 million by March 2025.