Tidal

Tidal Cyber is a cybersecurity software company that markets a "Threat-Led Defense" platform built around the MITRE ATT&CK framework. The platform maps adversary tactics, techniques and procedures (TTPs) to an organization's deployed security controls, calculating residual risk per technique, highlighting coverage gaps and overlapping tooling, and producing prioritized, risk-based remediation recommendations and a "Tidal Confidence Score." A Procedures Library captures concrete, repeatable adversary actions at the procedural level, going beyond technique-level mapping so defenders can build, test and tune detections against observed behaviors.

The product is offered in two editions. A free Community Edition provides user-created technique sets and matrices, notes, Tidal-curated extensions to ATT&CK and a vendor registry, on a shared cloud tenant. The Enterprise Edition adds threat-informed defense capabilities, a single cloud tenant with region flexibility, integrations with defensive solutions such as XDR, EDR and SIEM, continuous ATT&CK assessment, the Tidal Confidence Score, prioritized remediation recommendations and customer support. The company states it maintains a registry of more than 37,000 capabilities enriched through product integrations, ingests external, internal or custom threat feeds, and integrates breach-and-attack-simulation (BAS) to validate controls and tune detections.

Founding story

The company was co-founded in 2022 by Rick Gordon (CEO), Richard Struse (CTO) and Frank Duff (Chief Innovation Officer), each with more than 25 years of cybersecurity experience and prior work at MITRE. Gordon helped scale MITRE's Center for Threat-Informed Defense, ATT&CK Evaluations and MITRE ATT&CK Defender training, and was founding managing partner at the MACH37 Cyber Accelerator; Struse co-founded MITRE's Center for Threat-Informed Defense, created the STIX and TAXII threat intelligence sharing standards and served as CTO of DHS's National Cybersecurity and Communications Integration Center; Duff founded MITRE's ATT&CK Evaluations program. The stated founding rationale was that defenders need vendor-independent tools and services that make the benefits of ATT&CK-based defense attainable and affordable.

Business model

Software vendor selling a subscription platform in two packaged editions: a free Community Edition on a shared cloud tenant used as an entry point, and a paid Enterprise Edition with dedicated tenancy, product integrations, continuous assessment and customer support.

Tiered product packaging with a free Community Edition and a commercial Enterprise Edition sold to organizations.

Traction

The company reports customer testimonials from security operations leads, threat analysts, detection engineers and security architects, and its investors cite strong traction and demand for threat-led defense. Its capability registry exceeds 37,000 entries.

Latest developments

In September 2025 Tidal Cyber announced a $10 million Series A led by Bright Pixel Capital. The company also announced Threat-Led Asset Visibility and Vulnerability Prioritization capabilities, extensions of Threat-Led Defense into AI tools used by security teams, a Procedures Library of ATT&CK-mapped adversary procedures, and NARC, an AI engine that extracts structured adversary procedures from unstructured intelligence.