Tidal Cyber

Tidal Cyber develops a threat-informed defense platform that helps organizations shift from reactive vulnerability management to a proactive, adversary-behavior-centric security posture. The company’s core offering operationalizes Threat-Informed Defense, mapping adversary tactics, techniques, and procedures to enhance detection engineering, security operations center management, and cyber threat intelligence. This approach aims to provide a comprehensive framework for understanding and mitigating cyber threats based on actual adversary methodologies.

The company was co-founded by Rick Gordon, Richard Struse, and Frank Duff, who collectively recognized a critical gap in cybersecurity defenses. Their insight was that defenders required practical and sustainable tools and services to achieve the full benefits of Threat-Led Defense. They established Tidal Cyber to address this need, building a platform independent of specific vendor products to ensure unbiased guidance for its users.

Tidal Cyber primarily serves enterprises, enabling them to effectively adopt and leverage the MITRE ATT&CK framework. The company’s vision is to make threat-informed defense practical and affordable for all organizations, empowering them to build robust security programs that can anticipate and counter sophisticated cyber threats. It focuses on delivering actionable intelligence to strengthen defensive capabilities at scale.

High-Level Overview

Tidal Cyber is a cybersecurity company that builds a Threat-Informed Defense platform centered on the MITRE ATT&CK framework, helping enterprises map their security tools against real adversary tactics, techniques, and procedures (TTPs) to identify coverage gaps and prioritize defenses[1][2][3][4][6]. It serves security operations centers (SOCs), detection engineers, threat hunters, and compliance teams in large organizations, solving the problem of turning fragmented threat intelligence into actionable, measurable improvements that reduce residual risk and optimize security investments[1][3][4][5][6]. With $9M in total funding including a $5M seed round in 2023, the company shows strong early momentum, including recognition as "Threat-Led Defense Company of the Year" and integrations for continuous threat monitoring[2][4][5].

Origin Story

Tidal Cyber was founded in 2022 in Clifton, Virginia, by former MITRE leaders: Rick Gordon (CEO), Frank Duff (Chief Innovation Officer), and Richard Struse (Chief Technology Officer), who played pivotal roles in developing the MITRE ATT&CK framework[1][2][4]. The idea emerged from a recognized gap between threat intelligence, security controls, and operational decisions, with the founders aiming to make Threat-Led Defense practical and vendor-independent for all enterprises[3][4]. Early traction came from building the Tidal platform around ATT&CK, securing seed funding from investors like Squadra VC in 2023, and launching features like the Enterprise Edition[1][2][5].

Core Differentiators

• Comprehensive Procedures Library and NARC AI: Industry-first library of tens of thousands of real-world adversary procedures, powered by NARC (Natural Attack Reading & Comprehension) AI, which automates extraction of structured ATT&CK-aligned insights from unstructured data like CTI reports, incident responses, and pentests[4][6].
• Vendor-Independent Coverage Mapping: Maps over 500 security products to ATT&CK TTPs, generating continuous coverage maps, gap analysis, and defensive stack calculations to prove tool effectiveness without bias[1][3][4][6].
• Actionable Integration and Automation: Integrates with existing tools for SOC management, detection engineering, threat hunting, and CTEM (Continuous Threat Exposure Management), enabling prioritized insights, BAS validation, and automated compliance mapping to frameworks like NIST CSF[1][4][5][6].
• Proven Impact Metrics: Delivers 4x increase in proactive detections, cost savings via overlap identification, and risk-based recommendations tailored to specific threats[6].

Role in the Broader Tech Landscape

Tidal Cyber rides the surge in Threat-Informed Defense (TID) and CTEM trends, where organizations shift from reactive security to proactive, adversary-focused strategies amid rising sophisticated attacks[1][4][6]. Timing is ideal post-2022 ATT&CK maturation, as generative AI amplifies threats (e.g., their May 2025 piece on securing LLMs via TID), and market forces like regulatory pressures (NIST, CIS) demand evidence-based compliance[4][6]. It influences the ecosystem by democratizing ATT&CK adoption, fostering independent tool evaluation, and accelerating SOC efficiency for enterprises, reducing overall cyber risk in a landscape of 10,000+ cybersecurity firms[1][3].

Quick Take & Future Outlook

Tidal Cyber is positioned for expansion with its AI-driven edge in TID, likely scaling via enterprise deals and NARC enhancements to handle AI-evolved threats. Trends like AI-augmented attacks and zero-trust mandates will propel demand, evolving its influence toward becoming a standard for ATT&CK operations and compliance automation. As a post-seed player with MITRE pedigree, expect Series A funding and broader integrations, solidifying its role in sustainable cyber defense[2][4][5][6]. This builds on its core mission: making elite threat defense accessible and proven.