iCOUNTER CISO: Ali Waezzadah

What the company sells

In real time, iCOUNTER detects the active threats targeting a customer's vendors, suppliers, MSPs, SaaS providers, partners, and broader digital ecosystem.

An acceptable security posture can coexist with stolen credentials, access for sale, or an active compromise. Enterprise systems now depend on vendors, SaaS providers, and other third parties that third party risk management programs cannot continuously monitor.

CTOS (Counter Threat Operating System) is a cybersecurity platform that connects intelligence collection, risk determination, enterprise context, and counter-threat operations in one architecture. CTOS identifies active threats across a customer's extended ecosystem, determines their relevance to the business, and drives remediation with the affected third party. CTOS identifies adversary targeting, exposed credentials, campaign staging, and active compromise signals. Example threats include network or administrator access for sale, compromised VPN credentials, web shells, and data appearing in ransomware files. Active targeting and compromise signals are identified across critical third parties, technology providers, supply-chain partners, and subsidiaries. The Counter Threat Operating System (CTOS) includes third-party risk management and counter fraud capabilities.

CTOS combines global intelligence collection with a digital twin of the customer's ecosystem to determine which live threats matter to that customer. Intelligence collection across thousands of global sources, including cybercrime forums, credential markets, and ransomware sites, is owned and operated by iCOUNTER. Signals are collected continuously from adversary infrastructure, active compromise activity, exposed credentials, dark web sources, and third-party ecosystem telemetry. HUMINT is augmented with AI parsing of hundreds of databases to identify specific targeted threats. CTOS correlates threat signals against a digital twin of the customer's ecosystem to help determine whether a threat is real, which third parties are affected, the potential business impact, and who needs to act. CTOS determines risk at the Edge of Intelligence Collection, validating threat signals against the customer's ecosystem before findings reach the customer's team. CTOS connects third-party relationships and business dependencies to the organization's risk framework and tiers. AI helps CTOS correlate large volumes of threat signals and determine which are relevant to the customer's ecosystem. CTOS connects validated risk to existing security and risk workflows, and feedback from remediation outcomes informs the intelligence operation.

Using observable connection data, iCOUNTER maps a customer's ecosystem of vendors and data flows. Early warning is given if access to a vendor's network has been gained by cybercriminals. Vendors that have been victims of successful ransomware attacks, or that have exposed data that may include the customer's, are identified.

On the customer's behalf, iCOUNTER runs the intelligence-to-remediation operation: collecting and validating signals, determining ecosystem risk, engaging affected third parties, and coordinating remediation through completion. Under its terms, iCOUNTER provides managed third-party threat detection and response services that perform continuous reconnaissance across the customer's extended third-party ecosystem using human intelligence, technical intelligence, and adversary infrastructure monitoring. The managed services include a Validated Connectivity Inventory, which enumerates third parties based on verified bi-directional data exchange. Prescriptive Remediation provides actionable countermeasures with defensible evidence for third parties to take corrective actions. Analysts at iCOUNTER manage the CTOS Platform to track risk events, communicate with impacted third parties, and track third-party mitigations. Customers get access to the CTOS Platform for monitoring risk events, communications, and mitigations. Quarterly Business Reviews summarize alerts, mitigations, and current risk profile. Remediation is handled by iCOUNTER, which engages the affected third party, coordinates remediation, and tracks the fix to completion with evidence. Built-in metrics and remediation tracking are used to communicate progress to stakeholders and the board. The Managed Services and the CTOS Platform dashboard are provided by iCOUNTER, Inc.

CTOS complements a customer's existing program, including security ratings, questionnaires, GRC, threat intelligence, and SOC tools. Alongside a SecurityScorecard program, iCOUNTER adds its own intelligence collection, business-specific risk determination, and managed third-party response. A direct integration with SecurityScorecard is not required to begin an iCOUNTER engagement. Any data exchange or workflow integration can be scoped separately around the customer's environment and the products the customer uses. To start, a customer supplies a CSV of priority third parties and ecosystem partners. Customers share their risk framework, priorities, and current service coverage so the engagement can focus on relevant business dependencies. CTOS is aimed at CISOs, third-party risk managers, security operations teams, and compliance officers in enterprises and public sector organizations with complex third party ecosystems.

John Watters acquired iDEFENSE in 2002, four years after its founding in 1998, and later founded iSIGHT Partners in 2007. Following the merger of iSIGHT and Mandiant under the Mandiant brand, John Watters served as President and COO until the company's acquisition by Google in 2022.^{[1][5][6][8][9][10][11]}

Categories

• Third-party risk and security ratings (primary category)
• Digital risk protection
• Fraud prevention
• Compare iCOUNTER with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

2020^[2][7]

Ownership

Not established from our sources

CISO on record

Ali Waezzadah, Chief Information Security Officer (appointment announced in the week of June 22, 2026)

Website

icounter.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• CTOS (Counter Threat Operating System)^[9]

  A cybersecurity platform that connects intelligence collection, risk determination, enterprise context, and counter-threat operations in one architecture.

  CTOS identifies active threats across a customer's extended ecosystem, determines their relevance to the business, and drives remediation with the affected third party. CTOS combines global intelligence collection with a digital twin of the customer's ecosystem to determine which live threats matter to that customer. Customers get access to the CTOS Platform for monitoring risk events, communications, and mitigations.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of iCOUNTER's categories, then alphabetical. A list from the record, never a ranking.

• On third-party risk and security ratings, iCOUNTER competes with Bitsight, Black Kite, Panorays, Prevalent, RiskRecon, SecurityScorecard, UpGuard, Whistic, Recorded Future, SOCRadar and 28 more.

• On digital risk protection, iCOUNTER competes with BlackCloak, Doppel, Flare, ZeroFox, Charm Security, Group-IB, Overwatch, Recorded Future, SOCRadar, Binary Defense and 13 more.

• On fraud prevention, iCOUNTER competes with Charm Security, BioCatch, Feedzai, Forter, Sardine, Sift, TransUnion, Group-IB, Overwatch, Appgate and 15 more.

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]icounter.comiCOUNTER · icounter.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
2. [2]Icounter emerges from stealth to launch cyber risk intelligence category 302506189iCOUNTER via PR Newswire · prnewswire.com · published July 16, 2025 · Tier A: the company, a regulator or a filing
3. [3]Counter Cyber Threats Before They Strike | iCOUNTERiCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
4. [4]CTOS: Counter Threat Operating System | iCOUNTERiCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
5. [5]End User Terms of Service | iCOUNTERiCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
6. [6]Third-Party Cyber Risk Solutions | iCOUNTERiCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
7. [7]About iCOUNTER | The Cyber Risk Intelligence CompanyiCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
8. [8]iCOUNTER Alongside SecurityScorecard | Threat DetectioniCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
9. [9]The Third Wave of Cybersecurity | iCOUNTERiCOUNTER · undated page, accessed October 25, 2026 · Tier A: the company, a regulator or a filing
10. [10]Next Generation of Fraud Panel | Jason Brown, iCOUNTERiCOUNTER · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
11. [11]Keynote | Intel Led Security for Third Party RiskiCOUNTER · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing

Last verified September 27, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 10, 2026 from the references above.

Work for iCOUNTER? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.