CISO Tribune

Vendor comparison · 2 companies

Keepnet Labs vs Mave

Keepnet Labs sells security awareness training and multi-channel phishing simulations. Mave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack. CISO Tribune files both under Threat intelligence. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Keepnet Labs
  • Mave
Keepnet Labs vs Mave: Products, Customers and Funding Compared
Keepnet LabsKeepnet Labs sells security awareness training and multi-channel phishing simulations.keepnetlabs.comMaveMave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack.mave.com
What it sells
  • Phishing Simulator[1][2][7][9]Runs email phishing simulations.
  • Vishing assessment[15]Live calls from experienced social engineers to test verification.
  • AI SOC[1][14]Governed AI agents that investigate alerts, apply threat intelligence, hunt across tools, improve detections, and execute authorized response actions.
  • Threat Hunting[1][13]Runs continuous, cross-tool threat hunts for threats that never triggered an alert.
  • Detection Engineering[1][13]Finds coverage gaps, tunes noisy detection rules, and creates new detections.
  • Threat Intelligence[1][9][10][14]Converts relevant threat intelligence into investigations, threat hunts, detections, and authorized responses.
Categories
Headquarters
London, United KingdomNot stated on its pages
Founded
2017[1]Not stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pagesNot stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen October 26, 2026[13]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Keepnet Labs says any team that takes calls can be included in a vishing assessment, with the help desk requested most. Keepnet Labs organises published customer numbers by sector. Keepnet Labs prices its plans per employee per month, billed annually, and customers can buy through a Keepnet partner. Keepnet Labs lists hosting regions of the UK, EU, US, Canada, the UAE and Türkiye.From its own pages, Mave sells mainly to security operations teams that run many tools and want investigation, hunting, detection work, and response across the stack they already have. Mave addresses managed security service providers that want to scale without adding analysts at the same rate as customers. Mave addresses organizations with multiple SIEMs, tenants, and subsidiaries. Mave addresses organizations that want to reduce SIEM ingestion and retention costs. Mave addresses organizations that want alert triage, investigation, and response in-house, and organizations with on-premises workloads alongside cloud and SaaS. Mave also describes an alternative package for smaller teams.
Last verified
September 27, 2026October 23, 2026

Where they overlap

  • Keepnet Labs and Mave are both filed under Threat intelligence.

Where they differ, field by field

  • Keepnet Labs's primary category is Human risk management; Mave's is AI SOC analysts.
  • Keepnet Labs is also filed under Security awareness training and Incident response and forensics. Mave is also filed under SIEM.
  • Keepnet Labs lists Phishing Simulator and Vishing assessment. Mave lists AI SOC, Threat Hunting, Detection Engineering and Threat Intelligence.
  • Keepnet Labs is headquartered in London, United Kingdom.
  • Keepnet Labs was founded in 2017.

What it sells: Keepnet Labs

What Phishing Simulator does[1][2][7][9]
Phishing Simulator runs email phishing simulations. Phishing Simulator provides templates across languages and difficulty levels.
What Vishing assessment does[15]
A Keepnet vishing assessment is a set of live calls from experienced social engineers to employees, using pretexts the customer approves. Senior Keepnet social engineers hold the calls themselves, with no AI voices.

What it sells: Mave

What AI SOC does[1][14]
Mave runs an AI SOC across the security stack a customer already uses. Mave queries live data in the systems that already hold it, reasons across the evidence, and takes the next authorized action. No telemetry migration, duplicate data lake, central index, or fixed SOAR playbook is required.
What Threat Hunting does[1][13]
Mave applies threat intelligence to the customer's environment and runs continuous, cross-tool threat hunts across the SIEM, EDR, cloud, identity, and other security tools. Each finding becomes a complete investigation, a new or tuned detection, or an authorized response action. Source telemetry stays in place, with no new data lake, central index, or prebuilt correlation pipeline.
What Detection Engineering does[1][13]
Mave works across detection languages and formats, including SPL, KQL, YARA-L, Sigma, EQL, Lucene, and SQL-based rules. Agents review, create, translate, test, and tune detection content in the existing workflow, validate it against historical data where it already lives, and commit or deploy approved changes.
What Threat Intelligence does[1][9][10][14]
Mave determines which campaigns, actors, vulnerabilities, indicators, and techniques are relevant to the customer's environment. Mave evaluates each threat against assets, identities, technologies, vulnerabilities, detections, and live activity.

Questions about Keepnet Labs and Mave

What do Keepnet Labs and Mave sell?
Keepnet Labs sells Phishing Simulator and Vishing assessment. Mave sells AI SOC, Threat Hunting, Detection Engineering and Threat Intelligence.
Are Keepnet Labs and Mave in the same category?
They share Threat intelligence. Keepnet Labs's primary category is Human risk management and Mave's is AI SOC analysts.
Where are Keepnet Labs and Mave headquartered?
Keepnet Labs is headquartered in London, United Kingdom.
When were Keepnet Labs and Mave founded?
Keepnet Labs was founded in 2017.
Who are Keepnet Labs and Mave sold to?
Keepnet Labs says any team that takes calls can be included in a vishing assessment, with the help desk requested most. From its own pages, Mave sells mainly to security operations teams that run many tools and want investigation, hunting, detection work, and response across the stack they already have.

About Keepnet Labs

Keepnet Labs sells security awareness training and multi-channel phishing simulations. Keepnet sells a plan that adds incident response for the emails, SMS and calls employees report, and before and after behaviour measurement. Signals from the security stack a customer already runs become named behaviours in Keepnet.[4][7][9]

Keepnet sends a nudge in the moment, then training for the same behaviour. Keepnet nudges are short reminders by email, SMS and Teams, timed to each employee's behaviour. Keepnet security awareness training is matched to role, risk and behaviour, with nudges. Compliance 360 is role-based compliance training and readiness tracking. Secure Behaviour Dashboard shows before and after behaviour change, and risky behaviour from security tools drives nudges, training and simulations. Keepnet executive and advanced reports are ready-made reports with before and after behaviour data.[7][9]

Phishing Simulator runs email phishing simulations, with templates across languages and difficulty levels. Keepnet voice phishing simulations use pre-recorded, text-to-speech or two-way AI calls. Keepnet runs voice phishing simulations from numbers it owns, not spoofed. Keepnet places the call and records what each employee does. Keepnet voice campaign setup starts when a customer adds phone numbers and then creates a voice campaign. Keepnet SMS phishing simulations use numbers that Keepnet provides. Keepnet callback phishing is an email that asks the employee to call a number. Keepnet email threat simulator tests how email defences handle realistic threats. Keepnet customers can run voice, SMS, email, QR code and callback simulations themselves from the Keepnet console.[2][7][9][14][15]

Incident Responder provides analysis and response for reported emails, SMS and calls. Keepnet threat sharing lets customers share and receive phishing intelligence with peers. Keepnet says AI agents run the loop and, by default, nothing goes out until the customer approves it. Keepnet states that customer data is not used to train AI models.[3][7][9]

Senior Keepnet social engineers hold the calls themselves, with no AI voices. Keepnet vishing assessments are requested most for the help desk, and any team that takes calls can be included. Password and MFA resets, account changes and callbacks to the number on file are the most common scopes of a Keepnet vishing assessment. Keepnet vishing assessment callers are UK, Europe and US callers, in English and Spanish. Card, health, government ID and other high-sensitivity data are never requested or recorded in a Keepnet vishing assessment. Keepnet vishing assessment findings point to the verification steps and policies to strengthen, not to individual employees. Keepnet vishing assessment recordings are encrypted and deleted within five business days of report acceptance, under EU and UK GDPR and the published DPA. In a Keepnet vishing simulation, a platform the customer's team controls runs AI-agent, text-to-speech or recorded calls.[15]

Keepnet offers hosting in the region the customer chooses: the UK, EU, US, Canada, the UAE or Türkiye. Microsoft Azure hosts every Keepnet region except Türkiye, which AWS hosts. Keepnet lists certified security of ISO/IEC 27001, with data in the region the customer chooses. Keepnet states four current certifications, independently audited. Keepnet lists AES-256 at rest and TLS 1.2 or 1.3 in transit.[9][15]

Keepnet prices its plans per employee per month, billed annually, on a 3-year agreement, excluding tax, and 1-year agreements are quoted. Customers buying through a Keepnet partner have the partner quote, bill and support them. Keepnet names Whitbread and Koton among the teams it describes with the numbers they moved.[5][6][7][8][9][10][11][14][15]

Keepnet Labs on the record

Sources

Keepnet Labs full record

  1. [1]About usKeepnet Labs · keepnetlabs.com · published July 23, 2024 · Tier A
  2. [2]Phishing simulatorKeepnet Labs · keepnetlabs.com · published September 24, 2026 · Tier A
  3. [3]Threat intelligenceKeepnet Labs · keepnetlabs.com · published March 19, 2025 · Tier A
  4. [4]Phishing incident responseKeepnet Labs · keepnetlabs.com · published August 25, 2026 · Tier A
  5. [5]Privacy policyKeepnet Labs · doc.keepnetlabs.com · undated page, accessed September 27, 2026 · Tier A
  6. [6]About Us | KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  7. [7]Human Risk Management Platform for Cybersecurity | KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  8. [8]Vishing as a Service: Managed Live-Human Calls - KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  9. [9]Security Awareness Training Pricing & Plans | KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  10. [10]Customer Case Studies: Phishing Simulation Results | KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  11. [11]Cybersecurity Platform Features & Benefits: User Management & Automation | KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  12. [12]Integrations - KeepnetKeepnet Labs · undated page, accessed October 26, 2026 · Tier A
  13. [13]Keepnet Labs Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 26, 2026 · Tier C
  14. [14]Voice delivery Integration - KeepnetKeepnet · undated page, accessed November 10, 2026 · Tier A
  15. [15]Vishing Assessment: Social Engineering by Phone | KeepnetKeepnet · undated page, accessed November 10, 2026 · Tier A

Mave full record

  1. [1]mave.comMave · mave.com · undated page, accessed October 23, 2026 · Tier A
  2. [2]Terms and conditionsMave · mave.com · published February 15, 2026 · Tier A
  3. [3]AI Security Operations Platform | MaveMave · undated page, accessed November 10, 2026 · Tier A
  4. [4]Mave Platform | The SecOps Operating SystemMave · undated page, accessed November 10, 2026 · Tier A
  5. [5]Reduce MDR Reliance | MaveMave · undated page, accessed November 10, 2026 · Tier A
  6. [6]SIEM Cost Reduction & Replacement | MaveMave · undated page, accessed November 10, 2026 · Tier A
  7. [7]On-Prem SecOps Deployment | MaveMave · undated page, accessed November 10, 2026 · Tier A
  8. [8]Multi-SIEM & Post-M&A SecOps | MaveMave · undated page, accessed November 10, 2026 · Tier A
  9. [9]Multi-Tenant SecOps For MSSPs | MaveMave · undated page, accessed November 10, 2026 · Tier A
  10. [10]Threat Hunting | MaveMave · undated page, accessed November 10, 2026 · Tier A
  11. [11]Detection Engineering with MITRE ATT&CK | MaveMave · undated page, accessed November 10, 2026 · Tier A
  12. [12]Threat Intelligence | MaveMave · undated page, accessed November 10, 2026 · Tier A
  13. [13]Pricing | MaveMave · undated page, accessed November 10, 2026 · Tier A
  14. [14]AI SOC Agents for Full-Loop SecOps | MaveMave · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.