Sygnia: who they are, what they sell and what CISOs should ask

What Sygnia sells

Sygnia sells incident response, managed detection and response (MDR) and security readiness consulting to large organisations. The company says it is trusted by Fortune 500 and Global 2000 companies worldwide. It was founded in 2015 by veterans of Unit 8200 and launched from the Team8 foundry, and it has been a Temasek International company since 2018. CNBC reported in 2018 that the start-up had no plans to move its headquarters from Tel Aviv. The company's own page lists offices in Tel Aviv, New York, Singapore, London, Mexico City and Sydney, with 250+ team members. Shachar Levy, a co-founder, was its first chief executive. The role is now held by Guy Segal.

The work falls into three lines. Incident response covers investigation, containment, recovery and ransomware negotiation. It is sold either when an incident happens or through a retainer that, the company says, keeps a team of experts continuously on standby. Readiness work includes posture assessments, tabletop exercises, red and purple teaming, and threat intelligence exposure management. Its homepage describes this work as using front-line knowledge of attacker motivations and TTPs to prioritize your security roadmaps. The third line is MDR.

Both incident response and MDR run on Velocity, Sygnia's own threat detection, investigation and response (TDIR) platform. Its page states that Velocity can ingest up to 30 TB per day and run up to 100,000 queries daily, works in cloud and on-premises, IT and OT, and has over 250 out-of-box integrations. Data arrives by API, Syslog or manual log upload and is stored in the Snowflake data lake. On servers and workstations, collection runs through Pathfinder, a proprietary lightweight agent.

The MDR page makes several claims about the service:

• It integrates with network, endpoint, cloud, firewall, secure email gateway and application tools.
• Each client gets a named team of 8 experts.
• The platform is used to resolve 95% of alerts without involving the customer's team.
• Because MDR and incident response share Velocity, all MDR clients are IR-ready with complete forensic data.

On 11 October 2026 the company announced new MDR SOC hubs in Austin, Texas, and Singapore, alongside its existing MDR operations in Tel Aviv.

Sygnia's pages are specific about what it is not. Its incident response page says engagements are delivered exclusively by in-house Sygnia experts. It also says its parallel workstreams remove the need for any additional third-party vendors. The MDR page says "No trainees here." Velocity is described as technology-agnostic, and the incident response FAQ says the company can work with a customer's existing tools rather than replace them. On AI, Segal said in October: "Our goal is not to replace expert judgment with AI".

Figure: Sygnia's home page, captured 2026-11-03. Source: Sygnia | Cybersecurity & Incident Response Experts.

The founders

Sygnia's record lists two founders. Shachar Levy was the company's first chief executive. When Team8 announced the launch in November 2017, it named Levy as founder and CEO and said that over the previous two decades he "has held research, cyber, and business leadership positions in government and the private sector."

Ami Kor appeared in the same announcement as one of three co-founders, alongside Ariel Smoler and Arick Goomanovsky. Team8 said the group brought "decades of cyber experience" to the company. It did not set out Kor's individual career, and none of the sources available for this profile describe his earlier roles. TechCrunch's report on the 2018 Temasek deal listed the same four co-founders, with Levy as CEO. It named Nadav Zafrir as chairman, describing him as co-founder and CEO of Team8 and a former commander of Unit 8200.

Levy's public explanation of the company's purpose drew on military language. At launch he said: "In many cases, an incident response engagement is in fact a battle within a network." He added that the speed and experience of the company's response teams could mean the difference between "a minor blow and a devastating impact on performance and reputation," according to the Team8 release. TechCrunch summarised the idea behind the company as building technology, tools and services for an organisation's resilience, both to reduce the likelihood of a breach and to help it weather an attack if one happened.

A year later, when Temasek agreed to buy the company, Levy repeated the theme. "Cyber, in its current magnitude, is a new domain of technology, a new domain of warfare, and a new domain of business," he said in a statement quoted by TechCrunch, adding that companies faced risk "which until lately was the realm of militaries and states." The same report said Team8 had invested $4.3 million in Sygnia, the only outside funding the startup had taken before the sale.

CNBC reported at the time that Levy would "remain at the helm of the company" after the acquisition. He said the alignment with Temasek would strengthen the company's ability to offer end-to-end strategic support and "allow us to accelerate building our global reach." The sources do not say when Levy stepped back from the chief executive role; the current CEO is the one named earlier in this profile. Profiles of the people running security companies are collected under people.

What the product does

Sygnia's offering runs on one platform, Velocity TDIR, which its detection analysts and its responders share. Its page states that Velocity can ingest up to 30 TB per day and run up to 100,000 queries daily. Raw data is enriched as it arrives, including with the company's proprietary MISP, and AI is used to classify and normalize data. Analysts query that store in two modes, manual and automated, and can build custom queries from natural language search terms. The platform then generates alerts from queries and detection scenarios, each carrying a summary of findings and recommendations.

The customer sees this through a user portal. It has an operational dashboard, an alert view listing required actions, a list of enabled detection scenarios, and a chat channel to Sygnia's team, with an AI summary attached to each alert.

On servers and workstations, the Pathfinder agent mentioned earlier uses 10MB of memory when idle and runs on a single CPU core at low priority. It sends a heartbeat to Velocity every 60 seconds and acts only when queried. It can also install and configure Microsoft Sysmon and Elastic's Winlogbeat, Filebeat, and Auditbeat collectors. The company says it has been audited in accordance with the AICPA's SOC 2 Type II standards for security, availability and confidentiality.

The managed detection service follows five steps on its page: design, collect, detect, analyze, respond. Sygnia writes a detection plan for each client mapped to MITRE, with up to 200 detection rules of three kinds: baseline, custom and IR-based. Client systems are connected to Velocity and monitored continuously. Its page states that the technology lets Sygnia take ownership over the investigation. The output the client receives is a set of remediation steps and recommended actions.

When a breach is under way, the company's incident response services run as parallel workstreams covering executive and technical crisis management, containment, investigation, ransomware negotiation, remediation and recovery, and threat monitoring. Negotiators pass attacker information back to the investigators, and monitoring continues after the incident so that re-entry attempts are blocked, the page says. A retainer differs: it sets pre-established terms and conditions before an incident and guarantees priority access.

The controls a person keeps were the focus of the October announcement. The company said clients could decide which containment actions to automate and which to keep manual, and that its hybrid investigation model kept expert oversight central to critical decisions. It also said it was extending monitoring into cloud-native AI workspaces through integrations with AWS Bedrock.

Figure: Sygnia's product page, captured 2026-11-03. Source: Incident Response Service | Sygnia Cybersecurity.

How it works and what it connects to

Velocity sits underneath both of Sygnia's operating lines. The platform page describes it as technology-agnostic and built to run across cloud and on-premises, IT and OT environments (Sygnia). Because the same platform is used by the incident response team, the MDR page says all MDR clients are "IR-ready with complete forensic data" (Sygnia).

Data in. The company lists over 250 out-of-box integrations with IT and OT data sources, and three ways of bringing data in: API, Syslog transport and manual log upload (Sygnia). On the MDR side, it says the service connects to existing network, endpoint, cloud, firewall, secure email gateway and application tools (Sygnia). The incident response page adds that Velocity ingests data from all sources, including tools a client has built itself (Sygnia).

Endpoints. On servers and workstations, Velocity relies on Sygnia's own Pathfinder agent for collection and response, including binary and memory data (Sygnia). The company presents the agent as a supplement rather than a replacement: it was built to "enable, enhance and supplement existing binary data collection" (Sygnia). Its page states the agent uses no OS hooks or monitors and acts only when Velocity queries it, and that its operations run through OS APIs, with no CMD or shell commands called (Sygnia).

OT. The company says Velocity provides visibility into legacy OT systems which, in its words, "most other IT detection tools cannot monitor" (Sygnia).

Where data lives and how it is searched. Enriched data is stored in a Snowflake data lake, according to the platform page, which also describes a repository of proprietary search queries built on Sygnia's library of indicators of compromise (Sygnia). In an October 2026 announcement the company said it was processing more than 5 billion log items a day (Business Wire via Yahoo Finance).

People and locations. Sygnia says each MDR client has a named team of 8 analysts watching its environment around the clock (Sygnia). The same October announcement added MDR operations centres in Austin and Singapore alongside the existing Tel Aviv operation, which the company said would run a three-region, follow-the-sun model (Business Wire via Yahoo Finance).

The sources do not say which Snowflake regions hold customer data, how long it is retained, or whether a customer can host Velocity itself, and the company states no limits on the platform beyond the agent footprint noted earlier.

Where it sits in the market

CISO Tribune's record files Sygnia under three categories. Incident response and forensics covers breach investigation and containment services, digital forensics tools, and platforms that coordinate incident response. MDR and managed SOC covers services in which a provider's analysts monitor a customer's environment around the clock and respond to threats. Security consulting and advisory covers assessment, architecture, programme and compliance advisory services, and excludes incident response and penetration testing.

The chart shows how many companies CISO Tribune's record files under each of Sygnia's three categories, as of 3 November 2026.

The record lists these neighbours in those categories, in alphabetical order and without ranking: Accenture; AccessIT Group; Acronis; Agile Defense; Airbus; Alphabet; Arctic Wolf; Atos; Barracuda Networks; Binary Defense; Bitdefender; BlackBerry; BlackCloak; Blackpoint Cyber; Blue Mantis; Booz Allen Hamilton; BreachRx; BSI; Capgemini; CGI; CISO Global; Coalfire; Critical Start; CyberTrust Consulting; Cybolt; Cyderes; CYPFER; D3 Security; Deepwatch; DefenseStorm; Deutsche Telekom; Dispel; DXC Technology; eSentire; EverOak Solutions; Expel; Forte Technologies; Fortified Health Security; Fujitsu; Grant Thornton; Guardz; GuidePoint Security; Hold Security, LLC; Honeywell; I-TRACING; IANS; ICF; IDEMIA; Indra Group; Infosys; Integrity360; Inversion6; iVerify; Judy Security; Keepnet Labs; KPMG; Kroll; Kudelski Security; Kyndryl; Leidos; Leonardo; Malwarebytes; Millennium Corporation; NCS; NGC Risk; NTT DATA; Orange Cyberdefense; Parsons; Peraton; Proximus NXT; PwC; Quorum Cyber; Rackspace Technology; Red Canary; SAIC; SonicWall; Sophos; Stellar Cyber; Tata Consultancy Services; Tenfold Security; Third Wave Innovations; Trail of Bits; Trustwave; UltraViolet Cyber; UnderDefense; Unisys; UST; Veeam; Wipro. On our reading, the list mixes MDR specialists, response firms, product vendors and large IT services and consulting groups, so the overlap with Sygnia differs from name to name. Profiles are on the vendor pages.

Sygnia's own pages draw the lines in a few places. On MDR, its page states that "Most MDR vendors cover IT environments only" and argues that because Velocity was built for incident response and forensic investigation, it is not constrained by environment type or operating system. That ties back to the OT claim noted earlier.

On incident response, the company says its service offers support from start to finish that removes the burden of managing multiple vendors, and that engagements are "delivered exclusively by in-house Sygnia experts", its page states. On the advisory side, the home page describes its proactive work as drawing on "front-line knowledge of attacker motivations and TTPs" to prioritise security roadmaps. The same page describes the company as combining global reach with "a boutique, highly engaged approach" grounded in more than a decade of incident response work.

On our reading, the common thread across these pages is that Sygnia presents incident response as the origin of its MDR and advisory offerings, not as a separate line of business sitting beside them.

Funding, investors and growth

Sygnia's capital history is short. It did not raise a sequence of venture rounds. It moved from an incubator launch to a single owner.

The company's story page states it was founded in 2015 and launched from the Team8 cybersecurity foundry. Team8 disclosed the official launch at its Rethink Cyber event in New York. The same story page names Microsoft, Intel, Cisco, Qualcomm, Temasek and Innovation Endeavors among its investors and partners. TechCrunch reported a narrower picture of direct funding: Team8 had put $4.3 million into Sygnia, "the only outside funding the startup had ever taken." Our reading is that the larger names reached Sygnia mainly through Team8 rather than through a Sygnia round. No source given here states that directly.

In 2018 Sygnia said it would be acquired by Temasek Holdings, subject to customary signing and closing conditions. The price was not officially disclosed, and Temasek declined to comment on the size of the deal. A source close to the deal told TechCrunch that Temasek was buying Sygnia for $250 million, and a source told CNBC the same figure. That reported price is the only valuation any source here gives.

On the purpose of the deal, Shachar Levy said aligning with Temasek would "allow us to accelerate building our global reach". The company said it would keep its operational independence while working with Temasek's portfolio companies. It also said it had no plans to move its Tel Aviv headquarters and expected a presence in Singapore. TechCrunch read the sale as securing "a dedicated and large-pocketed owner" to help it scale.

Day to day the company is now run by Guy Segal, whom its leadership page lists as chief executive. The page says he oversees the company's strategy, operations, and continued growth.

Temasek ownership still shapes the company. Its page describes Sygnia as a Temasek International company since 2018 and a member of the ISTARI Collective. The board is chaired by Rashmy Chatterjee, CEO of ISTARI, which the leadership page calls "the global cybersecurity platform established by Temasek". Two further directors, Keat Chuan Yeoh and Reuben Low, hold Temasek roles.

For scale, the story page lists offices in Tel Aviv, New York, Singapore, London, Mexico City and Sydney and 250+ team members. The October 2026 announcement covered earlier also carried growth figures, which are the company's own. It cited a 40% year-over-year increase in IR projects from H1 2025 to H1 2026 and said MDR ARR was growing 50%, across North America, LATAM, EMEA and APJ.

Customers, partners and public evidence

Sygnia's public evidence was thin at the start. When Temasek bought the company in 2018, TechCrunch reported that it did not name specific customers or the incidents it had handled. The current site names more. Its homepage claims 500 clients worldwide, including Fortune 500 and Global 2000 companies.

Named customers and case studies. The case study archive lists a joint piece with Oregon Lottery. The company says that work grew from one small engagement into a multi-year programme. The homepage quotes Matt Boddington, Supervisor Information Security at Oregon Lottery: "We were able to go home after work and not lose sleep." The archive also carries a Repsol case study on relationship-led delivery. The other studies leave the client unnamed. One describes MDR work for a semiconductor manufacturer in a visibility-constrained SCADA environment. Another covers an unidentified device in an oil and gas organisation's OT environment. A third is a case study of the Bybit heist. The listing does not say whether Bybit was a client.

Analyst mentions and awards. Sygnia's incident response page says the company was named in the 2026 Gartner Market Guide for Cybersecurity Incident Response Retainer Services for the fifth consecutive time. A company press release said Sygnia appeared in a Gartner Market Guide for DFIR services that was published on July 23, 2025. The homepage also says it was recognised in the 2026 Gartner Hype Cycle for CPS Security. The newsroom lists an earlier item: Sygnia was shortlisted in two categories of the 2022 SC Awards Europe.

Certification and marketplace. The Velocity page states that Sygnia was audited against the AICPA's SOC 2 Type II standards, covering the Security, Availability and Confidentiality criteria. On the partner side, the company said it joined the AWS ISV Accelerate Program and listed its MDR, with bundled incident response support, on AWS Marketplace.

Published figures and research. A paid press release from October 2026 said Sygnia was processing more than 5 billion log items a day. The company also publishes its own benchmark research. Its CISO Survey 2026 drew on 600 senior IT security decision makers, and its headline finding was that 73% of CISOs were not fully ready for a major cyberattack. This is vendor-commissioned research. Readers comparing it with other reports should treat it that way.

Research, open source and public work

Sygnia publishes most of its research as threat reports, blog investigations and webinars built on its incident response work.

The Velvet Ant write-up is summarised as "How a China-Nexus Actor Infiltrated an Internal Network Undetected". A third report, on a group Sygnia named Emperor Dragonfly, argued that Night Sky and Cheerscrypt were a single ransomware group.

Software supply chain abuse is a second strand. The homepage featured "Shai-Hulud Returns: When Software Trust Becomes the Attack Surface", and a related blog described how Shai-Hulud exposes credentials across CI/CD environments. An earlier advisory, "16 Minutes to Impact", covered a compromise of npm packages that, the company says, enabled cryptocurrency theft by manipulating transactions in browser-based wallets.

Other write-ups followed specific criminal operations. One described how the SafePay ransomware group abused OneDrive to exfiltrate data over ordinary HTTPS traffic. A recorded webinar on North Korean IT workers walked through a case in which, its page states, attackers turned Zoom into a RAT and used ARP for covert command delivery. Separate research on Azure AD Connect described attack vectors involving credential and NT hash extraction.

The company has released at least two open-source tools. Cloud Scout maps cloud and hybrid environments to find attack paths. Mirage is aimed at incident response in Google Workspace and Google Cloud.

Longer reports sit alongside this work. The 2025 Annual Threat Report drew on Sygnia's response engagements during 2024 and covered ransomware readiness, identity governance and critical infrastructure. A 2026 ebook on the crypto threat environment set out four security domains for protecting digital assets. A press release reported that a Sygnia penetration test found "vibe coded" vulnerabilities in a Claude-based application, and the company tied that finding to the launch of its AI security services. The CISO survey mentioned earlier belongs in the same body of published material.

What a CISO should ask before buying

These questions are our reading of what Sygnia's own pages and announcements invite a buyer to test. Each one ties to a claim the company makes, and a proof of concept is the place to check it.

1. Alert resolution. The MDR page says the service is built to resolve 95% of alerts without involving your team. Ask how that share is counted and over what period. Ask what it would have been on your own alert stream during the trial.
2. Detection plan. Plans contain up to 200 detection rules, split across baseline, custom and IR-based types. Ask to see a draft plan for your environment and how many of its rules are custom.
3. Data paths. Velocity offers three forms of data integration, one of them manual log upload. Ask which of your sources would fall into the manual route and what delay that adds.
4. Scale. The platform page states it can ingest up to 30 TB per day. Run the trial at your peak volume and time queries under that load.
5. Endpoint agent. The company says the Pathfinder agent uses 10MB of memory when idle and checks in every 60 seconds. Install it on your standard builds next to your EDR and measure.
6. Where data lives. Enriched data is stored in the Snowflake data lake. Ask about region, retention, encryption keys and how you export your data if the contract ends.
7. AI in the pipeline. Sygnia says AI classifies and normalises data at ingestion. Ask which models do this and whether your data trains them. Ask how misclassification is caught.
8. Automated containment. The October announcement said clients can decide which containment actions to automate. Ask for the full list of actions, the default settings and who approves a change.
9. Moving to IR. The company says pivoting from MDR to incident response is as simple as flipping a switch, with clients IR-ready with complete forensic data. Ask what the contract says about fees, response times and staffing once that happens.
10. Legacy OT. Sygnia says its MDR reaches legacy OT systems that cannot take more intrusive tools. Ask how collection works on those systems and whether it is passive. Ask for a reference with a comparable site.
11. In-house delivery. IR engagements are delivered exclusively by in-house Sygnia experts, and the service includes ransomware negotiators. Ask whether the in-house commitment covers negotiation and work in your region, and put it in the contract.

Timeline

Sygnia's dated record runs from a 2015 founding inside an Israeli company builder, through a 2018 sale to a Singapore investor, to a run of reports, case studies and operational announcements in 2026. The milestones below come from the company's own pages, its first backer's launch announcement and press coverage of the sale. Research releases and product details covered in earlier sections are not repeated here.

The chart counts the dated milestones cited in this profile by year.

Chart data: Milestones cited in this profile; most from Sygnia: Story and Values - Sygnia.

• 2015. Sygnia was founded by veterans of Unit 8200 and launched from the Team8 foundry, according to its story page.
• October 2018. Sygnia said it would be acquired by Temasek Holdings, subject to customary signing and closing conditions, and would keep its operational independence, CNBC reported. Terms were not disclosed. A source told CNBC the price was $250 million. TechCrunch reported that Team8's $4.3 million had been the only outside funding the company took. Sygnia's own page states it has been a Temasek International company since 2018.
• 2022. Sygnia was shortlisted in two categories of the 2022 SC Awards Europe.
• July 2025. Sygnia said it was positioned in a Gartner Market Guide for DFIR services that was published on July 23, 2025.
• January 2026. Sygnia published a case study on its work with Repsol, framed as relationship-led delivery.
• Early 2026. Sygnia ran a CISO survey of 600 senior IT security decision makers, with fieldwork in January and February 2026. Its headline finding was that "73% of CISOs aren’t fully ready for a major cyberattack."
• 2026. The company says it was named in the 2026 Gartner Market Guide for incident response retainer services for the fifth consecutive time.
• October 11, 2026. Sygnia announced the new MDR hubs described earlier. The release, a paid distribution, said the number of IR projects it fielded rose 40% year over year from H1 2025 to H1 2026.

The gap between 2018 and 2025 is our reading of the sources supplied, which carry few dated milestones for those years. It should not be taken as a sign that the company stood still in that period.