Silverfort

1.1 Identity, Footprint, and Business Model

A third-party company profile dates Silverfort's founding to 2016 and names Hed Kovetz, Yaron Kassner, and Matan Fattal as founders. Silverfort's own current website describes a runtime identity-security platform that integrates with Active Directory, cloud identity providers, SaaS, legacy systems, and operational technology, then allows, challenges, or blocks access requests. This establishes the product positioning, not independently verified efficacy. The same third-party profile is internally inconsistent on headquarters: it presents Tel Aviv as headquarters in one field but separately lists a Plano, Texas address and answers Plano in its FAQ. The chapter therefore treats Tel Aviv as the reported operating center and Plano as a reported U.S. location, rather than asserting a single verified legal headquarters. A May 2024 company release also describes a channel-first model with more than 90% of revenue flowing through partners.[CO001, CO002, CO003, CO004, CO015]

1.2 Capitalization and Public Scale Signals

Public financing evidence supports a January 2024 Series D of $116M led by Brighton Park Capital. Silverfort said the round brought total funding to $222M, while the assigned third-party profile reports $223M; the $1M difference is preserved rather than averaged away. TechCrunch reported that its reliable sources put the valuation at around $1B, and the profile independently lists a $1B January 2024 valuation, but neither figure is a current October 2026 mark. Operating scale disclosures are also dated and largely company-issued: Silverfort said ARR grew more than 100% in 2023 while adding tens of millions in new ARR, and both Silverfort and TechCrunch described more than 100 new customers per quarter around the financing. A February 2025 company-issued release claimed more than 1,000 customers and more than 450 employees. No assigned source discloses current revenue, audited ARR, profitability, cash balance, burn, or runway.[CO005, CO006, CO007, CO008, CO009, CO011, CO012, CO013, CO014]

1.3 Leadership and Governance Coverage

The assigned evidence identifies co-founder Hed Kovetz as chief executive and co-founder Yaron Kassner as chief technology officer. The third-party profile additionally lists Howard Greenfield as president and chief revenue officer, Irena Meadan as chief financial officer, Tarah Cammett as chief marketing officer, and Michelle Wideman as chief customer officer. Those titles are current-page observations from a lower-reputation profile, not confirmations from an assigned official leadership page. The January 2024 financing added Brighton Park Capital co-founder Mike Gregoire to the board, according to both Silverfort and TechCrunch. Founder concentration is material because the founders remain the clearest public anchors for product strategy and external positioning, but the available sources do not establish the complete board, voting rights, committee composition, succession plan, or whether Matan Fattal retains an operating role. These are governance gaps rather than grounds for precise control conclusions.[CO001, CO010]

1.4 Milestones and Diligence Implications

Silverfort's public trajectory runs from a 2016 founding through four disclosed priced rounds, a May 2024 channel-program push, a February 2025 platform rebrand, and the April 2026 acquisition of Fabrix Security. The Fabrix announcement says most joint capabilities would become available in the second half of 2026, so the acquisition is a strategic milestone rather than proof that the combined roadmap was delivered by the run date. It is also a company-issued release syndicated by PR Newswire, not independent transaction reporting, and it discloses neither purchase consideration nor financing terms. The assigned pool contains no regulator, court, or independently critical incident source. That absence cannot establish that Silverfort has had no legal, regulatory, outage, breach, leadership-change, or customer-concentration issue. The defensible overview is therefore a well-funded, founder-led identity-security vendor with dated growth signals, a partner-led distribution model, and material private-company information gaps.[CO001, CO005, CO006, CO013, CO014, CO015, CO016]

1.5 Exhibits

2.1 Market Boundary, Category Scope, and Spend Classification

The identity security landscape is undergoing structural category decoupling where identity infrastructure management separates from identity protection and runtime threat response [CM001, CM006]. The enterprise spend addressable by Silverfort is centered on Identity Threat Detection and Response (ITDR), non-human identity (NHI) protection, and legacy protocol MFA enforcement across hybrid Active Directory and multi-cloud environments [CM001, CM002, CM007]. Included spend encompasses runtime access protection licenses, service account visibility tooling, and agentless MFA extensions for command-line and operational technology (OT) protocols [CM002, CM008]. Conversely, excluded spend comprises core identity provider (IdP) directory directories like Okta workforce seats or Entra ID tenant licensing, broad endpoint detection and response (EDR) agent software, and general data loss prevention platforms [CM001, CM003]. Security organizations increasingly treat authentication defense as an independent control plane rather than an unmonitored feature of directory directories [CM006, CM009].[CM001, CM002, CM003, CM006, CM007, CM008, CM009]

2.2 Addressable Market Sizing, Pricing Dispersion, and Economics

Evaluating the ITDR market requires analyzing three distinct go-to-market architectures and pricing benchmarks rather than relying on a single top-down total addressable market figure [CM003, CM004, CM014]. In enterprise deployments, pricing models vary widely from native suite bundles such as Microsoft Defender for Identity ($5.50 per user per month standalone or included in M365 E5) to EDR-add-on modules such as CrowdStrike Falcon Identity Threat Protection (~$124.99 per identity per year list price) and standalone custom-quoted platforms like Silverfort [CM003, CM004, CM005]. For a representative 5,000-seat enterprise deployment, published benchmark models demonstrate an annual software expenditure baseline of approximately $330,000 for standalone Defender for Identity and $624,950 for CrowdStrike Falcon Identity Threat Protection before discounting, while Silverfort deal sizes remain privately negotiated through multi-tiered plans [CM004, CM005]. Macro ITDR search volume and category engagement reflect steady enterprise evaluation growth as credential compromise accounts for the vast majority of ransomware intrusions [CM001, CM009, CM010].[CM001, CM003, CM004, CM005, CM009, CM010, CM014]

2.3 Buyer Segmentation, Budget Allocation, and Adoption Constraints

Adoption of runtime identity protection is governed by specific enterprise buying centers, operational constraints, and commercial procurement pathways [CM011, CM012, CM013]. Enterprise CISOs and Identity and Access Management (IAM) leadership serve as the primary budget owners and executive sponsors, while Security Operations Center (SOC) engineering teams manage alert triage and incident response [CM001, CM008, CM011]. Major enterprise rollouts highlight the operational complexity of managing diverse populations, where corporate identity teams must balance risk reduction against business enablement across massive distributed and franchised workforces [CM011, CM012]. On the distribution side, commercial traction is heavily enabled by global channel partner networks and cyber insurance underwriting mandates that enforce MFA across legacy assets and service accounts [CM007, CM013]. However, long-term market penetration encounters adoption friction from enterprise suite bundling, complex custom policy design, and legacy client authentication dependencies [CM003, CM014, CM015].[CM001, CM003, CM007, CM008, CM011, CM012, CM013, CM014, CM015]

2.4 Exhibits

3.1 Enterprise Identity Security Landscape & Taxonomy

The identity security landscape spans core cloud identity providers, privileged access management incumbents, specialized identity threat detection and response tools, and legacy directory architectures. Core cloud IdPs like Okta and Microsoft Entra ID secure modern SaaS and SAML/OIDC federated protocols but leave substantial visibility and policy enforcement blind spots across legacy on-premises Active Directory domains, command-line interfaces, and non-human service accounts. Silverfort differentiates its Runtime Access Protection architecture by integrating natively into directory authentication flows to enforce adaptive access and multi-factor authentication without software agents or inline proxy re-routing. Rather than seeking to displace incumbent directory suites, Silverfort operates as a decoupled security layer behind enterprise IdPs, while simultaneously competing against PAM specialists such as Delinea and native directory extensions.[CP001, CP002, CP003, CP004, CP005]

3.2 Capability Analysis & Evaluation Matrix

Enterprise access management procurement prioritizes authentication assurance, directory integration depth, lifecycle automation, and operational resilience under real incident conditions. In head-to-head evaluations, Silverfort scores high marks in enterprise directory integration and legacy protocol coverage, securing Kerberos, NTLM, and machine service accounts that traditional access managers fail to address. However, independent procurement benchmarks indicate that Silverfort's pricing is quote-based and frequently perceived as expensive for broader deployments, while deep legacy deployments require sophisticated configuration. Incumbents like Delinea dominate traditional credential vaulting and session management in PAM, whereas native IdP suites focus predominantly on cloud-native workflows and SaaS federation. The matrix below benchmarks key technical capabilities and operational tradeoffs across representative alternative architectures.[CP006, CP007, CP008, CP009, CP010]

3.3 Moat Durability, Channel Power & Displacement Risks

Silverfort's competitive defensibility relies on its patented Runtime Access Protection architecture, broad non-human identity coverage, and rapid deployment velocity. The company's go-to-market motion is driven by a global partner program where over 90 percent of revenues flow through channel partners and systems integrators, creating significant distribution leverage across enterprise accounts. Nevertheless, structural switching costs are balanced by competitive risks: core platform vendors like Microsoft continually enhance native identity threat detection, and point-solution sprawl creates pressure on CISOs to consolidate security stacks. Furthermore, customer procurement feedback highlights potential upgrade friction and specialized logging overhead. Silverfort's long-term moat durability depends on maintaining technical leadership in agentless cross-silo identity protection before major directory providers bridge the on-prem runtime enforcement gap.[CP011, CP012, CP013, CP014, CP015]

3.4 Exhibits

4.1 Revenue Model, Pricing Mechanics, and Commercial Architecture

Silverfort commercializes its Runtime Access Protection platform through enterprise software subscriptions, selling multi-factor authentication, identity threat detection and response, and privileged access security across hybrid Active Directory, cloud, and non-human identity environments. Enterprise pricing is quote-based and customized to organizational scope, reflecting protected user volumes, domain controllers, and non-human identities rather than transparent per-seat self-service tiers. In third-party access management procurement comparisons against competitors such as Transmit Security, reviewers identify Silverfort's pricing as high or quote-based, noting that deep legacy implementations require deliberate rollout planning. Contracts are structured as multi-year annual recurring subscriptions with enterprise support and service-level agreements. Revenue recognition follows standard SaaS subscription principles, but realized software-versus-services contract mix, professional services fees, and enterprise discounting structures remain strictly non-public.[CI001, CI002, CI003, CI004]

4.2 Go-to-Market Motion, Channel Economics, and Sales Efficiency

Silverfort's commercial expansion is executed through a 100% channel-first distribution architecture directed by executive leadership, including Chief Financial Officer Irena Meaden and Vice President of Global Channels Leslie Bois. More than 90% of total company revenues flow directly through channel partners—reaching 100% in selected international operating regions—leveraging value-added resellers, systems integrators, and cyber insurance alliances. Company disclosures indicate rapid top-line momentum, with revenues expanding more than 100% year-over-year following the channel transition, alongside onboarding over 100 net-new enterprise customers per quarter. Partner program tiers provide tiered margin discounts, co-marketing allowances, and technical enablement via the Silverfort Academy portal. By offloading primary customer acquisition and frontline implementation to channel partners, Silverfort benefits from sales leverage, though partner commission spreads and unverified customer acquisition costs obscure underlying GAAP sales efficiency.[CI005, CI006, CI007, CI008, CI009]

4.3 Capital Adequacy, Financing Structure, and Underwriting Diligence Gaps

Silverfort has raised a cumulative total of $222M to $223.34M in equity financing across five institutional rounds, culminating in a $116M Series D round in January 2024 led by Brighton Park Capital alongside Acrew Capital, Greenfield Partners, Citi Ventures, GM Ventures, Singtel Innov8, Maor Investments, and Vintage Investment Partners. Media and secondary market sources benchmark post-money valuation between $698.21M (Series D legal cap-table modeling reported by Forge Global at $1.57 per share across 74.3M shares outstanding) and $1.0B in TechCrunch and Tracxn financial reporting. While the $116M Series D provides multi-year balance sheet runway, Silverfort provides no public disclosure of GAAP net burn, cash reserves, gross margins, or net revenue retention cohorts. Evaluating long-term capital self-sufficiency is constrained by these private reporting gaps, making confirmation of unit economics and cash runway an essential diligence requirement.[CI010, CI011, CI012, CI013, CI014]

4.4 Exhibits

5.1 Runtime Access Protection and Directory-Layer Architecture

Silverfort's architectural foundation centers on Runtime Access Protection (RAP), an approach designed to bypass the operational and security trade-offs of legacy endpoint agents and network proxies. Rather than deploying software on every managed workstation or routing application traffic through inline network appliances, Silverfort integrates directly at the identity provider (IdP) layer. For on-premises Active Directory environments, domain controllers forward authentication requests to Silverfort for automated risk analysis before granting or denying access. Silverfort evaluates contextual risk indicators in real time; if elevated risk or sensitive access policies require step-up authentication, Silverfort dispatches a multi-factor authentication (MFA) challenge via its messaging service to the requesting user. Only upon successful challenge completion does Silverfort instruct Active Directory to issue authentication tickets or allow access, ensuring that unprotectable protocols like Kerberos and NTLM receive modern zero-trust policy enforcement without local endpoint modifications.[CE001, CE002, CE004, CE005, CE008]

5.2 Product Suite, Module Scope, and Unprotectable Asset Coverage

The Silverfort platform encompasses several core functional modules that address distinct enterprise identity attack surfaces. Universal Multi-Factor Authentication extends step-up challenges across systems lacking native MFA hooks, including Remote Desktop Protocol (RDP), command-line tools like PsExec and Remote PowerShell, legacy applications, CIFS file shares, and air-gapped industrial infrastructure. Identity Threat Detection and Response (ITDR) monitors authentication telemetry across human, non-human, and machine identities, identifying credential misuse, lateral movement, and privilege escalation attempts. Non-Human Identity (NHI) and Service Account Protection discovers machine identities dynamically by observing live authentications, establishing baseline behavioral profiles without requiring credential rotation in legacy services. Privileged Access Security (PAS) and Identity-First Incident Response provide targeted containment mechanisms, enabling security teams to isolate compromised accounts and block lateral movement during active breaches. These capabilities expanded through the November 2024 acquisition of Rezonate for cloud identity posture management and the April 2026 acquisition of Fabrix Security for AI agent security.[CE002, CE004, CE007, CE009, CE010, CE013]

5.3 Integration Ecosystem, Enterprise Deployments, and Diligence Caveats

Enterprise integration relies on two primary mechanisms: deep directory bridging and the Silverfort Integration Hub cloud service. For hybrid environments, Silverfort bridges on-premises Active Directory assets into Microsoft Entra ID, surfacing legacy systems as enterprise applications subject to Conditional Access and single-sign-on policies without requiring application code rewrites. The Silverfort Integration Hub, introduced in version 5.1.2, connects deployments with external security ecosystems, supporting real-time alerts, SIEM integrations with Splunk and Microsoft Sentinel, and planned bidirectional Shared Signals Framework (SSF) exchanges with XDR and EDR platforms. Despite broad commercial adoption among major global enterprises, technical diligence reveals notable transparency gaps: Silverfort's public documentation does not fully disclose protocol-level packet inspection mechanics, and its trust center is login-gated with public compliance pages returning 404 errors, preventing independent audit of SOC 2 Type II and ISO 27001 attestations from primary public surfaces.[CE003, CE004, CE006, CE011, CE012, CE014]

5.4 Exhibits

6.1 Enterprise Customer Segmentation and Go-to-Market Deployment Models

Silverfort targets hybrid enterprise environments where legacy corporate infrastructure intersects with distributed cloud applications and software-as-a-service platforms [CU001, CU006]. The company categorizes its customer accounts into four operational tiers: Strategic Global Accounts, Enterprise Core Accounts, Mid-Market Commercial Organizations, and Digital Touch or Tech-Touch customers [CU002, CU011]. Commercial procurement is structured around IT and security operations teams, identity and access management architects, and Chief Information Security Officers driven by compliance mandates and cyber insurance underwriting requirements [CU001, CU007]. Rather than deploying client software agents or modifying mission-critical legacy domain controllers, Silverfort operates via an agentless runtime architecture that monitors authentication protocols across Active Directory, Kerberos, LDAP, NTLM, SSH, RDP, and cloud identity providers [CU005, CU006]. Delivery across these operational tiers is executed through an indirect channel-first model, where specialized value-added distributors and regional security solution providers manage software distribution, partner enablement, customer onboarding, and tier-one administrative support [CU007, CU008].

6.2 Customer Footprint Expansion, Authentication Scale, and Organizational Governance

Silverfort's customer growth trajectory reflects rapid enterprise adoption, expanding from early enterprise deployments to a customer base exceeding 1,000 corporate clients globally, including multiple Fortune 50 and Fortune 100 corporations [CU001, CU002]. This organizational footprint is accompanied by significant operational transaction volume, with Silverfort's runtime access protection engine actively inspecting and verifying more than 10 billion authentications daily across on-premises and hybrid customer environments [CU001, CU014]. Enterprise adoption has been substantially accelerated by regulatory compliance deadlines and rigorous cyber insurance underwriting frameworks, such as New York Department of Financial Services 23 NYCRR 500 regulations, PCI-DSS requirements, and Federal Zero Trust executive directives [CU007]. To govern account health and scale customer retention across this growing international base, Silverfort maintains formal customer success leadership covering account planning, quarterly business reviews, customer health scoring, and multi-segment escalation workflows [CU002, CU011, CU013]. However, because Silverfort operates as a privately held venture-backed vendor, definitive quantitative retention indicators such as net revenue retention, gross revenue retention, and annual gross logo churn percentages remain non-disclosed private operating metrics [CU002, CU012].

6.3 Named Customer Proof, Strategic Alliances, and Operational Limitations

Publicly verifiable customer deployments and strategic alliances validate Silverfort's core functional utility across mission-critical enterprise environments [CU003, CU004, CU007]. Prominent international organizations across critical infrastructure, transportation, aerospace, retail, and telecommunications—including Airbus, Channel 4, Coop, Kayak, Ryanair, Rio Tinto, Swiss Automotive Group, Singtel, and UPS—utilize Silverfort to discover unprotected identities and enforce multi-factor authentication across legacy infrastructure [CU001, CU014]. In addition to commercial corporate customers, Silverfort has expanded its deployment surface through strategic technology alliances, such as its joint runtime security framework with SentinelOne, which integrates autonomous endpoint threat detection with runtime identity verification to defend against automated AI agents and compromised software supply chains [CU003, CU004]. Despite these marquee references, public evidence regarding customer experience is constrained: individual contract sizes, deployment seat counts, and expansion timelines are shielded by enterprise non-disclosure agreements, leaving third-party practitioners to evaluate adoption primarily through partner integrations and recruiter job postings rather than transparent user benchmarks [CU005, CU010, CU015].

6.4 Exhibits

7.1 Regulatory Mandates, Compliance Drivers, and Cyber Insurance Vulnerability

Silverfort's value proposition is closely linked to external regulatory mandates and tightening cyber insurance standards that compel enterprises to implement multi-factor authentication across hybrid, legacy, and command-line environments. Cyber insurers increasingly require comprehensive MFA across admin accounts, remote access, cloud applications, and automated service accounts as a precondition for underwriting coverage, citing credential theft as the primary driver of enterprise breaches and ransomware claims. While Silverfort positions its agentless architecture to satisfy these strict cyber underwriting criteria and compliance frameworks including PCI-DSS, NY-DFS, and zero-trust directives, its commercial pipeline remains vulnerable to shifting insurer validation methodologies and emerging requirements for phishing-resistant hardware credentials such as FIDO2 that bypass proxy-based controls. Furthermore, as an enterprise security vendor handling sensitive authentication verdicts across multinational clients, Silverfort faces ongoing compliance overhead across conflicting international data protection regimes and dual-use export control standards that could constrain public sector and sovereign cloud sales.[CR001, CR002, CR003, CR004]

7.2 Operational Failure Modes, Inline Architecture Sensitivity, and Research Scrutiny

Operating as an inline identity verification layer introduces severe technical and operational failure risks where software defects or routing latency could block legitimate enterprise workforce access. Silverfort's Runtime Access Protection intercepts authentication traffic across Active Directory, cloud identity providers, and operational technology without deploying local endpoint agents, creating single-point-of-failure sensitivity at the identity infrastructure boundary. The company's active public threat research program, exemplified by its publication disclosing critical RPC vulnerabilities in agentic skill repositories like ClawHub, demonstrates sophisticated offensive discovery capabilities but also highlights the systemic supply-chain exposure inherent in third-party integrations and developer ecosystems. If Silverfort's own proxy infrastructure or cloud platform were subjected to credential abuse, false-positive authentication denials, or supply-chain manipulation, customer production workloads and enterprise directory operations would experience immediate disruption.[CR005, CR006, CR007, CR008]

7.3 Channel Concentration, Commercial Dependencies, and Unaudited Valuation Multiples

Silverfort has structured its commercial go-to-market as an exclusively indirect channel-first model, creating substantial operational dependency on third-party security distributors and value-added resellers. Following the transition to a dedicated channel-led organization, more than 90% of company revenues flow directly through its channel program, and in several geographic regions 100% of revenue is partner-mediated. While this ecosystem structure enables rapid enterprise penetration across more than 1,000 corporate customers, it exposes Silverfort to distributor margin compression, partner conflict, and pipeline opacity where the company lacks direct billing relationships with end buyers. Concurrently, third-party business directories estimate Silverfort's employee base at roughly 633 staff and assert modeled revenue ranges of $500M to $1B, which sharply diverge from verified primary financing benchmarks recording ARR in the tens of millions of dollars at its $116 million Series D round. In the absence of audited GAAP financial disclosures covering net revenue retention, gross margins, and burn rate, late-stage investors risk underwriting an unverified private valuation premium that could precipitate substantial multiple compression in public markets.[CR009, CR010, CR011, CR012, CR013, CR014]

7.4 Exhibits

8.1 Investment Thesis and Core Anti-Thesis

Silverfort presents a compelling operational thesis built upon its agentless Runtime Access Protection architecture, which secures Active Directory, legacy applications, command-line interfaces, and industrial operational technology without requiring endpoint modifications. The enterprise perimeter has fragmented, with identity misuse representing the principal vector in ransomware and corporate intrusions. Silverfort's ability to act as an inline second opinion across disparate identity providers positions the company advantageously in identity threat detection and response. Conversely, the anti-thesis centers on the complete absence of publicly verified GAAP financials, audited annual recurring revenue, and net revenue retention disclosures. Furthermore, platform expansion into agentic AI security via the acquisition of early-stage startups introduces execution risk, while competitive pressure from incumbent identity providers remains an enduring risk factor.[CV001, CV002, CV003, CV004, CV005]

8.2 Recommendation Stance, Governance, and Valuation Multiples

Evaluating Silverfort under disciplined late-stage investment criteria leads to an explicit recommendation of track, paired with high author confidence, high risk rating, and a valuation stance characterized as stretched. The benchmark transaction remains the January 2024 Series D round of $116 million led by Brighton Park Capital at a post-money valuation of approximately $1.0 billion to $1.5 billion. While commercial momentum is reflected in channel revenues growing over 100% year-over-year and channel sales accounting for more than 90% of total revenue, underwriting a premium growth multiple requires auditable evidence of gross margin profile, customer acquisition efficiency, and net expansion across the 1,000+ enterprise accounts. In the absence of audited recurring revenue figures, paying top-quartile cybersecurity ARR multiples exposes capital to compression if growth decelerates.[CV006, CV007, CV008, CV009, CV010]

8.3 Scenario Analysis, M&A Capital Allocation, and Dilution Overhang

Capital structure and scenario modeling must account for cumulative equity funding of $211 million to $222 million across Series Seed through Series D, supplemented by active M&A capital deployment. On April 28, 2026, Silverfort announced the acquisition of Fabrix Security, an AI-native identity startup founded in 2025 with $8 million in prior seed funding, for an estimated $30 million transaction value. This transaction represents an aggressive strategic push into autonomous runtime access control for agentic identities. Our scenario framework evaluates a bull case driven by successful runtime AI monetization and market multiple expansion, a base case reflecting steady enterprise expansion within hybrid on-premises environments, and a bear case triggered by multiple compression, delayed AI integration, or slower channel velocity.[CV011, CV012, CV013, CV014, CV015, CV016]

8.4 Exit Horizons, Liquidity Timing, and Diligence Asks

Silverfort's exit horizons encompass an initial public offering or a strategic acquisition by a global cybersecurity or cloud platform aggregator. However, institutional liquidity preparation demands immediate clarification on specific structural diligence items. Key management appointments, including Chief Financial Officer Irena Meaden, Chief Customer Officer Michelle Wideman, Chief Marketing Officer Tarah Cammett, and VP of Global Channels Leslie Bois, provide essential organizational infrastructure for scaling. Final diligence kill criteria and underwriting priorities require inspecting audited cohort retention tables, customer concentration across the top twenty enterprise accounts, gross margin composition across software and deployment services, and verified post-acquisition retention of the acquired Fabrix engineering team.[CV005, CV010, CV014, CV015]

8.5 Exhibits