HarfangLab: endpoint security and European customer relationships

HarfangLab is a French cybersecurity company focused on the computers and servers used inside organisations. Its offering has expanded from endpoint detection and response, or EDR, into endpoint protection and visibility across a customer's digital assets. A distinguishing commercial feature is the choice of cloud or local deployment, alongside integration with security tools that customers already operate.

The company serves both direct enterprise relationships and a network of managed security service providers. Its public record is unusually useful in separating those arrangements: named customer testimony explains implementation choices, while product and distribution announcements show how the business is widening its offering. HarfangLab's company description

Ownership and company figures

HarfangLab identifies itself as privately held. Its governance page names the four co-founders and the investors Elaia, Crédit Mutuel Innovation and MassMutual Ventures following the 2023 financing round. The current public description does not publish their individual ownership percentages. The French government's enterprise record identifies the legal entity and its registered office in Puteaux, near Paris. Governance description and official company record

The careers page states 130-plus employees. That is an undated company disclosure, so it provides an approximate scale boundary rather than an exact workforce at a specified year end. The same page describes €30 million of financing, which is consistent with the company's public history of separate funding rounds and is not a turnover figure. Workforce disclosure

An October 2023 announcement detailed a €25 million round led by Crédit Mutuel Innovation, with MassMutual Ventures and Elaia participating. The intended uses included international development, research and recruitment. Financing announcement

The accessible government financial record reports €2,206,250 of turnover for 2022. That is historical legal-entity revenue, not an estimate of the company's current sales. It predates the larger financing round and the later expansion of its product range. No current revenue number is established by the accessible primary records.

How the product range has widened

The original EDR product helps a security team identify and investigate activity on endpoints. That creates a continuing connection between the customer's devices, the information available to its analysts and the wider security systems used to manage incidents.

The 2024 IKARUS partnership added a specific technology supplier relationship. HarfangLab's announcement described an endpoint protection offering incorporating IKARUS's anti-malware engine, together with capabilities developed by HarfangLab. It also described a commercial role for IKARUS in delivering the combined offering to customers. This is useful evidence of a product built with a named partner, rather than an entirely self-contained technology stack. IKARUS partnership

In September 2025, HarfangLab announced Scout, an attack-surface management product integrated into the platform. Its stated purpose includes visibility of digital assets and vulnerability information. The release distinguished available functions from additional compliance features planned for 2026. A planned feature in that earlier announcement should not be assumed to have shipped merely because its intended date has passed. Scout launch

The commercial direction is clear: HarfangLab is seeking a broader role around the endpoint estate. A customer may want incident investigation, preventative protection or a clearer inventory of what needs attention. Combining those functions can simplify a supplier relationship, but the relevant product package still depends on which problem the customer is trying to solve.

Certification is specific evidence with a defined scope

ANSSI's public certification report provides a concrete reference: report 2024/07 concerns HarfangLab EDR version 3.0.4 and is dated 22 August 2024. The agency explicitly explains that certification concerns the evaluated product under defined conditions and is not a general recommendation or a guarantee that vulnerabilities cannot exist. ANSSI report

HarfangLab's own explanation makes another useful distinction. It says CSPN certification concerns the security and robustness of the product, rather than its detection rate. That is more informative than interpreting an agency logo as a universal measure of effectiveness. Company explanation of the scope

The company also announced German BSI certification in January 2026. That announcement adds a dated European market-development milestone, while the precise version and conditions should be taken from the relevant certificate when evaluating a proposed deployment. German certification announcement

For a supplier operating in regulated environments, these records can support customer evaluation. They do not remove the need to match the software version, hosting arrangement and support responsibility to the actual project. BDI's Second Front Systems profile examines another business shaped by the relationship between software delivery and institutional acceptance.

Proton explains why integration matters

The named Proton case study describes the use of HarfangLab EDR on the company's workstations. Proton's security representative identifies an existing environment with different operating systems and an interest in openness and local deployment. This is a particular customer account, not an anonymous claim about universal adoption. Proton case study

The timing in the account is commercially revealing. Initial deployment took days, while configuration took longer and integration with the customer's broader security information system extended over roughly a quarter alongside other priorities. Those stages show why installing an endpoint agent and completing a useful organisational deployment are different milestones.

The customer's account also discusses access to the information produced by the product and its connection to existing tools. For a buyer, that matters because the security team's accumulated workflows do not disappear when a new product is introduced. The supplier's role includes fitting into an established environment, not just demonstrating a stand-alone interface.

The case study is published by HarfangLab and contains named customer testimony. It does not disclose the contract value, renewal term or the proportion of HarfangLab revenue represented by Proton.

Industrial hosting choices affect the service model

A separate HarfangLab case study describes an unnamed group operating in civil and military industry. It reports a local deployment covering 20,000 endpoints and says the customer chose on-site supplier assistance for updates. Because the organisation is not named, the example should remain an attributed industrial case rather than being assigned to a guessed defense prime. Industrial customer account

The significance is the support arrangement. Local hosting can change where responsibilities sit and how a supplier delivers maintenance. A software sale into that setting may depend on service availability and working relationships as much as on the product package itself.

BDI's coverage of the TKMS–Cohere enterprise software agreement offers a different industrial example of software being introduced into an established organisation. The comparison concerns adoption and delivery responsibility, rather than suggesting that the two products perform the same function.

European expansion through partners and exercises

In July 2026, HarfangLab and Infinigate announced an expansion of their relationship into Belgium and Luxembourg. The release focuses on access to cloud offerings through Infinigate's partners and support for service providers. It identifies a distribution route, rather than a disclosed contract with every organisation in those markets. BeLux partnership expansion

A May 2026 announcement separately described HarfangLab's invitation to provide EDR for the DACHL team in the Locked Shields exercise. That is evidence of an exercise relationship involving Germany, Austria, Switzerland and Luxembourg. It is not a NATO-wide procurement award. Exercise announcement

HarfangLab's next commercial developments are most meaningfully assessed through the combination already visible in these records: specific product additions, named users, defined certification scope and partners capable of delivering continuing service. The breadth of that evidence is more useful than a claim that any endpoint product can provide complete protection in every setting.