Sekoia sells threat intelligence and security-operations software through a network of managed service providers. Its public evidence includes Thales and Infinigate partnerships, named industrial users and a U.S. government acknowledgment.
Sekoia.io, now branded Sekoia on its corporate website, develops software for cyber threat intelligence and security operations. Its business connects information about threats with the tools used to investigate security alerts and manage incidents. The company also relies on managed security service providers, which can use its platform to serve several customer organisations.
That service-provider model is central to understanding Sekoia's market. A manufacturer may encounter the technology inside an outsourced security service, while another software vendor may consume its intelligence through an integration. Those are different commercial relationships even when the same Sekoia technology sits underneath them. Sekoia's corporate description
The current legal notice identifies Sekoia.io SAS, registered in Rennes with an office on Boulevard du Colombier. The company's present history names Freddy Milesi, Georges Bossert and Therese Favet as founders and describes the company's launch in 2022. Older references to the Sekoia brand and its predecessor activity should not be confused with the current legal entity's history. Legal notice and company history
In April 2025, Sekoia announced €26 million of financing from Revaia, with UNEXO participating alongside existing investors Bright Pixel Capital, Omnes Capital and Bpifrance. The company then described a workforce of more than 100 people and around 50 managed security service provider partners. The employee figure is a dated lower bound, not an exact September 2026 headcount. Financing and workforce disclosure
The financing announcement does not disclose current ownership percentages or audited turnover. The French government's enterprise API also supplies no financial figures for this entity in the record reviewed. Revenue therefore remains unquantified here; neither financing nor the number of organisations using a partner's service can substitute for it. Official company record
Sekoia Intelligence is the company's threat-intelligence offering. Its public description covers a maintained knowledge base about cyber threats, analytical reports and ways to provide that information to other security systems. The commercial role is to supply context that an organisation or service provider can use within its own defensive work. Sekoia Intelligence
Sekoia Defend brings together security events, alerts and incident-management functions. The company markets it as a next-generation security information and event management platform, or SIEM. Its public product page describes connections to existing tools and shared case management. This places it in the customer's recurring security workflow rather than limiting it to a separate reference database. Sekoia Defend
For a manufacturing customer, incident data and asset context can also connect the security team's work to the organisation's existing equipment and service responsibilities.
The two offerings can reinforce each other, but they answer different buying questions. A team already satisfied with its operations platform may still want another intelligence source. A service provider standardising its customer offering may instead want the broader platform, its integration catalogue and a consistent analyst interface.
Current product pages also identify Reveal, which brings together information about the customer's digital assets, and Elevate, the company's AI-agent offering. Reveal's stated role is to connect asset context to security investigations. Elevate extends the proposition into AI-assisted work. Their inclusion indicates a broader product perimeter; it does not independently prove the company's claims about the speed or completeness of automated analysis. Reveal and Elevate
For readers considering analytical software more broadly, BDI's Primer AI profile offers a useful comparison of product scope and user workflows. The common commercial question is what information the product processes and who remains responsible for the resulting decision.
Infinigate's October 2024 announcement describes distribution of Sekoia's portfolio through its reseller network across Europe, the Middle East and Africa, starting with named European markets. It identifies both the intelligence and detection-and-response offerings and explains that service providers can use them to supply security operations as a service. Infinigate's partnership announcement
This provides a concrete route to market. Infinigate is the distributor; a managed service provider may deliver the continuing customer service; Sekoia supplies the platform and intelligence. The customer organisation at the end of that chain is not necessarily a direct contracting customer of the software company.
That structure can extend a software supplier's reach without requiring it to employ every analyst serving the final customer. It also gives implementation partners a substantial role in the commercial outcome. Training, customer onboarding and integration affect whether a reseller becomes an active service provider, so a distribution agreement and an established customer deployment represent different stages of development.
In October 2025, Thales and Sekoia announced a French partnership for security-operations services. The release describes the Sekoia platform being operated by Thales and the possibility of hosting in S3NS. It connects Sekoia's software and intelligence to a named organisation responsible for delivering the service. Thales and Sekoia announcement
For a defense-industry reader, this is a useful example of a specialist software company working through a much larger service organisation. It is not evidence that Thales acquired Sekoia, nor does the announcement disclose the value of individual end-customer contracts. Its substance is the delivery arrangement and the intended customer setting.
Sekoia also publishes a named EDF security manager's account of its intelligence service. That account emphasises the relationship with the supplier's team and responsiveness to feedback. It is a customer quotation hosted by Sekoia, which is valuable evidence of the relationship but not an independent comparative benchmark. EDF account on the intelligence page
The U.S. Department of Justice's January 2025 account of an international malware-removal operation credits French authorities and Sekoia.io for their collaboration. It identifies the company as a contributor to the underlying research and cooperation. This is direct government acknowledgment, rather than a customer logo or an unnamed vendor success story. Justice Department account
The commercial significance is the documented external use of specialist expertise. The announcement does not publish a Sekoia software procurement or contract value. Research cooperation can strengthen a company's standing in its field without being equivalent to recurring subscription revenue.
That distinction is particularly important for intelligence businesses, where public research is both a contribution to the wider community and evidence of analytical capability. BDI's coverage of the U.S. commercially available information framework discusses a separate buyer-side issue: how institutions govern information they obtain commercially.
Sekoia's April 2026 release announced a Singapore hosting region intended to serve Asia Pacific and Japan. The page carries a 19 April update label, while the release itself is dated 20 April. The development adds a regional hosting option; it does not establish a customer award in Japan or automatic satisfaction of every local requirement. Singapore hosting announcement
A March 2026 release separately announced completion of a SOC 2 Type 1 audit by A-LIGN. It described Type 2 as a planned next milestone. The public statement is evidence of the announced assessment, while the detailed audit report and its exact contractual applicability remain separate documents. SOC 2 Type 1 announcement
Together, these developments show the business work accompanying product expansion: regional infrastructure, service partners and assurance evidence make a platform accessible to different customers. Sekoia's position is best understood through that combination of intelligence, software and delivery relationships, with each named deployment or partnership assessed at its actual stage.
Public product, company and partner records were read; three material2026/Thales releases also retrievedordinaryHTTP200withfullbodies. Infinigate's full indexed primary release was readable although direct web opening failed. DOJ's public archived primary text credits Sekoia; no underlying operational techniques are reproduced. Singapore article's page label is19April but its release dateline20April2026 governs the stated event date. SOC2evidence is the public Type1 announcement, not access to the detailed audit report or proof of Type2. Official API has no finances; revenue staysnull. Headcount is the company's April2025strictlowerboundover100, not a current exactestimate.
Suggest a correction