"Cyber security & insurance, unified."
The wordmark of a company that does two jobs most people think live in different buildings: the lock on the door and the policy that pays if someone gets through it. San Francisco, founded 2017.
A small business owner opens an email that looks exactly like an invoice from a supplier they've paid forty times. It isn't. Somewhere on the other side of that message is a kit rented by the hour - ransomware-as-a-service, no coding required. This is the ordinary morning Upfort was built around: not the breach of a bank, but the wire transfer that quietly leaves a 14-person company.
For years, the answer to that morning came in two unrelated packages. Security vendors sold tools - one for email, one for the browser, one for training - each priced and tuned for enterprises with a security team to run them. Insurers sold policies, written in language nobody reads until the worst day. The two camps rarely shared a sentence, let alone a platform.
"Enterprise point solutions weren't practical for 99% of companies."
Upfort's bet is almost suspiciously simple: put the lock and the policy in the same place. Prevent the incident, and if it happens anyway, cover it. The company calls this making cyber risk "easy to manage and simple to insure" - a sentence that sounds like marketing until you notice it's also a business model.
Figures are company-reported / public estimates and approximate.
AI copilots scan inboxes for advanced threats, a lightweight browser extension guards the web, and autonomous detection-and-response handles what slips past. Deploys in minutes, not quarters.
Phishing simulations and security awareness training turn the person clicking the invoice into the person who reports it. Risk monitoring flags exploitable systems and users before attackers do.
Policies from leading carriers covering ransomware, data breaches, and wire fraud - with intelligent automation handling the underwriting. Single and group programs available.
Insurers, MGAs, and brokers use Upfort to embed security with coverage, quote faster, and build group programs that price risk on real prevention - not guesswork.
Upfort's pitch to insurers is that security and underwriting are the same conversation. Their cited results:
Source: company-reported study figures. Treat as approximate.
"Make cyber risk easy to manage and simple to insure."— Upfort's mission, in one line
Carnegie Mellon and Harvard; previously led product at insurance-AI firm Tractable. Spent a decade building data-and-tech startups before Upfort.
Returned from deployment with US Army Cyber Command and saw how hard real security programs are to run - the spark for the company.
Part of the founding team that set out to build a holistic cyber-risk solution for the businesses enterprise tools ignored.
Founded as Paladin Cyber to close the SMB cyber-protection gap. Backed by Y Combinator.
Rebrands to Upfort, signaling a shift from pure prevention to holistic protection and resilience.
Closes $8M Series A led by SYN Ventures, with Eniac and Fika Ventures participating.
Partners with Arch Insurance to expand access to cyber insurance through broker group programs.
Wins multiple cybersecurity and cyber-insurance industry awards; expands Upfort Shield's AI capabilities.
Total raised: roughly $15.2M across rounds. Headquarters: San Francisco, California.
Multiple 2024–2025 industry awards spanning email security and cyber insurance - including cybersecurity excellence and SME insurance honors.
Upfort sizes the SME cyber-risk market at roughly $80 billion - the underserved middle between consumer antivirus and enterprise security suites.
Upfort still tweets from its old life - the handle is @paladincybers, a fossil of the Paladin Cyber era.
The CTO's origin story starts at US Army Cyber Command - the security gap was something he lived before he built for it.
The company claims Shield runs about 90% cheaper than assembling comparable point tools - roughly $4,000 a year saved.
It sells less to businesses directly and more through brokers and carriers - the platform hides inside the policy.
Upfort runs in the insurtech-meets-security pack alongside Coalition, At-Bay, Cowbell Cyber, and Corvus - plus security-only players like Huntress, Cloudflare, and Proofpoint. Its distinguishing move is refusing to pick a lane: it sells the prevention and the policy as one product.
Return to that 14-person company and the email dressed as an invoice. In the version Upfort is selling, the message never reaches the inbox clean - the AI copilot flags it, the browser extension blocks the link behind it, and the employee who almost clicked has already sat through a simulation that looked exactly like this. If something still slips through, the policy underwritten on the same platform is the one that pays.
That's the quiet ambition behind a wordmark and a tagline. Not a moat around the Fortune 500, but a roof over the businesses that were always told real security wasn't built for them. The morning still arrives. Upfort's whole pitch is that it arrives, now, with the lock and the policy already in the same room.
Sources: Upfort, BusinessWire, SiliconANGLE, Insurance Business, Y Combinator, Crunchbase, Pulse 2.0. Figures are public/company-reported and approximate.