Invest in WitFoo
The deterministic pane of glass for cybersecurity.
WitFoo, Inc. invites verified accredited investors to participate in a private placement of up to US$2.5 million under Regulation D, Rule 506(c). The investment thesis is the category WitFoo now defines: one flat-priced architecture that takes in diverse data from every IT source and renders actionable reports and work units for every cybersecurity practitioner. Every record is processed (no triage), so every calculation is deterministic and defensible where competitors offer actuarial and probabilistic guesses.
The mission is unchanged: Cybersecurity for Collective Defense. In the briefing below, Chairman and co-Founder Charles Herring explains what has triggered the current velocity and why it compounds.
The company at a glance
8
analyst-defined markets consolidated into one flat-priced architecture
$789M
US Navy cyber-modernisation award (Accenture Federal Services prime) in which WitFoo is the core software component
>90%
of security telemetry reduced before the SIEM or the AI, with no evidence lost
87%
modelled gross margin on the base-case plan, with EBITDA breakeven modelled in 2028
2029
intended first shareholder dividends on the base-case plan, following modelled EBITDA breakeven in 2028
The return model
Most early-stage cybersecurity investments offer a single path to a return: wait for an exit. WitFoo's plan offers two.
Dividends
WitFoo intends to initiate shareholder dividends by the end of 2029. The base-case plan models EBITDA breakeven in 2028 on an 87% modelled gross margin, with flat per-appliance pricing and a channel-only cost structure that does not add sales headcount as revenue grows. Dividend initiation, timing and amounts remain subject to board approval, operating results and applicable law.
-
2026
This offering — up to US$2.5 million under Regulation D 506(c)
-
2028
EBITDA breakeven on the base-case plan (modelled)
-
2029
First shareholder dividends (intended — subject to board approval)
Base-case plan milestones — modelled and intended, not committed.
The exit market
WitFoo does not need to be acquired for investors to see a return — that is the point of the dividend plan. But the market it operates in clears strategic exits at valuations orders of magnitude above WitFoo's current US$25 million pre-money. The transactions below are drawn from public reporting, current as of August 2026.
Strategic exits against WitFoo's US$25M pre-money
Bar length is each transaction's implied multiple of WitFoo's pre-money, on a logarithmic scale — each gridline is ten times the last.
- Google – Wiz ~1,280× · US$32B
- Cisco – Splunk ~1,120× · US$28B
- Palo Alto Networks – CyberArk ~1,000× · ~US$25B
- Thoma Bravo – Darktrace ~212× · ~US$5.3B
- Mastercard – Recorded Future ~106× · US$2.65B
- Francisco Partners – Sumo Logic ~68× · ~US$1.7B
- CrowdStrike – Onum ~12× · US$290M (announced)
- SentinelOne – Observo AI ~9× · ~US$225M (announced, cash and stock)
| Acquisition | Market | Transaction value | Closed | Multiple of WitFoo's US$25M pre-money |
|---|---|---|---|---|
| Google – Wiz | Cloud security | US$32B | March 2026 | ~1,280× |
| Cisco – Splunk | SIEM | US$28B | March 2024 | ~1,120× |
| Palo Alto Networks – CyberArk | Identity security | ~US$25B | February 2026 | ~1,000× |
| Thoma Bravo – Darktrace | AI network detection | ~US$5.3B | October 2024 | ~212× |
| Mastercard – Recorded Future | Threat intelligence | US$2.65B | December 2024 | ~106× |
| Francisco Partners – Sumo Logic | SIEM / log analytics | ~US$1.7B | May 2023 | ~68× |
| CrowdStrike – Onum | Telemetry pipelines | US$290M (announced) | September 2025 | ~12× |
| SentinelOne – Observo AI | Telemetry pipelines | ~US$225M (announced, cash and stock) | September 2025 | ~9× |
Five of these deals sit squarely in markets the platform consolidates — SIEM, telemetry pipelines and threat intelligence. The others show where the broader market clears when a category leader emerges. The two pipeline tuck-ins of 2025 each cover a single market Conductor already ships; each cleared at roughly 9–12 times WitFoo's entire pre-money valuation.
Past transactions are shown for context only; they are not a prediction or promise of any WitFoo outcome or return.
The thesis
Over the last decade data volumes exploded, and every downstream tool inherited the problem: telemetry pipelines, SIEMs, detection platforms and reporting tools all sit on data their customers can no longer afford to keep. The industry's answer is triage — disregard and discard records to stay affordable. That taxes customers twice. Engineers burn their days tuning what gets kept, and the analytics degrade because the evidence is incomplete. When not every record is processed, deterministic calculations cannot be made, and customers are left with actuarial and probabilistic guesses in a field that demands forensic reliability.
WitFoo spent the decade re-engineering the data science instead. More than 4,000 experiments across three dozen organisations (from the Fortune 500 to local government) produced empathetic processing (protected by seven families of patent filings, patent pending). It processes every record and reduces telemetry by more than 90% with no evidence lost. Every answer the platform renders is defensible math, not a guess. That is the deterministic pane of glass: diverse data from every IT source in, actionable reports and work units for every cybersecurity practitioner out.
Eight markets, one architecture
Analysts carve cybersecurity operations into separate markets, each with its own vendor, meter and console. The 1.2.0 platform covers eight of them in one flat-priced architecture:
Telemetry pipelines
Conductor — Every record parsed and enriched, telemetry reduced by more than 90% before the SIEM or the data lake, and exported wherever it needs to go — including OCSF.
SIEM / TDIR
Analytics — Detection, investigation and response over a deterministic evidence graph. Every record processed, no triage.
SOAR
Folded into the platform — Playbooks, sandboxed Python responders and work units are platform features, not a separate metered product — mirroring the analysts, who retired SOAR as a standalone market.
Threat-intelligence platforms
CyberGrid — A zero-knowledge IOC library and consent-gated cross-organisation federation, built in rather than bought separately.
UEBA
Analytics — Longitudinal per-identity behavioural baselining on the evidence graph, new in 1.2.0.
GRC, compliance and CCM
Reporter — Seventeen frameworks, audit-ready certification packages and continuous controls monitoring evidenced by live telemetry.
NPM / APM
Monitor — NetFlow, IPFIX, SNMP and cloud flow logs rendered into network and application performance monitoring — free in Monitor Lite.
ITSM
Monitor — Tickets, problems, changes and a knowledge base with SLA clocks, plus ServiceNow, Jira Service Management and Zendesk connectors.
The investor framing is deliberate. Customers and partners get materially better outcomes at materially lower spend; WitFoo intends to drive a correction in cybersecurity analytics spending, and consolidated spend flows to the consolidator. Corrections don't kill categories — they kill cost structures. WitFoo's was built for the correction.
The competitive position
WitFoo names its competition. The claims below are drawn from public pricing pages, analyst publications and vendor announcements, current as of July 2026.
- Splunk and Microsoft Sentinel
- Both meter every gigabyte — Splunk by daily ingest or workload, Sentinel per gigabyte with a separate consumption meter for its Security Copilot — and their AI assistants run only in their clouds. WitFoo is flat-priced per appliance, and its AI works everywhere its customers do, including fully air-gapped networks.
- Cribl
- The credit-metered pipeline vendor is watching its market be absorbed: CrowdStrike and SentinelOne each closed a pipeline acquisition in September 2025 — Onum and Observo AI — and the SIEM incumbents now bundle pipelines free. Conductor is the only pipeline in the market sold at a flat price with contractually unlimited data, and it is fully air-gap capable.
- Securonix
- Sells on quote-only EPS and gigabyte bands with a Snowflake bill the customer carries (as reported across procurement sources), and its on-premises product has effectively been retired. WitFoo Analytics is flat-priced and runs on appliances the customer controls — disconnected, if need be.
- Vanta and Drata
- The compliance-automation SaaS leaders now hold FedRAMP 20x authorisations, but they remain SaaS-only: they structurally cannot serve disconnected or classified environments, and their evidence (as vendor and procurement documentation describe it) comes from polling SaaS configurations rather than from security telemetry. Reporter draws its evidence from live operations, on premises, air-gapped where required.
- Telos Xacta and RegScale
- The federal-interchange incumbent and its momentum challenger. With 1.2.0, WitFoo matches them where it matters — RMF artifacts export in NIST OSCAL format, and POA&M and test-result exports ship in eMASS-ready formats — while adding what neither has: evidence drawn from live telemetry, and measured ROI reporting.
Three findings held for every vendor named above, each tested by attempted falsification against the July 2026 competitive field. No competitor sells flat unlimited-data pricing (there is no metering code anywhere in WitFoo's platform). No competitor ships measured ROI, FTE-savings or tool-effectiveness reporting from live operational data. And no competitor is fully air-gap capable including its AI. On those three counts, WitFoo is a category of one.
The 1.2.0 platform
The 1.2.0 release turns those competitive findings into shipped product — and opens two new markets while doing it.
- Monitor
- A network, application and IT service management product with a free tier — Monitor Lite at US$0, Pro at US$5,000 and Max at US$10,000 per appliance per year. Monitor Lite is the free front door to the architecture.
- NBAD and UEBA
- Network behavioural anomaly detection (beaconing, low-and-slow exfiltration, lateral movement, DNS tunnelling) over rolling baselines, and longitudinal per-identity baselining on the graph — closing the objection that the platform lacked longitudinal detection depth.
- Federal interchange
- RMF artifacts in NIST OSCAL format, POA&M and test-result exports in eMASS-ready formats, and CMMC continuous self-assessment with a live SPRS score.
- OCSF export
- Conductor exports in the Open Cybersecurity Schema Framework — the security schema of record for data lakes and modern SIEMs.
- Public parser catalog
- A machine-generated public catalog of the platform’s parsers and integrations, published from the same registries the code ships with.
- Measured reduction and savings
- A live, per-customer surface measuring telemetry reduction and estimated SIEM spend avoided — the more-than-90% fleet figure, now citable customer by customer.
- Reporter catalog expansion
- Executive, board and regulatory reporting (SEC, NIS2, DORA), vulnerability and exposure, identity and insider risk, and white-label MSSP multi-tenant reporting.
- Work Unit Replay and Exec Story Mode
- Time-scrubbed incident reconstruction and guided executive narratives — the rendering layer of the pane of glass.
The business model
WitFoo is channel-first and channel-only. Being undercapitalised meant the company could never afford the direct sales armies its competitors are forced to field (armies that alienate the very channel they claim to partner with), so the constraint became the moat: global distribution where partners keep the customer relationship and margins improve with scale. World Wide Technology, Accenture Federal Services, TD SYNNEX and partners across New Zealand and Australia are all transacting today, at excellent conversion rates and with rapid sales cycles. The model supports an 87% modelled gross margin, with EBITDA breakeven modelled in 2028. Pricing is flat per appliance on every product; a customer's bill never grows with their data.
That discipline extends to capital. A decade of R&D was built on under US$5 million of lifetime raise; the companies competing with each WitFoo product raised far more — Cribl more than US$700 million, Securonix about US$1.1 billion, Vanta US$504 million. Restraint bought two things. Shareholders, who include all of WitFoo's contributors, kept their ownership (dilution is forever). And the research matured into seven families of patent filings (patent pending) on the company's own timeline.
The cost base holds because of how the company builds: WitQ, the development system behind the velocity, described below.
Further agreements are executed with IBM and with Carson & SAINT (pre-revenue), and negotiations are under way with Cisco. Partner logos are the property of their respective owners.
WitQ: the development system behind the velocity
WitFoo develops software through WitQ, a proprietary AI-assisted system of the company's own design — code is generated under WitFoo's written engineering norms and independently re-verified by deterministic testing before it ships.
The effects are measurable. A small engineering team rebuilt the entire platform from the ground up and ships a major release every six weeks at the highest measurable quality; a major WitFoo release used to take 14 months. More than a decade of research backlog cleared in the twelve months to August 2026, shipping in the upcoming 1.2.0 release. The norm corpus WitQ enforces — the WitFoo Way — counts more than 1,900 standards and approaches, about 70 covered by the seven families of patent filings (patent pending) and the remainder maintained as trade secrets. Development cost grows at a low slope relative to the customers and partners supported: it is the reason the raise is US$2.5 million and not US$25 million.
Major-release cadence
Bar length is proportional to elapsed time per major release.
Verified accredited investors receive the WitQ due-diligence brief in the data room.
The patent program
In July 2026 WitFoo filed seven families of provisional patent applications with the United States Patent and Trademark Office — five on 13 July and two on 26 July — covering more than 100 patent-pending claims across the platform's core mechanisms. Filings were prepared and code-verified through WitQ, with US patent counsel engaged across the program; each application preserves a United States and New Zealand prosecution path, with conversion to full applications due by July 2027.
- 64/110,132
- Passive detection and graph representation of autonomous AI agents in network telemetry — Visibility into the agentic-AI wave, filed before any public disclosure.
- 64/110,134
- Deterministic entity identity with monotonicity-preserving merge — The graph-integrity backbone behind more than 90% telemetry reduction with no evidence lost.
- 64/110,135
- Detection-preserving pseudonymization of security telemetry — Privacy redaction that keeps detection, correlation and deduplication working.
- 64/110,138
- Consent-gated cross-organization federation with revocation propagation — The CyberGrid protocol behind Cybersecurity for Collective Defense.
- 64/110,139
- Evidence-derived incident risk composition with outlier damping — Triage scoring that gates automation and analyst attention.
- 64/119,373
- Deterministic explainable behavioral baselining from class-relationship aggregates — Behavioural analytics that score a never-before-seen host from its first observation and explain every alarm in a human-verifiable sentence — filed 26 July 2026, ahead of any public disclosure.
- 64/119,377
- Corroboration-gated publication of anonymous cross-organization threat intelligence — The decision layer above the CyberGrid protocol — anonymous community intelligence published only when independently corroborated. Filed 26 July 2026.
Provisional applications establish priority dates; they are not issued patents, and no assurance can be given that any patent will be granted or will provide the scope of protection sought. The methodology that produced them — WitQ — remains an unpublished trade secret.
The offer at a glance
- Issuer
- WitFoo, Inc. — Delaware C-corporation; holds all group intellectual property
- Amount
- Up to US$2,500,000
- Instrument
- Investor’s choice — common stock, or a convertible note
- Equity terms
- US$25,000,000 pre-money · US$2.50 per share · US$27,500,000 post-money fully subscribed · about 9.1% dilution (1,000,000 new shares)
- Convertible terms
- US$30,000,000 conversion ceiling · 10% discount to the next qualified financing · 4–6% p.a. · 36–48 month maturity
- Minimum subscription
- US$10,000
- Exemption
- Regulation D, Rule 506(c) · Form D filed 26 June 2026 · verified accredited investors only
- US securities counsel
- Kennyhertz Perry LLC
Terms are indicative and subject to the Private Placement Memorandum and definitive subscription documents.
Use of proceeds
- Sales and channel enablement
- 38% · US$950,000
- Product and engineering
- 28% · US$700,000
- WitFoo Limited (NZ) commercial operations
- 18% · US$450,000
- Working capital and contingency
- 10% · US$250,000
- Offering, legal and compliance
- 6% · US$150,000
The raise deliberately does not fund AI-hardware capital expenditure, which is paced against realised revenue rather than paid for upfront.
How to participate
1 · NDA and data room
Sign a mutual NDA and receive access to the investor data room, which includes all seven patent filings as investor briefs. Start by contacting investor relations.
2 · Verification
Complete accredited-investor verification, as Rule 506(c) requires.
3 · Subscription
Elect the instrument and execute subscription documents. Full terms are in the Private Placement Memorandum.
Investor resources
Investor relations contact
Start the conversation — data-room access, terms, and verification.
Shareholders Portal
Existing shareholders — holdings, documents, and updates.
SEC filings
WitFoo, Inc. filings on SEC EDGAR, including Form D.
Due Diligence Portal
Verified accredited investors — the offering data room.
Get WitFoo investment updates
Occasional email updates on the offering and company milestones. You can unsubscribe at any time.
Sign-ups are managed through Mailchimp and confirm in a new tab.
Disclaimer. This page is for informational purposes only and is not an offer to sell or a solicitation of an offer to buy any security. Any offer is made solely through the Private Placement Memorandum and definitive subscription documents, to verified accredited investors, under Regulation D, Rule 506(c). The securities have not been registered under the U.S. Securities Act of 1933 or any state securities laws and may not be resold absent registration or an applicable exemption. Forward-looking statements — including projections, revenue trajectory, margins and use of proceeds — are based on assumptions described in the offering materials; actual results may differ materially. Statements regarding intended dividends are statements of present intention, not commitments; dividend initiation, timing and amounts remain subject to board approval, operating results and applicable law, and no dividend is promised or guaranteed. Statements regarding patent applications describe provisional filings only; provisional applications are not issued patents and confer no enforceable rights unless and until patents are granted. Competitor, market and comparable-transaction figures are drawn from public sources believed reliable as of the dates noted on this page and have not been independently audited; comparable transactions are historical context only and are not a prediction or promise of any WitFoo outcome or return. Third-party statistics are attributed to their sources in the offering materials.