Cyble cybersecurity US expansion has a new face. On September 15, 2026, Cyble announced the appointment of Steve Ingram as Executive Vice President, US, tasking him with accelerating growth, deepening customer relationships, and building the company’s position in the world’s largest cybersecurity market. Ingram brings a genuinely impressive resume: EY’s Financial Services Cyber Leader for the Americas, 15 years as a PwC partner leading its Asia-Pacific Cyber practice, and early career service with the Australian Federal Police.
The hire is a credibility move. Cyble — an AI-native threat intelligence startup founded in 2019, headquartered in Cupertino with development operations in Bangalore — is a Series B company with 234 employees and approximately $48.3 million in total funding. Ingram spent two years on Cyble’s Advisory Board before transitioning to this operating role. CEO Beenu Arora called him “a trusted advisor” who “knows our technology, people and business.”
But the announcement arrives in a threat intelligence market that has consolidated sharply, where Cyble’s competitive standing — while improving — remains outside the top tier. The press release does not address the gap between the hire’s signal and the market’s reality.
Why This Announcement, Why Now
The timing aligns with three recent milestones that the press release does not mention.
First, the Inc. 5000. On August 11, 2026, Cyble ranked No. 576 on the 2026 Inc. 5000 list of America’s fastest-growing private companies. The company announced that its annual recurring revenue had more than tripled in just over two years. Arora called the recognition “proof that the world is moving toward AI-native security.” The Ingram hire, coming five weeks later, is a direct follow-on — bringing in operational leadership to capitalise on the growth momentum the Inc. ranking validated.
Second, the funding trajectory. Cyble raised a $24 million Series B in July 2023, co-led by Blackbird Ventures and King River Capital, with a $6.2 million second tranche in November 2023 bringing the total Series B to approximately $30.2 million. Total funding across all rounds reaches roughly $48.3 million, according to Tracxn. Investors include Spider Capital, Summit Peak Ventures, and Y Combinator. The company has not announced a Series C. The Ingram hire suggests Cyble is investing in go-to-market capacity ahead of its next funding round or as a bridge to profitability.
Third, product expansion. The press release mentions “agentic AI” as part of Cyble’s portfolio expansion. This refers to Cyble Blaze AI, an agentic AI engine the company describes as capable of hunting, reasoning, and acting autonomously on threat data. The press release also mentions endpoint security, referring to Silicon Attested Endpoint Protection. These are new product categories for Cyble, extending beyond its core threat intelligence and dark web monitoring capabilities. Ingram’s mandate covers selling these new capabilities into the US market.
Ingram’s Verified Background
Public sources confirm and extend the press release’s characterisation of Ingram’s career. His LinkedIn profile shows he retired from EY in April 2024 after four and a half years as FSO Cyber Leader for the Americas, based in New York. A yespress.io profile reports that under his leadership, EY’s Americas Financial Services Cyber and Privacy practice grew fourfold over five years. Before EY, Ingram spent 15 years as a PwC partner (November 2004 to September 2019), leading its Asia-Pacific Cyber practice and serving on the ASEANZ Markets Council. He also served as General Manager of Strategy and Security Risk at Commonwealth Bank, and began his career as a partner at Arthur Andersen.
Ingram joined Cyble’s Advisory Board in June 2024, two months after retiring from EY. He is based in Dallas, Texas, and is currently completing a Master of Legal Studies in Business Law at Texas A&M University. He also serves as a board member at the Institute for Critical Infrastructure Technology (ICIT), a nonprofit focused on critical infrastructure resilience. His LinkedIn profile listed him as “available for select Board, Advisory, and Interim CEO roles” — the Cyble EVP position represents a shift from advisory work back to operating leadership.
The Competitive Picture: Where Cyble Cybersecurity US Expansion Lands
The threat intelligence market Cyble is entering in the US is not an open field. It has consolidated rapidly, and the leaders are well-capitalised, well-recognised, and backed by either public markets or major acquirers.
Gartner’s First Magic Quadrant
In May 2026, Gartner published its inaugural Magic Quadrant for Cyberthreat Intelligence Technologies — the first formal analyst evaluation of this market category. Five vendors received Leader status: CrowdStrike, Google (Mandiant), Group-IB, Recorded Future, and ZeroFox. Cyble appeared in the evaluation but was not named a Leader. According to an analysis by Dawn Liphardt, Cyble ranked fifth on one evaluation axis but thirteenth on the other, reflecting strong execution capability but a narrower vision footprint compared to the Leaders.
This positioning matters. Gartner Magic Quadrant leadership is a procurement filter for large enterprise and government buyers. CISOs at Fortune 500 companies and federal agencies use it as a shortlisting tool. Cyble’s absence from the Leaders quadrant means it must compete on price, differentiation, and direct relationship — not on analyst endorsement.
The Consolidation Wave
The threat intelligence market has consolidated significantly since 2024. Mastercard acquired Recorded Future for $2.65 billion in September 2024, giving the largest threat intelligence vendor a payments-sector parent with deep enterprise distribution. Bitsight acquired Cybersixgill for $115 million in November 2024. ZeroFox went through a SPAC IPO, privatization under Haveli Investments, and a strategic refocus. Flashpoint has been approaching enterprise scale.
These moves have squeezed the mid-market. A July 2026 research report by Parallect AI noted that the mid-market is “structurally underserved” because Recorded Future and Flashpoint are “too expensive and analyst-intensive for organizations below approximately 2,000 employees.” Cyble’s opportunity — and the reason Ingram’s hire matters — lies in this gap: serving mid-market and upper-mid-market organisations that need threat intelligence but cannot justify Recorded Future’s reported $50,000 to $500,000-plus annual pricing.
Direct Competitors in Cyble’s Weight Class
Tracxn identifies 381 active competitors in Cyble’s category. The most directly comparable are Flashpoint, Intel 471, KELA, SOCRadar, and CYFIRMA — vendors that offer threat intelligence and digital risk protection at a scale and price point below Recorded Future and CrowdStrike. Cyble differentiates on its AI-native architecture and its combined offering across threat intelligence, dark web monitoring, attack surface management, and its newer agentic AI and endpoint protection capabilities. Whether these newer categories represent genuine differentiation or feature expansion that dilutes focus remains an open question.
What the Data Shows
Public sources reveal several data points that contextualise Cyble’s position beyond the press release.
Cyble’s ARR is not disclosed, but the Inc. 5000 announcement states it has “more than tripled in just over two years.” Ingram’s LinkedIn profile lists Cyble’s annual revenue in the $1 million to $10 million range — meaning the tripled figure likely sits in the high single-digit millions. For context, Recorded Future serves over 1,900 businesses and government organisations across 80 countries. ZeroFox’s customer base is mainly in North America. Flashpoint’s activity is concentrated in North America. Cyble operates across 11 countries with a team spread globally but remains significantly smaller than any Leader-category competitor.
Product and Partnership Traction
Cyble’s product portfolio has expanded meaningfully. The flagship Cyble Vision platform provides threat intelligence. Cyble Hawk serves law enforcement and government agencies. Odin is an internet-wide scanning technology. AmIBreached is a consumer-facing breach detection tool. Cyble Blaze AI represents the agentic AI layer. Silicon Attested Endpoint Protection extends into endpoint security — a category where Cyble competes not just with threat intelligence vendors but with CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint.
The company has earned 40 G2 badges in Spring 2026 and 36 in Summer 2026 across categories including dark web monitoring, threat intelligence, and attack surface management. It was recognised as a Cyber Threat Intelligence Leader by Frost and Sullivan in 2024. A partnership with Wipro embeds Cyble’s intelligence in enterprise risk management offerings — a channel relationship that could accelerate US enterprise penetration through a trusted systems integrator.
What’s New vs. What’s Repackaged
Breaking down the announcement into component claims separates genuine movement from familiar positioning.
Ingram’s appointment as EVP, US — New. This is a genuine operating hire, not an advisory board addition. Ingram transitions from a two-year advisory role to a position with P&L responsibility for the US market. The move from advisory to operating is common in startups that have reached product-market fit and need experienced go-to-market leadership to scale.
Ingram’s Big Four credentials — Verified. The press release’s characterisation of Ingram’s career is accurate and understated. His EY practice grew fourfold in five years. He chaired EY’s Americas Cyber Advisory Board. He led PwC’s Asia-Pacific Cyber practice for 15 years. Also, he served with the Australian Federal Police. The credentials are genuine and relevant to selling cybersecurity into regulated US financial services.
“AI-native cybersecurity” positioning — Repackaged. Cyble has used this language consistently since at least 2023. The positioning is core to the company’s identity but is not new with this announcement. Multiple competitors — CrowdStrike, SentinelOne, Darktrace — make similar AI-first claims.
“Agentic AI” — New category, industry-wide concept. Cyble Blaze AI is a real product, but agentic AI is an industry-wide trend. The press release mentions it as part of the portfolio expansion but does not differentiate Cyble’s implementation from competitors.
“Accelerating growth in the US market” — Standard. Every regional executive hire includes this language. The specific mechanisms — deepening customer relationships, building market position — are generic. No US revenue target, customer acquisition goal, or market share objective accompanies the statement.
The Questions That Weren’t Answered
The announcement leaves several questions that a buyer, investor, or competitor would need answered.
What is Cyble’s actual ARR, and what is the US revenue target? The Inc. 5000 announcement says ARR “more than tripled,” but from what base? Ingram’s LinkedIn suggests $1–10 million. What specific US revenue does Cyble expect Ingram to generate? Without a target, success cannot be evaluated.
How many US customers does Cyble currently have? The press release says Ingram will “deepen customer and partner relationships” but does not disclose how many US customers exist, what verticals they represent, or what the retention rate is. For a company expanding into the world’s largest cybersecurity market, this is foundational data.
Cyble Not A Gartner Leader
Why is Cyble not a Gartner Leader? The press release does not address Cyble’s position in the May 2026 Gartner Magic Quadrant. For CISOs who use Gartner as a procurement filter, this is the elephant in the room. Cyble ranked well on execution but lower on vision — what is the company doing to close the vision gap?
Is this a full-time commitment from Ingram? Ingram’s LinkedIn profile stated he was “available for select Board, Advisory, and Interim CEO roles.” He serves on the ICIT board. Is the Cyble EVP role his sole professional commitment, or does he retain other positions? For a company betting its US expansion on one hire, this matters.
How does Cyble differentiate against Recorded Future (Mastercard-backed), ZeroFox (Gartner Leader), and CrowdStrike (endpoint-native)? The press release mentions “AI-native” and “agentic AI” but does not articulate a specific competitive differentiation. Every threat intelligence vendor claims AI. Cyble’s pitch — dark web monitoring combined with AI-native architecture and agentic AI — needs to explain why a US CISO would choose it over a Gartner Leader with deeper resources and broader analyst recognition.
What is the pricing model, and how does it compare? Recorded Future reportedly costs $50,000 to $500,000-plus annually. Cyble’s pricing is not publicly disclosed. If Cyble is targeting the mid-market gap — organisations below 2,000 employees that find Recorded Future too expensive — the pricing strategy is the key differentiator. The press release does not address it.
What This Means for You
For CISOs and security leaders evaluating threat intelligence platforms, this announcement has specific implications depending on your organisation’s size and needs.
For large enterprises and government agencies with dedicated threat intelligence teams: the Gartner Leaders — Recorded Future, CrowdStrike, Google (Mandiant), Group-IB, and ZeroFox — remain the default evaluation set. Cyble’s Ingram hire does not change the shortlist. If you are already a Cyble customer, Ingram’s appointment adds enterprise sales credibility and may improve account management. If you are not, there is no compelling reason to add Cyble to an existing evaluation without a specific mid-market use case.
For mid-market organisations (500–2,000 employees) that need threat intelligence but find Recorded Future’s pricing prohibitive: Cyble is worth evaluating. The company’s AI-native architecture, dark web monitoring, and attack surface management capabilities cover the core external threat intelligence needs. Ingram’s Big Four background suggests Cyble is building a sales motion that speaks to regulated industries — particularly financial services, where his EY experience is directly relevant. Ask for reference customers in your industry and compare pricing against Flashpoint, Intel 471, and SOCRadar, which occupy similar market positions.
Tracking the Threat Intelligence
For investors tracking the threat intelligence market: the Ingram hire signals that Cyble is moving from product-led growth to sales-led growth in the US. The Inc. 5000 ranking validates the growth trajectory. The question is whether a 234-person company with under $10 million in ARR can scale US enterprise sales against competitors with orders of magnitude more resources. Ingram grew EY’s cyber practice fourfold — but EY had a global brand, thousands of consultants, and decades of client relationships. Cyble has none of those advantages. The hire is directionally positive but unproven in this context.
For competitors: Cyble is a company to monitor but not yet to fear. Its product portfolio is broadening — threat intelligence, digital risk protection, endpoint security, agentic AI — but breadth without depth is a risk. The Gartner Magic Quadrant placement suggests strong execution but a vision gap. Ingram’s hire may close the sales credibility gap but does not automatically close the product or analyst recognition gaps.
For everyone else: this is a startup hiring an experienced executive to lead a regional market expansion. The format — advisory board member transitions to operating role, Big Four credentials, AI-native positioning — is standard. The real test is whether Cyble can convert its Inc. 5000 growth momentum into sustained US enterprise sales under Ingram’s leadership, and whether its product portfolio can compete against Gartner Leaders who are better capitalised and more broadly recognised.
Editor’s Note
This article draws on the Cyble press release dated September 15, 2026. Cyble’s funding history and company profile come from Tracxn (accessed September 2026), The Cyber Express (January 12 and July 27, 2026), Startup Intros (July 13, 2026), and yespress.io (July 21, 2026). The Inc. 5000 ranking and ARR growth claims come from Cyble’s PR Newswire announcement on August 11, 2026, with additional coverage from BriefGlance and Third News.
Steve Ingram’s career background is verified through his LinkedIn profile (accessed September 2026), a yespress.io profile (July 8, 2026), his ICIT board biography, an InnovationAus.com profile (August 2017), and his LinkedIn retirement announcement from EY (March 2024). His appointment to Cyble’s Advisory Board was announced in June 2024, covered by Silicon UK. The Gartner Magic Quadrant for Cyberthreat Intelligence Technologies was published on May 4, 2026, with analysis by Dawn Liphardt (May 13, 2026) and rankings referenced by Ciphers Security (June 16, 2026) and World Metrics (February 19, 2026). Market consolidation data — Mastercard’s acquisition of Recorded Future for $2.65 billion (September 2024) and Bitsight’s acquisition of Cybersixgill for $115 million (November 2024) — comes from a Parallect AI research report (July 22, 2026) and The Business Research Company’s threat intelligence market report (July 30, 2026).
Intelligence Graph
Recorded Future’s customer base (1,900-plus organisations across 80 countries) and Intelligence Graph (200-plus billion nodes) come from its Gartner Magic Quadrant announcement (May 4, 2026). Cyble’s G2 badges, Frost and Sullivan recognition, and Wipro partnership are referenced in yespress.io and BriefGlance profiles. Pricing data for Recorded Future comes from Ciphers Security and WhiteIntel buyer guides (May–June 2026). Cyble’s product portfolio details (Cyble Vision, Hawk, Odin, AmIBreached, Blaze AI, Silicon Attested Endpoint Protection) come from The Cyber Express, yespress.io, and BriefGlance. All claims about product capabilities are attributed to the respective companies. What remains uncertain: Cyble’s actual ARR figure, US customer count, pricing model, Ingram’s full-time commitment status, and the specific mechanisms by which Cyble differentiates against Gartner Leaders.