LevelBlue is a global leader in cybersecurity, newly established in 2024 as a joint venture between AT&T and WillJam Ventures. The company represents the latest chapter in the evolution of AT&T Cybersecurity and its predecessor, AlienVault. LevelBlue's strategic vision is to simplify the complex world of cybersecurity by providing unified, outcome-driven security services that allow organizations to innovate with confidence. As the world's largest pure-play Managed Security Service Provider (MSSP), LevelBlue manages over 1.2 billion endpoints and operates a global network of Security Operations Centers (SOCs). The company combines the deep heritage of the AlienVault Unified Security Management (USM) platform with advanced AI-driven precision and elite human expertise. Its primary focus is on cyber resilience, helping businesses and governments navigate a rapidly evolving threat landscape through managed detection and response (MDR), strategic consulting, and community-powered threat intelligence via the Open Threat Exchange (OTX).
The foundation of USM Anywhere dates back to the founding of AlienVault in 2007 by Dominique Karg, Ignacio Molleda Carmona, and Alberto Roman Linacero in Madrid, Spain. The company's original mission was to commercialize OSSIM (Open Source Security Information Management), a groundbreaking tool created by Karg and Julio Casal in 2003. AlienVault quickly moved its headquarters to San Mateo, California, to capitalize on the Silicon Valley ecosystem. Under the leadership of CEO Barmak Meftah, the company became a 'Visionary' in Gartner's Magic Quadrant by unifying essential security controls into a single platform. In July 2018, AT&T acquired AlienVault for a reported $118 million to serve as the technological backbone of its new AT&T Cybersecurity division. In 2024, the business was spun out into LevelBlue, a dedicated pure-play security company, retaining the same core team of researchers and engineers while expanding its focus on Managed Services and XDR.
Before its acquisition by AT&T, AlienVault raised a total of $118.2 million over seven funding rounds, making it one of the most successful cybersecurity startups of its era. Key investment rounds included a $52 million Series E in August 2015, led by Trident Capital with participation from Institutional Venture Partners (IVP), Kleiner Perkins, and Sigma Partners. Earlier rounds saw significant backing from GGV Capital and Adara Ventures. This funding was primarily used to accelerate the development of the cloud-native USM Anywhere platform and expand the global reach of the Open Threat Exchange. Following the 2018 acquisition, the company was integrated into AT&T's multi-billion dollar enterprise division. The 2024 spin-off into LevelBlue was facilitated by a joint venture with WillJam Ventures, a private equity firm specializing in cybersecurity, providing the business with the autonomy to pursue rapid M&A and specialized growth strategies.
LevelBlue's core product offering is USM Anywhere, a SaaS-based security management platform that provides unified threat detection and response. This is complemented by USM Central, which provides a 'manager of managers' view for large organizations or MSSPs overseeing multiple USM Anywhere instances. Beyond software, LevelBlue offers an extensive portfolio of Managed Security Services (MSS), including Managed Detection and Response (MDR), Managed Cloud Security, and Incident Readiness & Response. A critical component of their offering is LevelBlue SpiderLabs, an elite global team of over 1,000 security consultants and threat hunters who provide 24/7/365 monitoring. They also provide the 'BlueApps' ecosystem, which consists of pre-built integrations that allow USM Anywhere to orchestrate actions with over 360 telemetry sources and third-party security tools like Microsoft Sentinel, CrowdStrike, and SentinelOne.
Originally a Spanish startup, LevelBlue now maintains a massive global footprint with regional headquarters in London (EMEA), and a significant presence in the Middle East, including offices in Dubai Internet City. The company has aggressively expanded its international reach through strategic partnerships with local MSSPs and telcos. In the Middle East, a high-growth region for the company, LevelBlue recently strengthened its collaboration with Mindfire Technologies, the region's largest MSSP, to deliver localized threat detection and cloud security services to government and enterprise clients in the UAE and Saudi Arabia. LevelBlue is also a founding member of the Global Telco Security Alliance, partnering with giants like Etisalat, Singtel, and Telefónica to share threat insights and best practices across more than 60 countries and 1.2 billion customers.
Recent updates to the USM Anywhere platform in 2024 and 2025 have focused on enhancing automation and deepening compliance coverage. A major addition is the 'Automated Playbooks' feature, which allows analysts to initiate fully automated remediation workflows from alarms, reducing the time from detection to containment. The platform also underwent a significant refresh of its Investigations UI and API, improving performance and providing a unified pane for managing incidents across multiple instances. On the compliance front, LevelBlue added updated templates for PCI DSS v4.0, ISO 27001:2022, and NIST 800-171 to reflect current regulatory standards. Additionally, the launch of the 'SpyCloud' BlueApp has brought advanced dark web monitoring directly into the platform, alerting users when corporate credentials or stolen data appear on underground markets.
The culture at LevelBlue, affectionately known as the 'Alien Nation,' is centered on the values of simplicity, inclusivity, and outcome-driven performance. The company has long been recognized for its commitment to Diversity, Equity, and Inclusion (DEI), winning awards such as the 2021 Diversity and Inclusion Champion Award. Leadership figures like Todd Waskelis and Bindu Sundaresan are frequently highlighted for mentoring underrepresented talent and building diverse teams. LevelBlue operates with a 'mission-first' mindset, aiming to democratize security by making it attainable for organizations of all sizes. The work environment encourages continuous learning, supported by the 'LevelBlue Learning' ecosystem, and promotes a collaborative philosophy where researchers from SpiderLabs work alongside customer success teams to ensure clients are resilient against emerging global threats.
The heart of LevelBlue's community engagement is the Open Threat Exchange (OTX), the world's largest open threat intelligence community. With over 80,000 participants from 140 countries, OTX democratizes security by allowing researchers to share 'pulses' of threat data for free. This community contributes over 20 million threat indicators daily, which are curated by LevelBlue researchers to improve detection rules for all users. Beyond OTX, LevelBlue fosters a robust ecosystem through its 'Success Center,' which provides user forums, documentation, and a developer community for building custom integrations. The company also hosts regular webinars, user groups, and 'AlienVault Certified Security Engineer' (LBSE) certification programs to empower IT professionals with the skills needed to manage advanced security operations in their own environments.
LevelBlue USM Anywhere
By LevelBlue
