RemoteThreat raises $7m to sell nation-state-grade attack tooling to corporate red teams
RemoteThreat left stealth Tuesday with $7 million and a platform that packages implants, C2 and evasion for enterprise and government red teams. Access is gated to vetted buyers over misuse concerns, with early customers including a major bank and a leading AI lab.
The Watch · Security desk
What happened
- Chris Thompson, now chief executive, and Shawn Jones, now chief technology officer, both led IBM's X-Force Red offensive team before founding RemoteThreat.
- Osage University Partners and DataTribe put up the pre-seed money behind the platform.
- Retired US Army General Paul M. Nakasone advises the company through his firm, the Nakasone Group.
- RemoteThreat has joined US Special Operations Command's SOF RACER program and partnered with Talon Defense.
- The Register reported the platform is built to simulate nation-state attacks for Fortune 500 companies and to arm government operators at speed and scale.
Why it matters
- What's now possible capability A red team can buy cross-platform, in-memory implants and configurable evasion as a product instead of building them, so an exercise can mirror a live attacker's methods.
- Who's exposed exposure The platform sold to a bank, an exchange and an AI lab is the same one sold to government mission teams, and the only gate on who runs it is RemoteThreat's own vetting.
- Who has to decide decision Blue teams that scoped drills around noisy automated scanners now have to prepare for engagements using C2 and traffic shaping tuned to blend into their own networks.
- What it sets up precedent A funded, government-advised commercial offensive platform under the US Cyber Strategy makes more such products likely to follow.
Next story · Security · 5h ago
X attributes more than 13,000 suspended accounts to Iranian, Russian and Chinese influence operationsConfirmed2 publishers
RemoteThreat's platform ships implants that run across operating systems and architectures and execute in memory, plus a command-and-control server with configurable traffic profiles that can run alongside a team's existing C2 [10][11]. Operators combine payloads and post-exploitation tools for each engagement, then apply control-flow obfuscation and configurable evasion to fit the target [12]. Those are the techniques an intruder uses to stay on a network undetected. There is no exploit here and no victim; the launch turns offensive capability of this grade into a product sold under the vendor's controls.
The eight connected systems are RemoteThreat's own description, relayed by SecurityWeek, and include mission planning, an initial access framework, an obfuscation pipeline, targeting and analysis engines, and AI assistants [5]. The early-customer list comes from The Register, which described them without names: a major bank, a securities exchange operator, a large US healthcare company and a leading AI lab [15][14]. Neither account includes a price or a demonstration of the implants.
RemoteThreat restricts access to vetted enterprises, defense contractors and US government buyers, citing the risk of misuse [8]. Operators can run tasks by hand, with AI assistance, or hand them to autonomous workflows, bounded by Rules of Engagement, approvals and no-strike controls [6]. The pitch to buyers is speed. "New AI-driven attacks are fast but noisy, while human-driven operations take too long and struggle to scale," Thompson said [13]. The launch aligns with the US Cyber Strategy's call for more private-sector involvement in offensive cyber operations [16].
What to watch
- Whether RemoteThreat or an independent tester publishes any demonstration of its implants and evasion against current EDR.
- Who clears RemoteThreat's vetting bar, and whether the tooling ends up outside the approved buyer set.
- Whether other X-Force or government-trained teams launch rival commercial offensive platforms under the same US policy push.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption20
- Hype gap+35
- Incentives60
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
RemoteThreat emerged from stealth on Tuesday with $7 million in pre-seed funding from Osage University Partners and DataTribe for its offensive operations platform.
- [2]
RemoteThreat was founded by Chris Thompson (CEO) and Shawn Jones (CTO), both former IBM X-Force Red team leaders.
- [3]
The Nakasone Group, the firm launched by retired US Army General Paul M. Nakasone, will serve as a strategic advisor to RemoteThreat.
- [4]
RemoteThreat's O/C/O Platform is built for offensive cyber operations, serving enterprise and critical-infrastructure red teams, US government mission teams, and vetted defense partners.
- [5]
The platform brings together eight connected systems: mission planning and oversight, command and control, implants, an initial access framework, composable capabilities, an obfuscation pipeline, targeting, tasking and analysis engines, and AI assistants.
- [6]
Operations can be run manually, with AI assistance, or by handing specific tasks to autonomous workflows; Rules of Engagement, policies, approvals and no-strike controls constrain consequential actions, and operator decisions, delegated tasks and evidence are kept traceable.
- [7]
RemoteThreat's platform is designed to simulate nation-state level attacks for Fortune 500 organizations and provide government operators with tools to target adversaries at speed and scale, according to The Register.
- [8]
Access to the platform is restricted to vetted enterprises, defense contractors and US government customers due to the potential for misuse.
- [9]
RemoteThreat has partnered with Talon Defense and the Nakasone Group and has joined the US Special Operations Command's SOF RACER program.
- [10]
The platform provides implants that work across operating systems and architectures and support in-memory execution.
- [11]
The command-and-control system has configurable traffic profiles and can run alongside a team's existing C2.
- [12]
Operators can combine payloads, implants and post-exploitation tools for each engagement, and apply control-flow obfuscation and configurable evasion techniques to fit the target environment.
- [13]
New AI-driven attacks are fast but noisy, while human-driven operations take too long and struggle to scale.
- [14]
RemoteThreat has secured early customers including a major bank, a securities exchange operator, a large US healthcare company and a leading AI lab, according to The Register.
- [15]
SC World's account of RemoteThreat is based on a report by The Register.
- [16]
The launch aligns with the US Cyber Strategy's call for increased private-sector involvement in offensive cyber operations.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comFormer IBM X-Force Red leaders launch AI-powered offensive cybersecurity startup
1 article · September 29, 2026
- securityweek.comRemoteThreat Launches With $7 Million for Offensive Operations Platform
1 article · September 29, 2026
Topics and entities
Topics
- AI in Cyber Operations
- Offensive security
- Cybersecurity venture funding
Entities
- US Special Operations Command
- The Register
- Paul M. Nakasone
- RemoteThreat Inc.
- Osage University Partners
- Talon Defense Inc.