KELA Cyber Threat Intelligence Platform

Cybersecurity has repeatedly swung between proactive protection and reactive detection/response as environments and threats evolved. The early “castle-and-moat” era relied on perimeter defenses like firewalls and intrusion prevention systems, but cloud adoption, mobile technologies, and increasingly open connectivity eroded the traditional perimeter. This shifted industry emphasis toward detecting and responding to incidents in real time, elevating SIEM as a central standard. Yet the growth in incident volume and complexity—paired with a shortage of skilled practitioners—reduced SOC efficiency, and even AI/ML has not fully closed the gap. Meanwhile, a proliferation of specialized tools (NDR, EPDR, ITDR) improved certain workflows but also added operational complexity and confused buyers with overlapping categories.

As multi-cloud architectures and post-COVID mobile workforces increase heterogeneity, proactive protection is resurging—now grounded in Cyber Threat Intelligence (CTI) rather than classic perimeter walls. CTI aggregates signals from sources such as public threat feeds, vendor research, and dark web monitoring, translating indicators of compromise and adversary TTPs into actionable insights. This supports Attack Surface Management (ASM) by discovering unknown assets and vulnerabilities, contextualizing threat likelihood, enabling threat hunting and incident response, and providing continuous external monitoring of an organization’s “virtual perimeter.”

KELA, founded in 2015 in Tel Aviv by veterans of military intelligence, evolved from traditional CTI into an “External Cyber Security” platform. It unifies external signals into a single data model, leverages historical artifacts plus real-time feeds, and blends expert research with automation to deliver contextualized risk findings across ASM, third-party risk, identity security, ransomware prevention, and more—without agents or access to internal networks. Modular capabilities (e.g., Threat Landscape, Threat Actors, Investigate, Identity Guard, TPRM, Monitor, Technical Intelligence, AiFort) integrate with SOCs via APIs, while challenges include add-on remediation, complex licensing, and limited end-to-end compliance monitoring.

• The “castle-and-moat” security model dominated cybersecurity about three decades ago.
• Cloud and mobile adoption contributed to erosion of the traditional network perimeter.
• SIEM tools were widely regarded as a gold standard for detection and response.
• A shortage of skilled cybersecurity workforce has reduced SOC efficiency.
• Specialized categories cited include NDR, EPDR, and ITDR.
• Cyber Threat Intelligence aggregates sources such as public threat feeds, security vendor research, and dark web monitoring.
• An organization’s attack surface is the set of vectors that can be used to attack, gain unauthorized access, or steal data.
• KELA is headquartered in Tel Aviv, Israel and was founded in 2015.
• The Threat Actors module monitors over 6.7 million entities involved in hacking and tracks their discussions.
• KELA was recognized among overall leaders in KuppingerCole’s Attack Surface Management Leadership Compass published in September 2023.

• “Looking back at the history of the cybersecurity industry, it is really difficult not to notice how it serves as a perfect illustration of the spiral model of historical development.”
• “In a new, open and connected world, the focus of cybersecurity has gradually shifted from proactive protection towards quickly detecting and responding to threats as they occur.”
• “A multitude of specialized solutions focusing on network (NDR), endpoint (EPDR), or identity (ITDR) threats… only introduce additional complexity to the existing security infrastructures and confuse customers with an entire alphabet soup of acronyms.”
• “The ultimate goal of a CTI solution is to turn this multitude of signals into actionable insights into potential and current cybersecurity threats that could harm an organization.”
• “What can be viewed as the new virtual perimeter of a modern organization is its attack surface.”
• “For KELA, however, the spectrum of services provided by a typical CTI platform… is just the tip of the iceberg.”
• “The platform leverages historical data and unique intelligence to provide rapid assessments and advance alerts about potential threats and vulnerabilities…”
• “The platform’s architecture is modular, with individual but tightly integrated capabilities available for individual licensing according to customers’ needs.”
• “In a way, it combines capabilities of multiple security solutions… And yet, all these capabilities operate without requiring changes in an organization's internal systems — no agent deployment or access to internal networks.”
• “Its architecture is designed in a way to ensure that even a partial compromise would not negatively impact its operations.”