Cybereason
MalOp-based EDR/XDR, now sold by LevelBlue as LevelBlue Endpoint Security
Overview
Cybereason's endpoint detection and response platform is built around the MalOp engine, which merges related alerts into a single attack story. LevelBlue completed its acquisition of Cybereason on 25 November 2025 and now sells the platform as LevelBlue Endpoint Security; in Japan it is still sold under the Cybereason name.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 12 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Multi-layered prevention (NGAV, behavioural, deception)
- MalOp attack correlation
- SpiderLabs threat intelligence
- Automated or one-click remediation
- Cloud, private and offline deployment
Use cases
What you can produce with Cybereason
- Related endpoint activity correlated into a single MalOp attack story
- Malware, ransomware and exploit blocking with NGAV and behavioural prevention
- One-click or automated remediation from the investigation view
- Cloud or on-premises deployment, including offline networks
- Optional LevelBlue 24/7 MDR and SpiderLabs threat intelligence
- Sales and support in Japan under the Cybereason name by Cybereason G.K.
Cybereason is now a LevelBlue product, and the core idea survives: the MalOp engine merges related endpoint activity into one attack story, with prevention, one-click remediation and an on-premises edition around it. Existing customers keep their console.
The open question is direction: LevelBlue is a services company that also made SentinelOne a preferred partner in 2026, and it publishes no pricing. In Japan the case is strongest; elsewhere it suits buyers who want EDR bundled with LevelBlue's MDR. Get a written roadmap commitment first.
What we found
Cybereason no longer exists as an independent company. LevelBlue, the Dallas-based managed security provider formed from AT&T's cybersecurity business in 2024, signed to buy it on 14 October 2025 and completed the deal on 25 November 2025; terms were not disclosed. cybereason.com now redirects to a LevelBlue page announcing the change, and outside Japan the platform is sold as LevelBlue Endpoint Security, which LevelBlue says is an evolution of the Cybereason Defense Platform.
The sale ended a rough stretch. A planned merger with Trustwave, announced in November 2024, fell through. Chief executive Eric Gan sued major investors SoftBank and Liberty Strategic Capital over blocked financing in February 2025 and resigned in March, after which the company reportedly took $120 million from those investors. There had been three rounds of layoffs since 2022, the year it had been preparing an IPO at a reported $5 billion valuation.
The technology is the reason it is still worth a look. The MalOp engine groups related endpoint activity into one investigation, so an analyst sees an attack's root cause, spread and affected machines together instead of a queue of separate alerts. Around it sit next-generation antivirus, behavioural prevention, one-click remediation and an on-premises edition for isolated networks. Figures such as up to 93 per cent shorter investigations and 100 per cent detection in MITRE testing come from the vendor.
Japan is where the brand is most alive: Cybereason G.K. still sells it under its own name from Tokyo and announced an automatic un-isolation feature for false positives in September 2026. Elsewhere it now sits inside a services company that named SentinelOne a preferred global partner in March 2026. Pricing is quote-only, and earlier versions of this page showed a three-tier table and free trial that no vendor page offers. Ask LevelBlue directly how long the platform will be developed before renewing.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
Notable facts
- Cybereason's three founders all served in Israel's Unit 8200, the elite intelligence and cyber unit — making it one of the highest-pedigree cybersecurity teams in the industry.
- The Malop engine can correlate an attack operation spread across 100 different endpoints over 72 hours and present it as a single, unified attack story.
- Cybereason's AI processes 9 million endpoint events per second across its customer base — more real-time security telemetry than any national intelligence agency processes.
Frequently asked questions
About this listing
This entry was compiled from publicly available data including Cybereason's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Cybereason unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Cybereason directly →
Spotted something out of date? Suggest an update →
More in Security & Safety
