What does your product do?

Phantom is the first community-powered security automation and orchestration platform. It provides the connective tissue to unite your existing point security products into a single defense system.

What problem does it solve?

The Phantom platform automates and orchestrates key stages of security operations from prevention to triage and resolution; delivering dramatic increases in productivity and effectiveness. Ranging from simple automation to fully autonomous response, Phantom lets you choose the best balance that fits your organization’s needs while increasing security and accelerating security operations. Focused on closing the security skills gap by enabling enterprise security operations to work smarter, respond faster, and strengthen their defenses; Phantom provides the flexibility to connect in-house and third-party systems into one open, integrated, and extensible platform.

How are you different from competitors?

The Phantom platform is/provides:

  • Community Focused — Phantom provides a free community edition and encourages all community members to contribute new integration apps and digital playbooks that extend the platform to address new security use cases.
  • Collaborative — Teams need to communicate quickly with one another and document their work for others to understand later. The Phantom platform includes team chat capabilities within the Mission Control area and complete logging of all activity on the platform.
  • Cognitive — Phantom Playbooks codify complex workflows that allow first responders bring to bear all of the experience of your organization to make better decisions and act quickly, confidently, and consistently.
  • Dialable Automation — Phantom Playbooks can operate with the right level of supervision for a given situation. Phantom supports having a human in the loop, on the loop, or out of the loop, depending on the task at hand.
  • Secure — Since the Phantom platform holds authentication credentials and other highly-sensitive information, it’s hardened, encrypts sensitive information, and supports a robust role-based access control facility.
  • Scalable — Phantom was built from the ground up to successfully operate in demanding environments where the volume and velocity of security events can vary dramatically from 1 in one minute to 10,000 in the next.
  • Open and Extensible — Security is ever evolving, evidenced by the multitude of point products available today. The Phantom platform was designed for openness and extensibility as new security scenarios arise, driving new products, new Actions, and new Playbooks.
  • Easy-to-Use — The Phantom onboarding assistant helps configure system settings, connect to a data source, and activate your first few Playbooks.  Once deployed, our visual IDE makes it easy to edit existing or create new Playbooks—even if you can’t write code.

Learn more at:

Competitive criteria to consider:

App Integrations—When considering the scope of 3rd-party product support, look beyond marketing hype and seek the number of unique products/platforms/services supported. Many vendors artificially increase their stats with multiple apps per product or apps that perform internal platform functions and don’t add support a 3rd-party product at all. Get the latest list of apps/integrations at

Security Actions — Consider the number of unique security actions supported by the automation engine. Phantom supports 150+ unique security actions. Phantom actions are abstracted primitives that work across multiple platform technologies, allowing users to create more powerful automated playbooks.

Visual Design & Single Language — Phantom provides a Visual Playbook Editor, allowing non-programmers and programmers alike to build playbooks. Phantom also uses a single language, Python, for customizing Phantom playbooks. Other tools require two or more languages and extensive coding experience to codify manual processes into automated playbooks.

Who has done this before?

We have several public references on our website at Currently, they are: Blackstone, Optiv, In-Q-Tel, Uber, and Rackspace. We also have many non-public references that we can provide to an opportunity under NDA. Learn more about the company's success at:

How do you demonstrate measurable results?

Results are demonstrated in the platform in real time using the dashboard widget shown below. A customer can also generate executive and detail reports which focus on ROI-related metrics, efficacy trends, and efficiency trends over time.