Companies Using SpyCloud

Our crawler pulls TXT records for every domain in the index, and SpyCloud's is one of the security records that turns up on serious company domains. A domain counts when a TXT record contains spycloud-domain-verification. Our October 2026 crawl puts that at 2,355 domains, 1,905 matched to a company, 8th of 17 in Security Testing & Compliance. When I re-read the 2,366 domains in our clean set on 15 October, 2,357 still carried the record, a near-perfect match.

What the record proves

SpyCloud's Employee ATO Prevention FAQ says domain ownership must be verified to see breach details, and that once a domain is added SpyCloud monitors every matching address. There are five verification methods, and DNS is one, so our count is a floor on that score. It's a ceiling on current customers in the other direction: the record stays after a contract ends. What it does show is a company that wanted to see which of its employees' logins were circulating among criminals.

Sales signal: a SpyCloud domain has a security team that thinks about identity as the attack path. Identity, MFA and session-security vendors will find the conversation already started.

One record per domain

SpyCloud issues a separate value per domain, so DNS can't group these domains into accounts the way it can for Wiz or Detectify. The 2,357 domains carry 2,371 values and only 22 values repeat, mostly where our index lists one company's hostnames as separate domains, such as five Zoom hosts and six student-union sites at Rensselaer. LinkedIn matching shows modest portfolios instead: Plasser and UNIQA have four domains each, Döhle Group and Kuhn three.

"Every SpyCloud domain carries its own value, so the list can't be collapsed by account. You have to collapse it by company." - David Thomson, CTO at TechnologyChecker.io

Sales signal: dedupe by company name and parent before you count accounts; the domains-per-company ratio is low, so most rows are one organisation.

A slow, steady count

The usage chart moves from 1,979 domains in June to 2,355 in October. That is mostly our crawl: the domains we cover turn over every month as dead sites go and new ones are found, and our DNS detection widened over the summer. Removals are rare. 19 domains dropped the record since 16 March 2026, 2 still carry it on another hostname, and 12 of the 20 dropped hostnames had really removed it when I checked.

Sales signal: about 0.8% of domains dropped the record in seven months. Because the record outlives a contract, that says little about renewals.

Older, larger, regulated

14.6% of matched companies with a known size have more than 1,000 staff, against 9.84% on Have I Been Pwned's page. The age profile is the oldest of the five DNS-verified security tools I covered this month: 53.36% were founded before 2000 and only 3.55% in the 2020s, against 22% before 2000 and 12.4% in the 2020s on Detectify's page. IT services lead at 7.19%, but law (5.13% across two rows), insurance (3.4%) and hospitals (4.24%) are high for a security tool. The named rows run from ASML and Intuit to Coke Consolidated, Envoy Air and Crate & Barrel.

Sales signal: these are firms with regulated client data and an incident-response duty. Pitch compliance evidence and response speed, not novelty.

Austria, Australia and Luxembourg

The United States has 686 matched companies. Australia has 250, Austria 132 and the United Kingdom only 101. Luxembourg has 43 and Belgium 72. I checked 425 Austrian, Australian and Luxembourg domains for a common reseller in their other TXT records and mail settings and found none: the most common shared entry is Microsoft 365's mail setting. The Austrian names are real organisations, UNIQA, ANDRITZ, Red Bull and Plasser among them. Austria's 132 is also more than Germany's 81, the reverse of the other DNS-verified security pages, KnowBe4 included, where Germany outnumbers Austria every time.

Sales signal: SpyCloud has unusual reach in Austria and Australia. A vendor selling into those markets gets a ready list of identity-aware buyers.

Overlap, not switching

We publish no migration table for SpyCloud. The largest overlap our checks found is KnowBe4: 216 domains run both today, out of 219 ever seen with both, 9.13% of the 2,366 clean domains. SpyCloud finds stolen credentials and KnowBe4 trains the staff who lose them; they're layers, not substitutes.

"Where a company runs SpyCloud and KnowBe4 together, it's treating its people as the attack surface. 216 domains do." - David Thomson, CTO at TechnologyChecker.io

Sales signal: the 216 domains with both records are the most security-mature part of this list. Put them first for identity threat detection.

The stack around it

On the clean set, WordPress runs on 38.72%, Google Analytics on 61.24% and Cloudflare on 42.1%. OneTrust is on 12.51%, against 5.71% on Have I Been Pwned's page, and TYPO3 on 3.3%. Duo Security (3.0%) and 1Password's record (2.7%) are the most common identity tools we see.

Sales signal: OneTrust's presence points to privacy and compliance teams with budget. Expect formal procurement.

What it costs

SpyCloud quotes every deal. Its FAQ says Enterprise Protection is tiered by the number of employee accounts protected, consumer protection by customer accounts, and the Investigations API by queries, with the portal priced by seat.

Sales signal: pricing by employee count means larger companies renegotiate as they grow. Headcount changes at a SpyCloud account are a timing signal.

Key takeaways

1. 2,355 domains in October 2026, 8th of 17; each verified a domain to see SpyCloud breach details at least once.

2. One value per domain, so count accounts by company, not by code.

3. 14.6% of matched companies have more than 1,000 staff, and 53.36% were founded before 2000.

4. Australia (250) and Austria (132) both outrank the UK (101).

5. 216 domains also run KnowBe4.

How to use this list

Dedupe by company, start with the larger regulated firms, and treat each row as a past verification. Our DNS statistics report explains why we read TXT records as history. The full list of 2,355 domains, with 1,905 matched companies and their size, country and industry, is on TechnologyChecker.io.