Coalfire

Coalfire
Name	Coalfire
Type	Private
Industry	Cybersecurity
Founded	1999
Founder	Robert W. Geer (founder)
Headquarters	Westminster, Colorado, United States
Area served	Global
Key people	Dan Hoffman (CEO), Robert W. Geer (Founder)
Services	Penetration testing, risk assessments, compliance auditing, managed security
Revenue	Private
Employees	~1,500 (2020s)

Coalfire is a private cybersecurity firm specializing in penetration testing, advisory services, and compliance assessments for organizations across financial services, healthcare, retail, government, and cloud providers. The company provides technical testing, audit support, and cloud security services to help clients achieve regulatory compliance and improve information security posture. Coalfire operates internationally with offices and teams that engage with notable technology providers, standards bodies, and regulatory frameworks.

History

Coalfire was founded in 1999 in Westminster, Colorado, during a period of expansion in cybersecurity consulting alongside firms such as Symantec, McAfee, Trend Micro, RSA Security, and Mandiant. Early work included network assessments and vulnerability research influenced by developments at CERT Coordination Center, SANS Institute, USENIX, and interactions with standards from National Institute of Standards and Technology (NIST). In the 2000s Coalfire expanded services to support compliance with frameworks like Payment Card Industry Data Security Standard (PCI DSS), aligning with major stakeholders including Visa Inc., Mastercard, American Express, and Discover Financial Services. Growth continued with cloud security offerings as cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform rose to prominence, and Coalfire engaged with ecosystem participants like Salesforce, ServiceNow, VMware, and Cisco Systems.

During the 2010s Coalfire increased advisory and managed services, participating in industry groups such as Cloud Security Alliance, HITRUST Alliance, and interacting with regulators including Office of the Comptroller of the Currency, Federal Financial Institutions Examination Council (FFIEC), Securities and Exchange Commission (SEC), and Centers for Medicare & Medicaid Services (CMS). Strategic hires and acquisitions paralleled moves by firms like Deloitte, PwC, KPMG, Ernst & Young, and Accenture in professional services. Leadership transitions tied Coalfire to board and executive networks spanning Fortune 500 companies, venture investors, and private equity firms.

Services and Products

Coalfire delivers technical services such as penetration testing, red team operations, vulnerability assessments, application security testing, and cloud security assessments. These offerings interact with toolchains and platforms including Burp Suite, Metasploit, Nmap, Splunk, Tenable, Qualys, and Rapid7. Advisory and managed services cover risk assessments, security architecture reviews, incident response planning, tabletop exercises, and managed detection and response, comparable to services from CrowdStrike, FireEye, Palo Alto Networks, Check Point Software Technologies, and Trend Micro. Coalfire also provides audit preparation and gap remediation for compliance standards and produces reporting artifacts used by auditors from firms such as Ernst & Young, KPMG, Deloitte, and PwC. For cloud-native clients the company offers cloud control mapping, secure migration guidance, and DevSecOps integration aligned with Kubernetes, Docker, HashiCorp Terraform, and Ansible workflows.

Productized offerings include platform-based compliance automation, penetration testing-as-a-service, and continuous control monitoring that interoperate with Okta, Ping Identity, F5 Networks, Auth0, and identity providers used across enterprises. Coalfire’s testing engagements frequently examine integrations with enterprise applications like Oracle Database, SAP ERP, Microsoft SQL Server, MongoDB, and PostgreSQL.

Certifications and Compliance

Coalfire conducts assessments against numerous standards and regulatory regimes, including PCI DSS, SOC 1, SOC 2, ISO/IEC 27001, HIPAA, HITRUST CSF, FedRAMP, NIST SP 800-53, NIST Cybersecurity Framework, CMMC, and GDPR-related readiness work. The firm acts as an authorized assessor and auditor for programs such as PCI SSC-related assessor activities and performs FedRAMP readiness assessments for cloud service providers pursuing authorization with General Services Administration (GSA) and Federal Risk and Authorization Management Program stakeholders. Coalfire’s compliance work interfaces with legal and regulatory actors including Department of Health and Human Services, Department of Homeland Security, US Department of the Treasury, and state-level regulators like the New York State Department of Financial Services (NYDFS).

Notable Engagements and Clients

Coalfire has provided services to organizations across banking and finance, healthcare, retail, technology, and government. Clients and engagements have included collaborations or assessments related to institutions such as JPMorgan Chase, Bank of America, Wells Fargo, Goldman Sachs, Morgan Stanley, CVS Health, UnitedHealth Group, Kaiser Permanente, CVS Pharmacy, Target Corporation, Walmart, Best Buy, eBay, Shopify, Zoom Video Communications, Dropbox, Salesforce, PayPal, Square (Block, Inc.), Stripe, American Airlines, Delta Air Lines, Boeing, Lockheed Martin, Northrop Grumman, US Department of Defense, GSA, NASA, Centers for Medicare & Medicaid Services, and numerous cloud service providers. Coalfire’s work has been cited in industry reporting alongside research by Krebs on Security, The Register, Wired, The Wall Street Journal, and Bloomberg.

Organizational Structure and Governance

Coalfire operates with executive leadership and practice leads overseeing technical, advisory, and industry vertical teams. Governance includes boards and committees reflecting corporate, risk, and audit functions similar to structures at Cisco Systems, Microsoft Corporation, IBM, Oracle Corporation, Intel Corporation, and Amazon.com. The company’s organizational model supports regional delivery teams aligned to sectors like financial services, healthcare, retail, and public sector, and employs subject-matter experts with backgrounds from institutions such as NSA, FBI, CIA, US Air Force, and academia including Carnegie Mellon University, Massachusetts Institute of Technology, Stanford University, University of California, Berkeley, and Georgia Institute of Technology.

Controversies and Incidents

As a firm operating in adversarial testing, Coalfire’s engagements occasionally intersect with public incidents, vulnerability disclosures, and contested pen-testing outcomes similar to public debates involving Mandiant, CrowdStrike, Symantec, and Check Point. Disputes have centered on scopes of testing, responsible disclosure coordination with vendors such as Cisco Systems, Microsoft, VMware, and Apple Inc., and the handling of sensitive findings for regulated entities overseen by agencies like SEC and FTC. The company has responded to criticisms through client remediation support, engagement-level transparency, and alignment with disclosure frameworks promoted by FIRST and ICASI.

Category:Cybersecurity companies