Compliance, Advisory and Offensive Security for Highly Regulated Industries

Founded in 2001 by Richard E. Dakin, Kennet Westby and Alan Ferguson, Coalfire is a cybersecurity services firm built around organizations that operate under regulatory scrutiny: cloud service providers, federal contractors, healthcare systems, financial institutions, retailers and SaaS companies. The business spans three lines, covering advisory work on FedRAMP, CMMC, cloud engineering and healthcare risk; third-party assessment and audit; and offensive, defensive and managed security delivered through the DivisionHex division. The firm reports more than 1,000 enterprise clients and a comparable number of practitioners, over 900 of whom hold licenses or certifications.

Assessment work runs through Compliance Essentials, a platform that maps controls across overlapping frameworks so a single evidence request and interview cycle can satisfy several audits at once. It pulls evidence from MCP-compatible sources such as Jira, GitHub and Microsoft 365 rather than requiring bespoke integrations, and applies an auditor-reviewed AI layer to first-pass policy review. Certified assessors then validate findings against more than 100 frameworks, among them FedRAMP, PCI DSS, SOC 1/2/3, ISO 27001, 27701 and 42001, HITRUST CSF, HIPAA, GDPR and NIST AI RMF.

Market position rests on assessor credentials rather than tooling alone. The firm claims first-to-market status in cloud security engineering and in assessing against PCI and CMMC, operates as a certified C3PAO and FedRAMP third-party assessor, and supports over 700 cloud service partners alongside alliances with AWS, ServiceNow and the compliance-automation vendors Vanta and Drata. Recent expansion targets AI risk through the CoalfireForgeAI, LegionAI and GuardianAI offerings, which address secure GenAI and agentic adoption, agent-assisted security operations, and AI governance frameworks.