Threat intelligence analysts and builders. Talk to someone who does this work, and get a straight answer.
Contact usGet a DemoStart a free trialMorado means purple.
Red is the risk: what attackers are using against you. Blue is the defense: your team and your tools. Where they meet, you get purple: see what attackers see, and act before they do.
Joining forces with Threatnote.
In 2025 we joined forces with Threatnote. Threatnote began as an open source-based platform for managing threat intelligence, built by Brian Warehime, a former senior leader in threat discovery and CTI at ZeroFox and Dragos, because analysts needed a better way to run a program. Pairing Threatnote with our analysts gave us what neither had alone: software built by practitioners, and practitioners who use it every day. That platform is Threatnote, the Morado platform you see today.
The people who built it.
Peter Zwers
Cybersecurity executive and senior sales leader with a proven track record of building teams and opening new markets. Leads Morado's strategy, growth and go-to-market.
Jordan Kalm
Combat veteran and threat intelligence operator with a background across CTI, fraud and security operations. Built CTI-as-a-service programs at two companies and has stood up threat intelligence programs for organizations across industries. Runs Morado's operations and intelligence services.
Brian Warehime
Veteran with a background in the U.S. Intelligence Community, and a former senior leader in threat discovery and CTI at ZeroFox and Dragos. Built Threatnote, now the Morado platform, and is an active voice in the CTI community on collection management and maturity models.
What we're here to do.
Morado helps security teams, and the MSSPs that serve them, see what attackers see and act before they do. Our platform and analysts find, prioritize and respond to the threats and exposures that can reach your organization, your people and your locations.
A world where every organization, regardless of size or budget, has the threat intelligence function it needs to see and stop the threats and exposures that matter.
Our values
Evidence over volume
We spent years watching teams drown in alerts and reports, and more output never answered the question that mattered: what should we fix first? So every finding in Morado carries its evidence: what attackers are doing with it, and what it touches in your environment. If we cannot show the proof, we do not make the claim.
People decide
Software and analysts do the heavy lifting: collecting, enriching, ranking and drafting. People make the call. Our analysts supplement your team and never replace it, and AI speeds up the work without taking the decision. Your program, your priorities, your name on the result.
Show, don't claim
We build what works today and show it working. No roadmap promises, no demos of features that do not ship. We would rather earn your business with a program that runs on day one than with a pitch.
Built by practitioners
Morado began as a team of analysts, and we still run intelligence programs for customers every day. The platform is built by people who do the work, for the people who do the work.
Meet the team.
Tell us what you are trying to solve. A person who does this work will reply.