Red Sift is a cyber security company that protects the public-facing parts of an organisation: its email domains, brand, certificates and internet-facing assets. Security and IT teams use it to stop attackers sending email in their name, find lookalike domains, keep track of every TLS certificate and see what infrastructure they expose to the internet.
It suits organisations whose domains and brand are targets for phishing and impersonation, and that need one view of an exposure that is otherwise spread across DNS, email and certificate tooling.
At A Glance
| Vendor | Red Sift |
|---|---|
| Category | Email and communications security, PKI and certificate monitoring |
| Identities covered | Public and private TLS certificates, email domains and senders |
| Deployment | SaaS, with an optional private PKI agent |
| Agentic AI | Radar, an LLM based assistant inside the platform |
| Customers | Save the Children, Bird & Bird, William Fry, ITV, TalkTalk |
| Market classification | Email & Communications Security; also PKI & Certificate Lifecycle |
What Red Sift Does
Phishing, spoofing and business email compromise all rely on the gap between what an organisation owns and what it can see. A domain without DMARC enforcement can be spoofed, a registered lookalike can host a fake login page, and a certificate issued by an unknown party can go unnoticed. Red Sift closes that gap by watching the public record, from DNS and Certificate Transparency logs to newly registered domains, and turning what it finds into fixes, so teams see their external exposure the way an attacker would.
Products
OnDMARC
OnDMARC is for organisations that want to stop others sending email from their domains. It shows the email security posture of each domain at a glance and configures SPF, DKIM, DMARC, BIMI and MTA-STS in one place.
| Dynamic SPF | Flattens records at query time to stay under the SPF 10 lookup limit |
|---|---|
| VMC provisioning | Simplifies BIMI adoption |
| DNS Guardian | An add-on that monitors DNS configuration continuously for dangling records, CNAME takeover and SubdoMailing risks |
Brand Trust
Brand Trust protects brands from lookalike domains and impersonation. It scans up to 150 million domains daily, recognises misuse of brand marks, executive images and branded content even when distorted or obfuscated, and scores risk dynamically using brand marks, faces, keywords, industry tags and email readiness. When a malicious site is found, Brand Trust bundles the evidence into a takedown package for registrars and partners, and its shadow asset feature uses WHOIS, SSL, MX and other metadata to find forgotten or unowned infrastructure tied to the brand.
Certificates
Certificates gives PKI and operations teams a complete inventory of the certificates their organisation relies on. It watches every public certificate in real time through the Certificate Transparency ecosystem, finds certificates issued by third parties or embedded through external services, and surfaces those issued by private or internal CAs. Alerts cover misconfigurations, expired or undeployed certificates, automation gaps and rogue activity such as unauthorised issuance within minutes.
ASM
Red Sift ASM discovers and manages an organisation’s external-facing and cloud assets, giving security teams a current picture of the attack surface an outsider can see. Findings sit alongside the domain, email and certificate data from the other products, so an exposed host can be tied to the domain and certificate it uses.
Radar
Radar helps teams investigate and fix issues across email, domains and internet-facing assets, following built-in expert playbooks for multi-step security analysis. Red Sift reports that investigations taking 20 minutes come down to about 2. The LLM behind Radar runs inside Red Sift’s own platform, and customer data is not used for training.
How It Works
Red Sift runs as a cloud platform, and Certificates deploys with nothing to install. A private PKI agent extends discovery to internal infrastructure.
| Component | What it does |
|---|---|
| Certificate discovery | Certificates correlates Certificate Transparency logs, IPs, hostnames and DNS records, and covers hostnames, services and private infrastructure, consolidating certificates from every issuing authority. |
| Email enforcement workflow | An OnDMARC rollout identifies every sender, updates SPF and DKIM, and moves the DMARC policy from p=none to p=quarantine or p=reject. |
| Radar intelligence | Radar combines internet-scale security intelligence and a global network of monitoring points with an LLM. |
Identities And Systems Covered
| Certificates | Public and third-party TLS certificates and private PKI certificates. |
|---|---|
| Email senders and domains | SPF, DKIM, DMARC, BIMI and MTA-STS configuration for sending domains, including third-party gateways. |
| DNS | Subdomains, dangling DNS records and CNAME takeover risks. |
| External assets | Internet-facing and cloud assets, plus lookalike domains. |
Company Background
| Founders | Rahul Powar (co-founder and CEO) and Randal Pinto (co-founder and CTO). |
|---|---|
| Funding | $54m Series B (2022). |
| Customers | More than 1,500 reported teams across EMEA, APAC and the US. |
| Team | Team members in 18 countries. |
| Recognition | Included in G2 Best Software 2026. |
Note: This overview is compiled from Red Sift’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.