Riot is a cyber security company that helps security teams protect employees from social engineering, phishing, AI-driven attacks such as deepfakes and voice clones, and leaked credentials. It treats staff as “the first line of defense against hackers” and works on employee security posture continuously rather than through an annual training course.
It is for security teams that want employees to act as part of the defence, and most of the employee-facing work is done by Albert, a cyber security coach that lives inside the chat tools people already use.
At A Glance
| Vendor | Riot |
|---|---|
| Category | Employee security posture management, security awareness and email security |
| Identities covered | Employees in Google, Microsoft and Okta environments |
| Deployment | SaaS, data hosted on AWS (Ireland) and Azure (France) |
| Customers | Mistral AI, Deel, Intercom, Deezer, Le Monde |
| Certifications | SOC 2 Type II, ISO 27001 (with 27017 and 27018), GDPR compliant |
| Funding | Series B (2025) |
| Market classification | Email & Communications Security |
What Riot Does
Attackers increasingly go after people rather than systems, and Riot is built around that employee. Training and simulation are only part of the programme: Riot also covers how employees share data, what they report, which of their credentials have leaked and what reaches their inbox. A Karma score rolls all of this into one measure of team security posture, so security teams know where to focus first. Riot sits alongside endpoint detection, firewalls and SIEM tools rather than replacing them.
Products
Awareness
Awareness builds a security culture without pulling people out of their work. Albert delivers short, gamified lessons on social engineering, password security, privacy and GDPR inside Slack, Microsoft Teams and Google Chat, on a schedule the security team sets, in 33 languages.
Simulation
Simulation is phishing practice that looks like the real thing. Teams can describe their own attack scenario and have AI generate a new template from it. Real-time metrics track open rates, click-through, login submissions, password weakness and reporting, and employees who fall for a simulation get a tailored three-minute remedial lesson.
Studio
Studio is a no-code course builder for organisations that want branded training built around their own policies and content.
Sonar
Sonar is a data loss prevention tool for files and data shared through Microsoft or Google workspaces, aimed at the permission drift that builds up as people share with partners and forget. It hands ownership to employees, who review and manage how they share data, and it connects to Google and Microsoft in as few as six clicks.
Slash
Slash catches the malicious email that gets past existing filters. It combines semantic analysis with technical signals, and Albert warns employees directly inside a suspicious message. When impersonation is suspected, Albert checks with the employee in chat, and a confirmed threat is removed from every mailbox in the company.
Inbox And Breaches
Inbox is a 24/7 security hotline where employees can raise concerns, with ticket triage for the security team. Breaches collects the data leaks that have affected employees, ranks them by severity, and has Albert tell each person so they can change their login credentials.
How It Works
Riot is a cloud service, with data hosted on AWS in Ireland and Azure in France so it stays in the EU. Setup takes a reported five minutes.
| Component | What it does |
|---|---|
| Directory sync | The employee list stays current through automatic sync with the organisation’s directory. |
| Albert | Training, breach notices and email warnings all reach employees through the chat coach. |
| Mailbox access | Slash needs read access to analyse email and write access to add alerts inside Google and Microsoft mailboxes. |
| Data export | HRIS and SIEM or SOAR connections run through the API, webhooks and audit log export. |
Identities And Systems Covered
| Human users | Employees synced from Google Workspace, Microsoft 365 and Okta. |
|---|---|
| Credentials | Employee logins exposed in data breaches, through Breaches. |
| Data sharing | Files and data shared through Google and Microsoft workspaces, through Sonar. |
| Mailboxes | Google and Microsoft mailboxes, through Slash. |
Company Background
| Founded | 2020. |
|---|---|
| Headquarters | Paris, France. |
| Leadership | Benjamin Netter, Founder and CEO. |
| Funding | $30 million Series B in 2025, led by Left Lane Capital. |
| Accelerator | Y Combinator (W20). |
| Reach | A reported 2,000,000+ employees protected. |
Note: This overview is compiled from Riot’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.