Nothreat and Carahsoft to bring AI threat platform to US agencies

Nothreat, the London-headquartered cybersecurity vendor, has appointed Carahsoft Technology Corp. as its Master Government Aggregator in the United States, giving public-sector agencies access to its preemptive threat-detection platform through a range of established cooperative purchasing vehicles, including TIPS, OMNIA Partners, and E&I Cooperative Services contracts.

The partnership is designed to sidestep the procurement friction that often delays security tool adoption in government environments. By riding Carahsoft's existing contract infrastructure, Nothreat avoids the lengthy solicitation cycles that can leave agencies exposed for months while new vendors work through compliance and acquisition processes.

What the platform does

Nothreat's offering combines three components. CyberEcho deploys digital twins of an organisation's IT services, including web applications, APIs, VPNs and databases, as decoys. Because legitimate users have no reason to touch a decoy, any interaction is treated as an unambiguous attack signal, generated in an isolated environment with no risk to live data. A behavioural AI layer classifies threats without relying on known vulnerability signatures or Common Vulnerabilities and Exposures (CVE) entries, which is the critical distinction the company draws against conventional signature-based tools. ThreatShield then pushes validated threat intelligence in real time to the organisation's existing firewalls, claiming support for more than 20 firewall vendors through a single configuration change.

The vendor cites the July 2025 Microsoft SharePoint "ToolShell" campaign as a live demonstration of the approach. According to the release, Eye Security confirmed 396 compromised systems across 145 organisations in 41 countries during that incident. Nothreat says its platform detected, classified and blocked the attack more than 40 days before CVE-2025-53770 was formally published, though this claim is sourced from the vendor's own release and has not been independently verified by this publication.

Sergej Kostenko, chief executive of Nothreat, said: "Attackers now use AI to generate thousands of variations of the same attack until one gets through, and each of them can look like legitimate traffic. Public Sector organisations cannot afford to wait for a signature or a patch to catch up."

Market and regulatory context

The US public sector represents one of the most structurally attractive markets for cybersecurity vendors with credible zero-day and AI-threat capabilities. Federal civilian agencies are operating under binding operational directives from CISA requiring faster vulnerability remediation, while the White House's 2022 zero-trust architecture mandate continues to drive procurement of layered, identity- and behaviour-aware security tooling. State and local governments, healthcare systems, and utilities, all named by Nothreat as target customers, face similar pressure from NIS2-equivalent frameworks and sector-specific regulators.

The deception-technology category in which CyberEcho competes is well-established but fragmented. Attivo Networks, acquired by SentinelOne in 2022, brought honeypot-style deception into an endpoint-detection platform; Illusive Networks, Deception Grid (TrapX), and Acalvio occupy adjacent positions. The differentiator Nothreat is pressing is the pre-CVE detection window, which maps directly onto the gap between a novel exploit's first use in the wild and its public disclosure, a gap that averaged more than 100 days in some threat-intelligence analyses.

Nothreat holds ISO/IEC 27001:2022 certification and SOC 2 Type I attestation, the baseline credentialling expected by most US federal procurement officers. The platform supports on-premise and customer-hosted cloud deployment, with data-sovereignty controls the company says are designed for public-sector compliance, an important consideration for agencies handling classified or sensitive unclassified data that cannot transit commercial cloud infrastructure. No contract value or minimum commitment was disclosed in the announcement.