Trellix

Trellix

Company type	Private
Industry	Cybersecurity
Founded	2022
Headquarters	Milpitas , United States
Key people	Vishal Rao (CEO)
Products	Hardware, software, and services for cyber threat investigation, malware defense, IT security vulnerability assessment; email protection, endpoint defense, file security, cross-platform management tools, cybersecurity consulting
Number of employees	5000
Parent	Symphony Technology Group

Trellix—previously known as FireEye and McAfee Enterprise—is a privately owned cybersecurity firm established in 2022, with its main office located in Milpitas, California. The company provides a range of hardware, software, and services designed to investigate cyber threats, defend against malware, and assess IT security vulnerabilities.

In March 2021, Symphony Technology Group (STG) completed the acquisition of McAfee Enterprise through a $4.0 billion all-cash transaction, finalizing the deal by July 2021 and initiating plans for rebranding. Subsequently, in June 2021, FireEye divested its brand and product lines to STG for $1.2 billion. STG then combined FireEye with McAfee’s enterprise division to create Trellix, which emphasizes extended detection and response (XDR) capabilities. Concurrently, McAfee Enterprise’s security service edge (SSE) operations were separated into a new entity called Skyhigh Security.

Trellix offers a comprehensive suite of solutions including email protection, endpoint defense, file security, and cross-platform management tools. These are complemented by cybersecurity consulting services such as incident response, vulnerability assessments, and readiness evaluations. By 2020, the company reported revenues of $940 million, held assets valued at $3.245 billion, and employed around 3,400 staff members under the leadership of CEO Vishal Rao. Owned by Symphony Technology Group, Trellix capitalizes on the combined heritage of its predecessors to enhance its competitive position within the cybersecurity market.

History

FireEye was launched in 2004 by Ashar Aziz, an engineer formerly at Sun Microsystems. Its initial commercial offering debuted in 2010, utilizing virtual machine technology to scrutinize internet traffic before it entered corporate or governmental networks.

In December 2012, Aziz resigned as CEO and was succeeded by David DeWalt, the former CEO of McAfee, who was brought in to steer FireEye toward an initial public offering (IPO). The company secured $50 million in venture funding during 2013, bringing total investment to $85 million before going public later that year and raising $300 million. FireEye remained publicly traded until 2021.

In December 2013, FireEye acquired Mandiant for $1 billion. Founded by Kevin Mandia in 2004, Mandiant specialized in incident response and probing notable hacking groups. Following the acquisition, Mandiant operated as a subsidiary that bolstered FireEye’s service offerings and played a key role in investigating major cyber incidents affecting organizations such as Target, JP Morgan Chase, Sony Pictures, and Anthem.

Between 2010 and 2013, FireEye expanded its presence internationally across regions including the Middle East, Asia-Pacific, Europe, and Africa. Although revenue increased eightfold from 2010 to 2012, the company remained unprofitable due to substantial research and development expenditures.

A secondary stock offering in late 2014 raised $1.1 billion to support ongoing product innovation. That same year saw the purchase of nPulse Technologies for approximately $60 million to enhance network security solutions. By 2015, FireEye’s annual revenue exceeded $100 million; however, it continued to operate at a loss.

In January 2016, FireEye acquired iSIGHT Partners for $275 million—a firm specializing in threat intelligence—as well as Invotas, which focused on IT security automation. DeWalt stepped down as CEO later that year; Kevin Mandia—Mandiant’s CEO and former FireEye President—assumed leadership. Under Mandia’s direction, the company underwent restructuring amid declining sales, including workforce reductions of 300–400 employees and a transition toward subscription-based offerings that improved both profitability and revenue growth.

Symphony Technology Group (STG) acquired McAfee Enterprise for $4 billion in March 2021. In June of that year, FireEye sold its product business and brand assets to STG for $1.2 billion while retaining its cyber forensics division Mandiant separately. In October 2021, FireEye’s NASDAQ ticker symbol FEYE was replaced by MNDT.

STG introduced Trellix in January 2022 as a new entity focused on extended detection and response by merging FireEye with McAfee Enterprise operations; Bryan Palma was appointed CEO in September 2021. In January 2025, Vishal Rao took over as CEO of Trellix while also maintaining his role as chief executive at affiliated company Skyhigh Security.

Products and services

FireEye initially specialized in "sandboxing," a method that isolates incoming network data within a virtual machine to detect malware before granting network access. Over time, the company broadened its offerings by acquiring complementary businesses. By 2017, FireEye transitioned from predominantly selling hardware appliances to adopting a software-as-a-service delivery model.

Its portfolio includes solutions for securing networks, email systems, and endpoints, complemented by the Helix platform, which supports the operation of security centers. FireEye’s consulting arm provides expertise in incident response and threat intelligence gathering.

The Central Management System (CMS) consolidates management functions, reporting capabilities, and data exchange across FireEye’s Web MPS (Malware Protection System), Email MPS, File MPS, and Malware Analysis System (MAS). This integration forms a single network appliance that acts as a centralized malware intelligence hub.

FireEye Cloud aggregates Dynamic Threat Intelligence (DTI) from individual MPS devices worldwide, distributing critical zero-day threat information to clients through a combination of automated updates and expert research insights.

After its establishment in January 2022, Trellix—formed by merging FireEye with McAfee’s endpoint, cloud, collaboration, data, application, and infrastructure security divisions—serves more than 40,000 customers with a workforce of 5,000 employees and generates annual revenues of $2 billion. Trellix focuses on enhancing threat detection and response capabilities using machine learning and automation to combat sophisticated cyber threats.

Operations

FireEye has gained recognition for exposing significant hacking collectives.

2008–2014

Towards the end of 2009, FireEye played a key role in dismantling the Mega-D botnet. In March 2011, it collaborated with Microsoft, U.S. law enforcement agencies, and the University of Washington to take down the Rustock botnet. By mid-2012, FireEye conducted analysis on the command and control infrastructure of the Grum botnet spanning several countries.

Prior to its acquisition by FireEye, Mandiant revealed in 2013 an extensive espionage campaign conducted by the Chinese hacking group known as APT1.

In 2014, FireEye Labs discovered two previously unknown Windows kernel vulnerabilities exploited in targeted corporate attacks; these were subsequently patched by Microsoft. The same year, FireEye exposed FIN4, a threat actor engaged in insider trading activities by targeting corporate executives, legal departments, and regulatory staff to gain access to market-sensitive information. Additionally, FireEye reported on APT28, a cyber espionage entity associated with Russian government interests that had been targeting government agencies, military organizations, and security entities since at least 2007.

2015

During 2015, FireEye identified at least fourteen SYNful Knock router implants deployed across Ukraine, the Philippines, Mexico, and India. This covert firmware alteration provides attackers with persistent network access.

In September of that year, FireEye secured an injunction against a security researcher who attempted to disclose vulnerabilities found in its Malware Protection System.

FireEye also uncovered an attack leveraging two zero-day flaws in Microsoft Office and Windows embedded within a résumé-styled Word document that allowed full remote code execution. Microsoft responded promptly by issuing patches for these vulnerabilities.

The Singapore-based FireEye as a Service team detected a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability attributed to the China-based threat group APT3. Adobe released an out-of-band update to address this issue.

2016

During 2016, FireEye monitored a cybercriminal faction known as the "Vendetta Brothers," who specialized in compromising point-of-sale systems to harvest and trade payment card information through their clandestine platform, "Vendetta World."

Around mid-year, FireEye conducted an examination of 72 groups believed to be linked to China, following the 2015 Obama-Xi agreement aimed at curbing economic cyber espionage. Their analysis indicated a reduction in successful intrusions against both U.S. and international targets by the middle of 2014.

FireEye uncovered IRON GATE, a malware targeting industrial control systems that incorporated techniques reminiscent of Stuxnet and focused on Siemens control environments. Siemens later confirmed that this malware did not threaten their operational products.

On May 8, 2016, FireEye identified a zero-day vulnerability in Adobe Flash Player (CVE-2016–4117), which Adobe subsequently patched within four days after being informed.

The company also discovered a significant Android security flaw enabling local privilege escalation to the "radio" user account, potentially exposing SMS messages and call logs. FireEye worked collaboratively with Qualcomm to address this vulnerability.

Moreover, FireEye provided detailed insights into FIN6, a cybercriminal group targeting hospitality and retail point-of-sale systems to steal millions of payment card details for resale on underground markets.

2017–2019

In 2017, FireEye detected a critical vulnerability in Microsoft Office RTF files (CVE-2017-0199) that allowed attackers to execute malicious code through embedded exploits. FireEye partnered with Microsoft to ensure timely disclosure and patch deployment. In 2018, the company aided Facebook in identifying 652 fraudulent accounts, demonstrating its proficiency in countering disinformation operations.

2020–2021

On December 8, 2020, FireEye revealed a sophisticated cyberattack by a nation-state adversary that resulted in the theft of its red team toolkit—essential offensive cybersecurity assets. The firm swiftly issued countermeasures to mitigate the risks posed by these compromised tools. Shortly thereafter, FireEye reported the SolarWinds supply chain compromise to the U.S. National Security Agency (NSA), exposing that the same threat actors were responsible. This revelation uncovered vulnerabilities affecting numerous U.S. federal agencies utilizing SolarWinds software.

Following this incident, cybersecurity company McAfee confirmed that the stolen tools were utilized in attacks spanning at least 19 countries, including key markets such as the United States, United Kingdom, and Australia. Investigations indicated that the attackers operated from within the U.S., frequently near targeted locations, successfully evading detection by NSA and Department of Homeland Security defenses. This event highlighted FireEye's crucial role in detecting advanced persistent threats and underscored its leadership in cybersecurity intelligence and incident response.

2022

A report published by Trellix in 2022 emphasized that hacking groups Wicked Panda (affiliated with China) and Cozy Bear (linked to Russia) were responsible for 46% of state-sponsored cyberattacks during Q3 2021, with approximately one-third of these intrusions leveraging Cobalt Strike tools for network infiltration. Trellix CEO Bryan Palma remarked on the intensifying cyberwarfare threats emanating from Russia and China in early 2022.

Another study by Trellix revealed that threat actors employed Microsoft OneDrive within a complex espionage operation targeting government officials in Western Asia. The malware, named Graphite, exploited Microsoft Graph APIs to utilize OneDrive as a command-and-control infrastructure, facilitating extended covert activities.

Acquisitions

Announcement date	Company	Sector	Transaction value
December 30, 2013	Mandiant	Information security services	$1 billion
May 8, 2014	nPulse Technologies	Information security solutions	$60 million
January 2016	iSight Partners	Cyber threat intelligence services	$275 million
February 2016	Invotas	Security orchestration platforms
October 2017	The Email Laundry	Email protection services
January 2018	X15 Software	Machine and log data management tools	$20 million (combination of equity and cash)
May 2019	Verodin, Inc.	Security instrumentation technology	Approximately $250 million (cash and stock)
January 2020	Cloudvisory	Cloud security solutions	$13.2 million (cash)
November 2020	Respond Software	Decision automation platforms	Around $186 million (cash and stock)

Through these targeted acquisitions, the company has broadened its product offerings and strengthened its presence in various cybersecurity domains, solidifying its competitive position within the global market.