RedShield

RedShield is a managed web application and API security service founded in 2008 in Wellington, New Zealand. Rather than selling a self-service WAF that customers configure and tune themselves, RedShield operates the shielding layer for its clients: traffic is routed through RedShield’s AWS-hosted platform, where its security engineers apply targeted “in-flight” virtual patches for specific known vulnerabilities, layered alongside standard WAF and DDoS/bot protections.

The pitch to CISOs is that it closes the gap between a vulnerability scan finding a flaw and a development team actually fixing the underlying code, which in many organizations can take weeks or months. RedShield’s managed engineers write and deploy a patch at the traffic layer in the meantime, then work with the customer’s own developers toward a permanent fix. The company has built out a channel business through partners including Kordia (New Zealand/Australia) and AT&T Cybersecurity, which added RedShield’s shielding service to its own Managed Vulnerability Program in 2021, and serves government, healthcare and finance customers in New Zealand, Australia, the UK and the US.

RedShield has grown steadily and largely outside the venture-funded hype cycle common elsewhere in AppSec: no major VC round is publicly disclosed, and its scale (reported at roughly a 50-person team with a few million dollars in annual revenue as of 2025) is modest next to venture-backed WAF and CNAPP vendors. Its differentiator is the managed, hands-on patch-deployment model rather than a novel detection technology.