Common Defense says security service went live before formal launch

Common Defense made its formal public debut on 28 September 2026, according to TheStreet, with a cybersecurity business centred on detecting social engineering across workplace and personal communications. The vendor says its core service was already operating before the announcement.

A Common Defense update dated 11 September gives a more detailed chronology: the company says a closed beta began in April and the service went live in July. That makes September best understood as a formal public or company launch, rather than the first operational availability of the service. The reviewed material does not specify what changed at that point.

The distinction matters because Common Defense is promoting operating figures accumulated before its public debut. Those figures indicate claimed use of the service, but they do not independently establish how accurately it identifies threats or whether it prevents successful attacks.

What the Communications Firewall claims to cover

The company calls its central product the Communications Firewall. TheStreet and Common Defense describe it as a system intended to detect social engineering across communication channels, while the company also offers incident response services. Common Defense AI Security, Inc. is the corporate name displayed in the footer of its official website.

The company’s broad product description covers personal and work email, messaging applications, social platforms, professional networks, and voice and video calls. A September operating update is more specific, naming Telegram, email, WhatsApp, Slack and SMS as channels the service screens.

It is not clear from the reviewed pages whether the wider set of surfaces, particularly voice and video, is generally available, in limited deployment or part of a broader plan. The difference may reflect a separation between active connectors and the company’s intended product scope, but Common Defense does not label each listed channel as available, in beta or planned.

The Communications Firewall is presented alongside the company’s incident response services, but the available documentation does not provide detailed deployment terms for either. It also does not explain how automated detections move into an incident response process.

A staged approach to message analysis

Common Defense describes a detection process that moves communications through several stages. According to its homepage, those stages include identity checks, comparison with known scam signatures, analysis by a custom deep-learning model and an intent assessment using a large language model.

The company says about 3 per cent of messages reach the LLM stage. This describes a filtering funnel in which earlier checks handle most traffic before a smaller subset reaches the intent gate. The public material does not, however, provide an independent assessment of the system or enough methodology to determine how each stage performs.

Claims attributed to Common Defense about high precision, low latency and strong privacy protections are not supported in the reviewed material by published benchmarks, error rates or an external audit. The absence of public testing does not show that the service is ineffective, but it limits what can be concluded from the launch information.

Large totals, limited definitions

In an update dated 11 September, Common Defense reported that it had screened 2,226,173 messages and flagged 48,900 as threats. It also gave a scanning rate of about 32,000 messages per day.

On 29 September, the company’s homepage displayed dynamic totals of 2,830,047 messages screened and 55,630 threats caught. The rise is consistent with the vendor’s claim that the service was operating before the formal launch, although the counter does not publish an independently verifiable methodology or timestamp.

More importantly, the company does not define the difference between a message flagged as a threat and a threat caught. Its public pages do not establish whether those messages were blocked, quarantined, sent for review or subsequently confirmed as malicious. Nor do they say whether the totals include repeated, simulated or automatically classified messages.

Message volume therefore demonstrates scale only at the level claimed by the vendor. It cannot, by itself, establish detection accuracy, prevented losses or successful containment. The reviewed launch report and product pages provide no independent benchmark, false-positive or false-negative rates, named customer case study or external audit substantiating the product’s performance and privacy claims.

Privacy and deployment questions remain

A service intended to screen both personal and workplace communications raises practical questions about permissions, data handling and organisational governance. This is not evidence of a privacy failure. It does mean prospective customers need to understand what content the service can access and how that access is controlled.

The reviewed pages do not explain the required account permissions, message retention periods, data locations, subprocessors or whether customer communications are used to train models. They also do not set out detailed data flows for the named messaging services or the broader voice, video and social-network coverage.

The product’s corporate lineage is another unresolved area. TheStreet reported, based on launch material, that Common Defense was built by Quantstamp. The reviewed evidence does not include corporate records or a clear description of ownership and organisational structure. Public materials also use differing figures for Quantstamp’s record and the experience of the Common Defense team, with scopes and counting methods that cannot be reconciled from the available information.

The reviewed sources also do not establish Australian customers, local data hosting, pricing, support or regulatory arrangements.

For organisations assessing the launch, the key distinction is between documented product positioning and demonstrated results. Common Defense has described its channel coverage, detection stages and substantial screening totals. A fuller evaluation would still require a definitive list of live integrations, clear definitions for threat classifications, details of account access and data handling, and independent evidence about detection performance.

A communication screening total invites a basic question: what conclusions do the underlying classifications and supporting evidence justify? Take that enquiry further through The Hack Academy’s online cybersecurity training programme; study is self-paced, cybersecurity fundamentals and networking are listed subjects, and practical exercises sit alongside theory.