Rising Star Constella Intelligence

Fraud Reduction Intelligence Platforms (FRIP) address fraud through six core capabilities: identity verification, compromised credential intelligence, device intelligence, user behavioral analysis, behavioral biometrics, and bot detection/management. A key goal is reducing account takeover (ATO), account opening (AO) fraud, and other identity fraud by evaluating whether credentials or identity attributes have been exposed in breaches or linked to malicious activity. FRIP and Identity Threat Detection and Response (ITDR) tools often rely primarily on in-network data from their own customer ecosystems, while broader sharing and use of external credential intelligence remains limited. When compromised credentials can be evaluated at runtime, organizations can apply targeted controls—step-up authentication, forced password resets, or transaction denial—to reduce fraud while minimizing user friction.

Constella, founded in 2010 and headquartered in San Jose with a large presence in Spain, focuses on dark/deep web threat intelligence centered on compromised credentials and exposed personally identifiable information (PII). It has built a large searchable data lake sourced from breaches, hacking forums, infostealer malware outputs, and surface web sources, containing billions of user IDs and related attributes, including items beyond usernames and passwords such as Social Security numbers, national IDs, and credit card data. Constella differentiates through automated ingestion, normalization, enrichment, and de-duplication, using machine learning to identify data formats, verify legitimacy, and reduce false positives, complemented by manual review where accuracy is critical. Its Identity Risk Posture capability correlates exposed identity elements to infer cross-platform risk, highlights new or unique exposures, and supports detection of malicious or synthetic identities. Delivery includes APIs plus a SaaS investigative interface (“Hunter”) for searching and threat hunting across emails, domains, IPs, and other PII, positioning Constella as a specialized intelligence supplier to FRIP and ITDR ecosystems, with challenges around privacy compliance, evolving adversary techniques, and demonstrating value beyond open-source data.

• Constella was founded in 2010.
• Constella is headquartered in San Jose, California.
• Constella has a large presence in Spain.
• Constella operates with a Series D funding status.
• Constella’s licensing model is subscription-based, tied to number of seats and usage.
• Constella’s geographic focus includes the EU and South America.
• FRIP platforms include six major components: identity verification, compromised credential intelligence, device intelligence, user behavioral analysis, behavioral biometrics, and bot detection/management.
• Constella maintains a searchable data lake containing billions of user IDs and related information.
• Constella provides API access to query breach and infostealer data, identity risk scores, and threat intelligence.
• Constella provides a graphical SaaS interface called Hunter for searching emails, domains, IP addresses, and other PII attributes.

• “Runtime evaluation of compromised credentials enables organizations to enforce security measures such as step-up authentication, forced credential resets, or transaction denial, thereby reducing fraud incidents while minimizing user friction.”
• “Constella specializes in dark and deep web threat intelligence gathering and analysis, looking for compromised credentials, emails, and personally identifiable information (PII).”
• “They determine the veracity of attackers’ claims whether the purported leaked PII is real or not and notify customers accordingly.”
• “Constella’s most innovative functions are its automation processes, which include the ingestion, normalization, and enrichment of data.”
• “In instances where accuracy is of utmost importance, Constella employs a hybrid approach involving both automated and manual reviews to ensure data integrity, to reduce false positives.”
• “Constella has developed an identity risk posture feature that examines their vast data lake to identify potential fraud and account takeover (ATO) threats.”
• “Constella's system is capable of deduplicating old breach data, focusing on new or unique occurrences, thus refining its alerts to only pertinent and current identity threats.”
• “Many FRIP and ITDR solutions do not search and analyze threat information on the dark and deep webs, which leaves gaps in coverage.”
• “Constella can serve as a key information provider in the threat intelligence supply chain.”
• “There is an astonishing amount of personal information on the dark and deep webs that can be used by attackers for fraud.”