HarfangLab

What Is HarfangLab?

HarfangLab is a French endpoint detection and response (EDR) vendor whose agent is certified by two national security agencies, one in Paris and one in Bonn. That is the claim the company leads with, and it holds up. The agent received an ANSSI CSPN certification in 2020, renewed and extended in 2024 to cover both agent and manager. Germany's BSI added a BSZ certification, announced on 7 January 2026.

The company was founded in 2018 by Grégoire Germain, Xavier Boreau, Mathieu Gaspard, and Maxime Rameau. Its legal entity, HARFANGLAB SAS, has its registered seat in Puteaux according to the company register. On its about page, the vendor gives its headquarters as 5 rue Feydeau in Paris. The same page says headcount passed 100 in 2024, with more than 60% of staff working on research and development.

HarfangLab's about page lists a €5 million seed in 2021 and a €25 million round in 2023. Elaia led the seed. The company's press release describes the second deal, announced on 9 October 2023, as a €25 million Series A (company figure) led by Crédit Mutuel Innovation, with MassMutual Ventures and Elaia. A newer round is in progress, which we cover in the compliance section.

HarfangLab is a narrower product than its French rival TEHTRIS. It does not bundle a SIEM, SOAR engine, or honeypots. The endpoint layer is the product, and the rest of your SOC connects through open interfaces. On the endpoint, the rivals are CrowdStrike and SentinelOne, and HarfangLab pairs naturally with a European SIEM such as Sekoia.

Key Features

What Does the HarfangLab EDR Detect With?

The EDR layers several engines. YARA handles signature matching, Sigma covers behavioural rules, and an IOC engine matches known indicators. Ransomguard targets ransomware behaviour, and Sidewatch looks for DLL side-loading. Ashley, the company's machine-learning engine, aims to catch unknown threats early in the execution of a malicious script.

The open formats matter for practical reasons. A Sigma or YARA rule written for HarfangLab is readable, reviewable, and portable, so detection engineering does not disappear into a black box. Analysts get a correlation engine that merges related events into a single alert, which reduces the alert noise that wears down small teams.

Response actions include process blocking, endpoint isolation, and file and service deletion. A remote shell lets analysts run investigation commands on a machine without leaving the console. Kio, a natural-language assistant, lets them query telemetry in plain language.

Where Can You Run It?

Deployment is the most distinctive part of the product. The console runs in the cloud, on-premises, or in a SecNumCloud environment, and the vendor says features are identical across all three. HarfangLab has not, in the pages we reviewed, named the SecNumCloud hosting provider, so ask during procurement.

On-premises matters for isolated networks, defence suppliers, and hospitals that cannot route endpoint telemetry to a third-party cloud. HarfangLab's own marketing singles out this flexibility, and customers quoted on its homepage mention easy on-premises deployment.

The agent is lightweight by the vendor's account, at roughly 250 MB of RAM and 1% CPU, and updates without a reboot. Treat those numbers as vendor claims; we did not measure them. The documented operating systems are Windows, Linux, and macOS.

What Else Is in the Platform?

HarfangLab has widened beyond EDR. Its plans page lists endpoint protection (antivirus, firewall, device control), attack surface management with vulnerability and patch management, identity threat detection and response, and an email security module. These modules arrived in stages, with attack surface management in September 2025 and identity detection in September 2026.

A younger module is a less proven module. If identity threat detection or email security is your main requirement, test them against a specialist before treating the bundle as equivalent. The EDR is the mature core.

How Open Is the Ecosystem?

HarfangLab's connectors page names SIEM integrations for Splunk, IBM QRadar, Sekoia, and Thales, plus SOAR tools including Cortex XSOAR, TheHive, Shuffle, Mindflow, and Airbus Prophecy. Threat intelligence platforms include MISP and OpenCTI, and file analysis covers VirusTotal, CAPE, GLIMPS, and Airbus Orion. Network detection partners include Gatewatcher, Vectra, and Thales.

Authentication connects to Okta, Azure Active Directory, OpenID Connect, and LDAP. The list leans toward the European security ecosystem, which is a strength if you buy local and a limit if your stack is built around Microsoft or Palo Alto tooling.

HarfangLab and Sekoia are also integration partners. Events flow from HarfangLab into Sekoia through a syslog connector, and Sekoia playbooks can act on HarfangLab endpoints. For a fully French stack, that pairing covers endpoint and SIEM without a US vendor, though you still operate two products.

Pricing

HarfangLab does not publish prices. Its plans page says the cost of each plan depends on the number of endpoints, telemetry, the length of the plan, and associated services. Buyers are directed to sales, and the page shows no trial information.

The company sells modules individually and in bundles. Guard combines endpoint protection with EDR, and Harfang One is the all-in-one bundle. We cannot quote a per-endpoint figure, and we will not estimate one.

Quote-only pricing is standard for enterprise EDR, but it still costs you time. You cannot compare HarfangLab against a competitor on a spreadsheet before talking to a salesperson, and you cannot start a self-service trial. Telemetry-based pricing also means your bill can move with data volume, so ask how retention is counted before you sign.

We scored value for money at 6.5 without any public price to test it against. The case rests on certification and deployment flexibility rather than a low price. Gartner Peer Insights shows a 4.9 out of 5 rating for the product, which the vendor repeats on its homepage. At the time of our research the sample was small, at 32 ratings, so read it as a positive signal rather than proof.

EU Compliance & Privacy

HarfangLab is a French company under EU law, and its about page states that data is hosted entirely within the EU. We set the data-hosting flag on that basis. On-premises and SecNumCloud options let you keep telemetry on infrastructure you control.

The certification record is the product's main selling point. ANSSI's CSPN certification covers the agent and manager. The BSZ scheme follows the European standard EN 17640 and combines conformity tests with penetration testing, conducted by a BSI-approved evaluator, TÜV. Its scope covers the agent, development methods, update procedures, and cryptographic measures.

HarfangLab also announced an ANSSI qualification in January 2025 and calls itself the first and only qualified EDR. We could not verify the "only" independently, so treat it as a vendor claim. French trade coverage describes qualification as a higher bar than certification, because it examines the development environment and version management.

The company's press page adds an ISO 27001:2022 certification, listed as achieved on 14 September 2026. That page does not state the scope of the certificate or the body that issued it, so ask for the certificate itself during procurement.

Is a US Fund Buying Into HarfangLab?

Not yet, but the plan deserves a plain reading. On 26 May 2026, ChannelNews reported that the US fund PSG Equity was preparing to join a new round, and French trade press said the economy ministry was setting conditions. Reports said the majority of capital had to stay French, with Bpifrance and the founders involved.

HarfangLab confirmed a process was under way. Its statement said that whatever the final decisions, the majority of capital, research and development, the headquarters, and the management team would remain French. We found no announcement of a closing as of 5 October 2026, so this review reflects the company as an independent French firm and flags the open question.

For buyers whose procurement rules depend on ownership, check the cap table at contract time. Buyers who weigh jurisdiction and certification can note that the French headquarters and the agency approvals are unchanged by the reported plan. We have not speculated on amounts or stakes because none have been confirmed.

Who It's Best For

French and German public bodies, hospitals, and defence suppliers with certification requirements. If procurement asks for ANSSI or BSI evidence, HarfangLab can point to both, and the company says it was the first EDR to earn each.

Organisations with air-gapped or restricted networks. If telemetry cannot leave your perimeter, the on-premises and SecNumCloud options make HarfangLab one of the few serious EDR choices.

Teams that already own a SIEM and SOAR. If you run Splunk, QRadar, or Sekoia, HarfangLab adds endpoint depth without duplicating your SOC stack. If you want one console covering SIEM, SOAR, honeypots, and mobile fleets, choose TEHTRIS instead.

Not the best fit for buyers who need a published price, a free trial, or mobile threat defence, and not for teams seeking the largest global threat-intelligence network. For that scale, CrowdStrike and SentinelOne remain the benchmark.

The Verdict

At 7.7 out of 10, HarfangLab is a focused EDR whose certification record is real. Few EDR vendors can show national certifications in two countries, and its on-premises and SecNumCloud options suit isolated networks that cloud-first rivals serve less naturally. The product is open and well matched to regulated European buyers. Ease of use scores 7.5 because nothing can be tried before purchase, and value is scored without public pricing. Real trade-offs remain: no public pricing, no native SIEM or SOAR, no documented mobile coverage, a customer base that appears concentrated in France, and an unresolved funding round with a US investor. Choose it when certification and control outweigh breadth and price transparency.

Frequently Asked Questions

Is HarfangLab a European EDR with EU data hosting?

Yes. HarfangLab SAS is a French company founded in 2018, and its about page states that data is hosted entirely within the EU. The console can also run on-premises or in a SecNumCloud environment, so data can stay on your own infrastructure.

Which certifications does HarfangLab hold?

Its EDR agent holds an ANSSI CSPN certification (2020, extended to agent and manager in 2024) and a German BSI BSZ certification announced in January 2026. The company's press page also lists ISO 27001:2022 certification, achieved on 14 September 2026, without stating its scope. HarfangLab also says it is the first and only EDR qualified by ANSSI, a vendor claim we could not check independently.

How does HarfangLab compare with TEHTRIS and CrowdStrike?

An endpoint-first platform, HarfangLab plugs into your own SIEM and SOAR, while TEHTRIS bundles SIEM, SOAR, honeypots and mobile defence in one console. CrowdStrike and SentinelOne offer far larger global telemetry and ecosystems, but neither is EU-owned.

Is a US fund investing in HarfangLab?

French trade press reported in May 2026 that a US fund, named by ChannelNews as PSG Equity, was preparing to join a new funding round, with the French economy ministry setting conditions. HarfangLab confirmed a process and said most capital, R&D, headquarters and management will remain French. We found no closing announcement as of 5 October 2026.

How much does HarfangLab cost?

HarfangLab does not publish prices. Its plans page says cost depends on the number of endpoints, telemetry, plan length and associated services, and directs buyers to sales. It lists bundles named Guard (EPP plus EDR) and Harfang One, with no public price list or self-service trial.