Who owns Malwarebytes? Ownership structure explained (2026)

Malwarebytes is one of the best-known names in consumer cybersecurity, the free scanner millions of people reach for when a PC starts behaving strangely. Behind that familiar brand sits an unusual ownership story for a company its size: it is still private, still run by its founder, and has deliberately avoided the venture-heavy path most security firms take toward an IPO or a private-equity buyout.

That independence shapes almost everything about how Malwarebytes is governed. Instead of a crowded cap table and a board stacked with growth investors, the company has raised money sparingly and kept control close to the founder. Understanding who owns it means looking at a short list of investors, a founder who has resisted selling, and a 2023 reorganization that split the business into two brands under one corporate roof.

This article breaks down who holds equity in Malwarebytes, how much it has raised, who sits in control, and why that structure matters for a company competing against far larger and better-capitalized rivals.

Malwarebytes was founded in 2008 by Marcin Kleczynski and Bruce Harrison. Kleczynski built the first version of the software as a teenager after his own computer was infected, and the free anti-malware scanner that grew out of that project became the company's calling card. The business is headquartered in Santa Clara, California, with an EMEA office in Cork, Ireland.

The company sells cybersecurity software across two audiences. The consumer brand, Malwarebytes, covers anti-malware protection, identity and privacy tools, and a VPN. The business-facing brand, ThreatDown, sells endpoint detection and response, managed detection, and related tools to companies, IT teams, and managed service providers. Malwarebytes has expanded its privacy lineup through acquisitions, buying the privacy firm Cyrus in 2023 and the Sweden-based provider AzireVPN in 2024.

Malwarebytes does not publish audited financials, and it is private, so revenue figures are not officially confirmed. What is documented is scale on the consumer side: the company said its software had cleaned malware from hundreds of millions of computers, and it reported annualized billings above $100 million as early as 2016. Comparable privately held security firms show the same pattern of a large user base paired with limited public financial disclosure, as the breakdown of Bitdefender's private ownership illustrates.

Malwarebytes is a privately held company. It has never completed an initial public offering, and it is not a subsidiary of any larger corporation. Ownership is concentrated among the founder and early employees, a small group of institutional investors, and management. This stands in sharp contrast to publicly traded security peers, where shares trade daily and control is spread across institutional funds, as with CrowdStrike's public-market ownership.

Marcin Kleczynski is both the co-founder and the largest individual force in the company's ownership. Because Malwarebytes has taken only minority investments and never sold a controlling stake, Kleczynski and the early team have retained majority control of the equity. The company has not disclosed his exact percentage ownership, and no filing pins down a precise figure, so his stake should be understood as controlling rather than quantified. Kleczynski has publicly favored keeping the company independent rather than pursuing an exit that would dilute founder control.

Malwarebytes raised very little outside capital for most of its history and has taken only three disclosed institutional rounds.

That brings total disclosed funding to roughly $180 million since 2008, a modest sum for a security company of its reach and reputation.

Highland Capital Partners provided the first major outside money, a $30 million round in 2014. It was the company's first institutional financing after years of bootstrapped growth, and it signaled that a product with a large free user base could be turned into a fundable business.

Fidelity Management and Research Company led the $50 million round announced in January 2016. That investment valued Malwarebytes at about $625 million, the only company valuation that has been publicly disclosed. Fidelity is best known as a mutual-fund giant, and its participation reflected the crossover investing that was common in late-stage private tech at the time.

Vector Capital made the most recent investment, a $100 million minority stake completed in 2022. Vector is a technology-focused private equity firm, and it took two of the five seats on the Malwarebytes board as part of the deal. Vector has described its role as helping separate the consumer and corporate business lines into distinct operating units, work that fed directly into the ThreatDown reorganization.

Vector Capital's investment was explicitly a minority one, not a buyout. It gave Vector board representation and influence, but not control. The founder and early team continue to hold the majority of the equity, and Vector's two of five board seats leave the balance of governance with the company's own leadership. Some third-party sources cite later rounds or higher valuations for Malwarebytes, but those figures are not confirmed by the company or by primary reporting, so they are best treated with caution.

Marcin Kleczynski is the CEO and the central figure in the company's control. As co-founder and majority-aligned shareholder, he holds both the executive role and the largest ownership position, an unusual concentration of authority for a company of this size and age.

Bruce Harrison co-founded the company with Kleczynski and led its research and engineering work in the early years. The broader executive team has turned over significantly since the 2023 reorganization: the company confirmed that its CIO, chief product officer, and chief technology officer departed around the 2023 restructuring, and it has since rebuilt parts of its leadership, including expanding its corporate go-to-market team for ThreatDown in late 2024.

The board has five seats, two of which are held by Vector Capital following its 2022 investment. The remaining seats sit with the company's own leadership and earlier backers. Beyond Vector's two seats and Kleczynski's role, the full board composition is not comprehensively disclosed, so specific director identities should be treated as inferred rather than confirmed.

Malwarebytes competes in one of the most saturated corners of software. Free antivirus tools, built-in operating system defenses like Microsoft Defender, and heavily marketed suites from larger vendors all pressure the same consumers. Much of the paid consumer security market has consolidated under private equity, which puts well-funded rivals against an independent Malwarebytes, a dynamic visible in McAfee's private-equity ownership. Mapping that competitive field is the kind of exercise a structured competitive analysis template is built for.

Malwarebytes cut staff in two consecutive years, roughly 125 employees in 2022 and about 100 in 2023, as it reorganized around two distinct business units. The company framed the cuts as part of separating its consumer and corporate operations rather than a response to distress, but back-to-back reductions drew scrutiny and reflected the pressure on a mid-sized independent competing against larger firms.

The acquisitions of Cyrus and AzireVPN pushed Malwarebytes deeper into privacy and VPN services, a market with its own competitive and trust dynamics. VPN providers face constant questions about logging, jurisdiction, and data handling, issues that shape how a privately held VPN is judged, as seen in the ownership profile of NordVPN's parent company. For Malwarebytes, moving into this space adds both a growth avenue and a new set of trust obligations to manage.

The most important fact about Malwarebytes' ownership is what it lacks: an IPO and a controlling private-equity owner. By taking only minority investments over more than a decade, the company kept its founder in control and avoided the pressure to chase quarterly numbers or a near-term sale. That has let Kleczynski steer the business on a longer timeline than many venture-backed peers can afford.

For investors, that same structure means limited access and limited disclosure. There is no public stock to buy, no regular earnings report, and only one disclosed valuation, now nearly a decade old. Anyone trying to gauge what the company is worth today is working from fragments rather than filings, which is why any current valuation should be modeled rather than quoted. A business valuation calculator is a reasonable starting point for that kind of estimate, though the inputs for a private company remain uncertain.

For customers, founder control tends to translate into continuity. The product roadmap and brand have stayed consistent, and the company's stated commitment to independence reduces the risk of the abrupt strategy changes that often follow an acquisition. The trade-off is scale: an independent Malwarebytes has less capital to deploy than rivals owned by large public companies or well-funded buyout firms.

Finally, the 2022 Vector Capital investment introduced a new dynamic. Vector's two board seats and its role in separating the business lines show that even a minority investor can shape strategy. The ThreatDown split, the sharpened focus on two customer segments, and the push into privacy all took shape after Vector arrived, a reminder that ownership influence is not only about who holds the most shares.

Malwarebytes is privately held and controlled by its founder and CEO, Marcin Kleczynski, together with early employees. Outside investors Highland Capital Partners, Fidelity, and Vector Capital hold minority stakes, with Vector holding two of the five board seats.

No. Malwarebytes has never held an IPO and is not listed on any stock exchange. It is a private company, and its shares are not available to public investors.

Marcin Kleczynski and Bruce Harrison founded the company in 2008. Kleczynski had built the first version of the anti-malware software as a teenager, and he remains CEO today.

The main institutional investors are Highland Capital Partners, which led a $30 million round in 2014; Fidelity, which led a $50 million round in 2016; and Vector Capital, which made a $100 million minority investment in 2022.

Malwarebytes has raised roughly $180 million across three disclosed rounds. The only publicly confirmed valuation is about $625 million from the 2016 Fidelity round. No current valuation has been disclosed, so newer or higher figures are estimates rather than confirmed numbers.

ThreatDown is the business-facing brand Malwarebytes launched in 2023 for its corporate, endpoint, and managed security products. It operates as a distinct business unit under the same corporate parent and the same CEO, alongside the consumer Malwarebytes brand, rather than as an independent company.