The product looks real; the recruiter’s “8‑figure ARR” is bigger than what Petra itself says in writing
Asked (summary):
“Is she lying? Is it truly a good product?” — evaluating a recruiting pitch that Petra Security (YC W24) went from 6 to 8 figures of ARR in under a year with four AEs, wins over 90% of head-to-head competitive deals, has 25–45 day sales cycles, and catches account compromises large vendors miss.
76 public observations about Petra Security, gathered October 2026: 16 firsthand or user-review accounts (Reddit MSPs, a Capterra verified reviewer, two hands-on MSP blogs), 52 first-party claims from Petra’s site, docs, case studies and job postings, and 8 competitor comparison claims from Huntress and Blackpoint. Most business metrics are single-sourced vendor assertions; the matrix below sorts every key claim by how well it is backed.
Evidence matrix: where each claim sits, from corroborated to inconsistent
stronger evidenceweaker or conflictingclick a claim for detail and its source
Claim detail
Click any claim above
Each card explains what the evidence shows and links the page it came from.
What the matrix cannot say alone
Petra’s own live job postings — including for Account Executives — say “mid-7-figures in ARR in a year” with a goal of $30M+ in the next 12 months; that is one order of magnitude below the recruiter’s “8 figures”. jobs.ashbyhq.com
Petra’s site claims 2.5M+ identities and 10,000+ businesses, but a Petra employee on Reddit said “nearly 2 million identities” as of May 2026, and older marketing pages still say 1.7M+ — the headline numbers move. reddit.com
The “100% zero false positives” marketing line is contradicted by Petra’s own case studies, which count 2 false alarms at CyberStreams and 1 at ElasticIT — honest numbers, dishonest absolute. cyberengage.org
The strongest independent signal is Brivy IT’s hands-on review: agentless two-click install, 20–30 behavioral signals per user, 12 months of telemetry, SOC 2 Type II — consistent with what Reddit MSPs and a Capterra verified reviewer report. brivyit.com
Strengths and limits of the product itself
Reported strengths
Finds live and historical BEC compromises other tools missed — including a 5-month-old compromise found during onboarding, and catches ahead of Huntress ITDR, Blackpoint, SaaS Alerts and Sophos MDR in vendor case studies.
Fast in practice: users report credential theft detected within 1–2 minutes; case studies cite mean time-to-contain of 1:41.
Low noise and strong forensics: exportable incident reports showing exactly what an attacker read, changed or sent; email search with hard-delete.
Cheap to adopt: agentless OAuth install in minutes, works on basic M365 licenses without P2, deployable across tenants via Partner Center.
Acknowledged limits
Microsoft 365 only — no Google Workspace, no endpoint agent or EDR, no SIEM, no vulnerability management (per Huntress, Blackpoint, and Petra’s own docs).
Depends entirely on Microsoft audit logs; no retroactive visibility for periods when auditing was off, and backfill takes up to 72 hours.
Endpoint compromises are caught only “by accident”, in Petra’s own words, when downstream M365 behavior looks suspicious.
Small team, automated SOC with limited human analysts and no published MTTR, per competitor pages — biased sources, but Petra does not dispute the scope.
Before signing: what to ask the recruiter for
All 76 source observations
Type
Claim
Who says it
Date
Source
Method: 76 public observations about Petra Security collected October 2026 — 16 firsthand/user reviews, 52 first-party company claims, 8 competitor comparison claims — each row one claim with its source page. The matrix is an editorial grading of 12 recruiting and product claims into four evidence tiers; claims and relationships are shortened for space. Vendor case-study numbers (win counts, precision, containment times) are company-published and not independently audited. Competitor claims come from Huntress and Blackpoint sales pages and are biased by design.