Ghost Shift
Provides cyber intelligence operations and ethical strategic influence to help organizations in contested information environments.
Website: https://www.ghost-shift.com/
Cover Block
Open sources
| Field | Value |
|---|---|
| Name | Ghost Shift |
| Tagline | Provides cyber intelligence operations and ethical strategic influence to help organizations in contested information environments [LinkedIn] |
| Headquarters | Manchester, UK [LinkedIn] |
| Founded | 2025 [Crunchbase] |
| Stage | Pre-Seed [BusinessCloud, October 2026] |
| Business Model | B2B |
| Industry | Defense / Govtech |
| Technology | Software (Non-AI) |
| Geography | Western Europe |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding Label | Pre-seed |
| Total Disclosed | £465,000 [BusinessCloud, October 2026] |
Links
Open sources
- Website: https://www.ghost-shift.com/
- LinkedIn: https://www.linkedin.com/company/ghost-shift
- F6S: https://www.f6s.com/company/ghost-shift
- Product page: https://ghostshift.io/
What an Investor Needs First
PUBLIC Ghost Shift is building a cyber-intelligence and influence-services company for governments, defense organizations, and industry customers operating in contested information environments, and it merits attention now because it has moved from concept to funded formation with a small but clearly attributed pre-seed round and a positioning that sits between cybersecurity, intelligence, and strategic online operations [BusinessCloud, October 2026] [LinkedIn] [Millilux, August 2026]. Founded in 2025 and based in Manchester, the company presents itself as a specialist in online intelligence gathering, ethical strategic influence, and capacity-building consultancy rather than a conventional off-the-shelf software vendor, which is a meaningful distinction for investors assessing sales motion and scalability [LinkedIn] [F6S] [Ghost Shift].
The public record suggests the initial wedge is expertise-led delivery: Ghost Shift says it helps organizations design cyber capability, conduct online operations, and strengthen resilience against information threats, while also describing work in intelligence collection, influence campaigns, and disinformation detection [F6S] [Ghost Shift] [LinkedIn]. That mix could create early demand in defense and public-sector settings where buyers value operator experience, but it also means the differentiation currently rests more on domain credibility and mission fit than on a widely evidenced product footprint.
On team, the clearest named executive is co-founder and CEO Tom Sefton-Collins, whose public profile says he spent more than a decade delivering security and intelligence operations in the public sector and 15 years across UK government departments, mainly in law enforcement and the intelligence community [LinkedIn] [Millilux, August 2026].
Funding is the strongest externally verified signal so far. BusinessCloud reported in October 2026 that Ghost Shift raised a £250,000 pre-seed round backed by Manchester Angels, Cambridge Angels, Ante-Bellum Angels, and Halceon, and that the financing unlocked £215,000 in matched UK Research and Innovation support, for £465,000 in total disclosed capital; the business model is described in public materials as B2B consultancy and capability-building for institutional customers [BusinessCloud, October 2026] [F6S].
Over the next 12 to 18 months, the key question is whether Ghost Shift can convert a services-heavy entry point into repeatable productized delivery, referenceable customer adoption, and a clearer proof of procurement within government, defense, or adjacent enterprise accounts [F6S] [Millilux, August 2026]. Public evidence of customer names, deployments, and hiring remains thin, so the near-term underwriting case depends less on current scale and more on whether this early funding translates into credible execution milestones and a more legible go-to-market narrative [LinkedIn] [BusinessCloud, October 2026].
Claim stands unchecked -- This section relies on one independent funding report from BusinessCloud, partial corroboration from LinkedIn and Millilux on team and positioning, and several company-controlled sources for product claims.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Pre-Seed |
| Business Model | B2B |
| Industry / Vertical | Defense / Govtech |
| Technology Type | Software (Non-AI) |
| Geography | Western Europe |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding | Pre-seed, total disclosed £465,000 [BusinessCloud, October 2026] |
Inside the Company
PUBLIC
Ghost Shift presents as a very early UK defense and cybersecurity startup built around online intelligence and influence work rather than a conventional security software SKU. Public company materials describe the business as helping organizations "infiltrate and influence" online adversaries and strengthen cyber capability through online operations and targeted influence strategies [Ghost Shift]. Crunchbase lists Ghost Shift Ltd as founded in 2025 and based in Manchester, UK, which matches the location shown on the company’s LinkedIn profile, though LinkedIn is not relied on here for this section [Crunchbase].
The public chronology is still short, but it is at least coherent. The company appears to have been founded in 2025 [Crunchbase]. By 2026, its website described services spanning intelligence collection, online operations, and influence campaigns [Ghost Shift]. Crunchbase also identifies the company as Ghost Shift Ltd, giving investors at least a basic legal-entity reference point in the absence of fuller public filings within the materials reviewed [Crunchbase].
The first clearly documented external milestone is financing announced in October 2026. BusinessCloud reported a £250,000 pre-seed round led by Manchester Angels, with participation from Cambridge Angels, Ante-Bellum Angels, and Halceon, alongside £215,000 in matched UK Research and Innovation funding, or £465,000 total capital unlocked [BusinessCloud, October 2026]. That matters less as a scale marker than as evidence that the company had moved beyond concept stage into a funded buildout, but the public record remains thin on customer adoption, contracts, and operating history.
Partially corroborated -- Founded year and company profile are supported by Crunchbase and the company website, but key milestone detail in this section relies materially on one named publisher report from BusinessCloud.
Under the Hood
Reported and inferred
Ghost Shift is presenting less as a conventional security software vendor and more as an operator-led cyber capability partner. Its public materials describe "cyber intelligence operations and ethical strategic influence online," alongside specialties in threat intelligence, offensive cyber-capacity building, intelligence, data manipulation, and disinformation detection [LinkedIn]. On its website, the company says it helps organizations "infiltrate and influence" online adversaries, gathers intelligence from online sources, and conducts influence campaigns intended to strengthen client resilience in contested information environments [Ghost Shift].
The evidence points to a services-first offer with some technology development around the edges, rather than a fully specified product suite. F6S describes the company as providing capacity-building consultancy to help organizations design the cyber capability they need [F6S]. BusinessCloud reported in October 2026 that the pre-seed financing would support technology development and research into applying AI models to "inverse learning," but the company has not publicly detailed a shipped product architecture, a deployable software platform, or a verified demo that would clarify how much of the offer is software versus consulting delivery [BusinessCloud, October 2026]. A separate Ghost Shift site also advertises "AI Enablement," framed as training teams and installing AI with measured before-and-after results, though that claim remains company-authored and is not independently corroborated [Ghost Shift, retrieved 2026].
Claim stands unchecked -- Product descriptions in this section rely primarily on company-owned materials and profile pages, with limited independent reporting from BusinessCloud on technology development plans.
Market Research
PUBLIC
The market matters now because organizations are spending more on cyber defense while also confronting a less familiar problem: coordinated online influence, disinformation, and intelligence operations are becoming operational risks rather than peripheral communications issues [BusinessCloud, October 2026] [Millilux, August 2026].
Public evidence on Ghost Shift's exact addressable market is thin, so the cleanest way to frame demand is through adjacent markets that are well covered by third-party research. On one side sits enterprise and government cybersecurity spending. On the other sits a smaller, less standardized category around threat intelligence, disinformation monitoring, and strategic influence support. Ghost Shift's own positioning, as described by the company and in publisher-hosted coverage, sits at that intersection rather than in a conventional endpoint or network security budget line [LinkedIn] [Ghost Shift] [Millilux, August 2026].
That creates a market-mapping problem as much as a market-size question. Buyers that need online intelligence gathering or influence resilience may fund it through cyber, defense, public safety, national security, corporate security, or external affairs budgets, depending on the institution. For an early company, that can expand the theoretical opportunity, but it can also slow procurement because the pain is cross-functional and the budget owner is not always obvious [Millilux, August 2026].
The available public research in this dataset does not provide a named third-party TAM, SAM, or SOM estimate for Ghost Shift's exact category. A narrower reading is more defensible: the company appears exposed to spending pools associated with cyber intelligence, threat intelligence, and public-sector information operations, with governments, defense organizations, and industry referenced as intended counterparties in public materials [F6S] [Millilux, August 2026].
| Market lens | What public sources support | Caveat |
|---|---|---|
| Core adjacent market | Cybersecurity and cyber intelligence services demand [BusinessCloud, October 2026] [LinkedIn] | No third-party market size figure in source set |
| Functional extension | Threat intelligence and disinformation detection [LinkedIn] [Ghost Shift] | Product scope is company-described |
| Likely public-sector budget overlap | Government and defense information operations capability [Millilux, August 2026] | No named department budgets or contracts cited |
| Substitute procurement path | Consultancy-led cyber capacity building [F6S] | Services budgets can be episodic and less scalable than software budgets |
The table points to a market that is legible in use case terms but not yet well bounded in public data. For investors, that usually means the near-term question is not category size in the abstract, but whether the company can attach itself to recurring budgets with a repeatable buying motion.
Demand drivers are easier to identify than market size. The first is the broad elevation of information integrity and online adversary activity into security issues rather than purely media or policy issues. The second is institutional demand for cyber capability building, which Ghost Shift explicitly references through consultancy and operational support language [F6S] [Ghost Shift]. The third is the UK public innovation funding backdrop, visible here through UK Research and Innovation's matched funding, which suggests at least some policy support for experimentation in adjacent national-security technology areas [BusinessCloud, October 2026].
There is also a macro tailwind in the convergence of cyber operations and information operations. Ghost Shift's language around intelligence collection, influence campaigns, and resilience implies a buyer concern that standard security tooling does not fully address [Ghost Shift] [LinkedIn]. That concern is real in strategic terms, but the public record here does not yet show whether it resolves into a productized budget category or remains largely project-based.
Adjacent and substitute markets matter because they shape both competition and pricing power. The closest substitutes may not be direct startups doing the same thing, but incumbent cyber consultancies, government contractors, threat intelligence vendors, and internal public-sector teams. If buyers can solve the problem through a broader security retainer or existing defense supplier, Ghost Shift's challenge becomes proving that a specialized online operations capability is distinct enough to warrant separate spend [F6S] [Millilux, August 2026].
Regulatory and macro forces cut both ways. Heightened concern around disinformation, foreign interference, and national cyber resilience can support procurement urgency, especially for public-sector and defense-linked buyers [Millilux, August 2026]. At the same time, any company operating near intelligence collection and ethical influence will face scrutiny around procurement ethics, oversight, and acceptable use, particularly if it expands beyond advisory work into technology-enabled operations. The public materials point to "ethical strategic influence," but the market will still depend on how clearly the company can define scope, controls, and lawful deployment in front of institutional buyers [LinkedIn] [Ghost Shift].
Partially corroborated -- Market framing is supported by company materials, LinkedIn, F6S, BusinessCloud, and Millilux, but no independent third-party market sizing figures were available in the source set.
Competition and Substitutes
MIXED Ghost Shift is not competing head-on with mainstream security software on features or scale; the public record points instead to a narrower position at the intersection of cyber operations, intelligence collection, and ethical influence work for government, defense, and adjacent institutional buyers [LinkedIn] [F6S] [Millilux, August 2026].
| Company | Positioning | Stage / Funding | Notable Differentiator | Source |
|---|---|---|---|---|
| Ghost Shift | Cyber intelligence operations, online intelligence gathering, influence campaigns, and capability-building consultancy for contested information environments | Pre-seed, £465,000 total capital unlocked in October 2026 | Positioning blends operational cyber and information influence work rather than a conventional security product stack | [BusinessCloud, October 2026] [Ghost Shift] [LinkedIn] [F6S] |
| Palo Alto Networks | Broad enterprise cybersecurity platform vendor | Public company | Large installed base across network, cloud, and security operations | [CB Insights] |
| CertiK | Security-focused platform best known for blockchain and smart contract auditing | Venture-backed | Deep specialization in blockchain security assurance | [CB Insights] |
| Optiv Security | Cybersecurity services and solutions provider | Private company | Enterprise services reach and procurement familiarity for large buyers | [CB Insights] |
| Patchstack | Application and web vulnerability security specialist | Venture-backed | Focused positioning around website and application-layer risk | [CB Insights] |
The comparison table is directionally useful, but it also shows the limits of standard peer sets. Palo Alto Networks and Optiv represent incumbent buyers' default options when a procurement process is framed as enterprise security, not influence operations or online infiltration work [CB Insights]. CertiK and Patchstack sit even further away from Ghost Shift's apparent center of gravity, because their public positioning is tied to narrower technical domains rather than the blended intelligence-and-operations offer Ghost Shift describes on its own channels [CB Insights] [Ghost Shift] [LinkedIn].
That leaves three competitive buckets. First are incumbents such as Palo Alto Networks and Optiv, which can absorb budget because they already sit inside security, consulting, and managed-service line items [CB Insights]. Third are adjacent substitutes: internal government teams, defense primes, and traditional intelligence or strategic-communications consultancies. Public evidence suggests those substitutes may be more relevant than software peers, because Ghost Shift's stated offer emphasizes capacity building and operations support as much as technology [F6S] [Millilux, August 2026].
Ghost Shift's clearest edge today appears to be talent and buyer fluency rather than distribution or capital. Tom Sefton-Collins' public profile says he spent more than a decade delivering security and intelligence operations in the public sector and worked for 15 years across UK government departments, mainly in law enforcement and the intelligence community [LinkedIn] [Millilux, August 2026]. In a category where trust, mission familiarity, and the ability to translate sensitive operational needs into a scoped engagement matter, that background can be meaningful. The durability is less certain. Talent-led advantage tends to persist if it converts into referenceable programs, repeat procurement paths, or proprietary operating data, but the public record does not yet show named customers, deployments, or a software footprint that would compound independently of the founding team [Millilux, August 2026] [LinkedIn].
The exposure is easier to see. If a buyer's problem is framed as enterprise cyber defense, Palo Alto Networks and Optiv have stronger procurement muscle, broader product coverage, and more established credibility with large organizations [CB Insights]. If the problem is framed as narrow application or blockchain security, specialists such as Patchstack or CertiK benefit from category clarity that Ghost Shift does not claim [CB Insights]. Ghost Shift is also exposed to a channel problem: consultancy-led offerings can open doors early, but they are harder to scale than a product with obvious seat-based or usage-based expansion. The company says it offers technology development and has described AI-related work around "inverse learning," but the available public evidence does not yet establish a market-tested product layer that would shift the basis of competition away from services and founder-led delivery [BusinessCloud, October 2026].
The most plausible 18-month scenario is a bifurcation between trusted niche operators and scaled security incumbents. Winner if trust-sensitive government and defense buyers continue to prioritize specialized operational expertise over broad security suites: Ghost Shift, because its public positioning is tailored to contested information environments rather than generic cyber tooling [Millilux, August 2026] [Ghost Shift]. Loser if the category collapses back into standard enterprise-security purchasing criteria: Ghost Shift again, because incumbents such as Palo Alto Networks and service-led firms such as Optiv are structurally better placed when buying committees favor existing vendor relationships, broad compliance coverage, and balance-sheet comfort over a focused operational specialist [CB Insights].
Reasoned from indirect evidence -- This section uses confirmed public funding and founder-background sources, but several competitive comparisons rely on high-level third-party company profiles and category inference rather than fully corroborated like-for-like overlap [BusinessCloud, October 2026] [LinkedIn] [Millilux, August 2026] [CB Insights].
Opportunity
Open sources The prize here is not a conventional cybersecurity tool outcome, but the chance to become a trusted operator and software layer for governments, defence organisations, and critical-sector buyers that need to gather intelligence and shape online environments, not simply defend their networks [BusinessCloud, October 2026] [Millilux, August 2026] [Ghost Shift].
The most credible upside case is that Ghost Shift becomes a specialist platform for information operations and online intelligence in markets where procurement is slow, trust is scarce, and operational experience matters more than broad horizontal feature sets. That is reachable, in limited form, because the public record already shows a defined thesis, early external capital, and founder-market fit around public-sector security and intelligence work [BusinessCloud, October 2026] [LinkedIn] [Millilux, August 2026]. The company is still very early, and much of the product description remains company-stated, but the combination of Manchester Angels backing, matched UK Research and Innovation support, and a CEO whose public profile centers on UK government security and intelligence operations gives the opportunity a firmer base than a pure concept-stage consultancy claim would on its own [BusinessCloud, October 2026] [LinkedIn].
The paths to scale are narrower than in mainstream enterprise security, but they can still be meaningful if one wedge converts into repeatable procurement.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| UK public-sector specialist | Ghost Shift wins early UK government or adjacent defence work, then turns bespoke intelligence and influence engagements into a repeatable operating model for a small set of high-value customers | The October 2026 pre-seed and UKRI match fund hiring, technology development, and R&D tied to applied AI and "inverse learning," which could help package services into more repeatable workflows [BusinessCloud, October 2026] | The company already positions itself around governments, defence organisations, and contested information environments, and Sefton-Collins' public background is rooted in UK government security and intelligence operations [Millilux, August 2026] [LinkedIn] |
| Dual-use intelligence platform | The company starts as consultancy-led capacity building, then standardises pieces of collection, detection, and influence planning into software used by both public-sector and regulated commercial buyers | A product shift from services-heavy work to software-assisted delivery, building on Ghost Shift's public claims around online intelligence gathering, disinformation detection, and AI enablement [Ghost Shift] [LinkedIn] [Ghost Shift, retrieved 2026] | F6S describes the current offer as capacity-building consultancy, which often creates the raw material for a later software layer once repeated workflows emerge [F6S]. LinkedIn and the company site also describe a consistent operational domain rather than a one-off advisory niche [LinkedIn] [Ghost Shift] |
| Trusted mission partner in a small market | Ghost Shift remains focused and does not chase broad enterprise security, instead becoming a go-to niche supplier for sensitive online operations, training, and resilience programs | Continued support from angels with local networks and research-linked funding that can underwrite early productisation and credibility building [BusinessCloud, October 2026] | In defence and govtech, smaller vendors can build durable positions if they solve hard problems in a narrow mission set. Ghost Shift's public messaging is already specific about intelligence collection, influence campaigns, and organisational capability building [Ghost Shift] [F6S] |
The compounding mechanism, if it appears, would come from trust, workflow reuse, and proprietary operating knowledge rather than a consumer-style network effect. A first successful engagement with a government or defence-adjacent buyer can produce references, security clearances, process knowledge, and repeat playbooks that lower the cost of winning the next engagement. If Ghost Shift can convert that into software-assisted delivery, each project could improve internal tooling for intelligence collection, disinformation detection, and training, making delivery faster and margins better over time [Ghost Shift] [LinkedIn] [F6S]. The public evidence only hints at that flywheel today, chiefly through the company's repeated emphasis on online operations and capacity building across its website, LinkedIn presence, and F6S profile, plus the disclosed use of fresh capital for hiring and technology development [Ghost Shift] [LinkedIn] [F6S] [BusinessCloud, October 2026].
The size of the win depends on which identity prevails. If Ghost Shift stays primarily a boutique operator, the ceiling is likely that of a valuable niche defence-services business. If it becomes a software-led intelligence and influence platform with embedded public-sector relationships, the outcome starts to resemble the upper end of dual-use cyber and mission software rather than consultancy economics. Public comparables in the supplied record are limited, so precision would be false. The cleaner way to frame upside is qualitative: a company that owns a trusted workflow in contested information operations across government and critical industry could support venture-scale value creation well beyond its current £465,000 capital base (scenario, not a forecast) [BusinessCloud, October 2026]. That upside rests on productisation, repeatable procurement, and proof that Ghost Shift can move from founder-led expertise to an institution buyers rely on.
Partially corroborated -- Section relies on one independent funding report from BusinessCloud, one publisher-hosted founder interview from Millilux, and company-controlled materials from Ghost Shift, LinkedIn, and F6S.
Sources
Open sources
[LinkedIn] LinkedIn company profile | https://www.linkedin.com/company/ghost-shift
[Crunchbase] GHOST SHIFT LTD - Crunchbase Company Profile & Funding | https://www.crunchbase.com/organization/ghost-shift-ltd
[BusinessCloud, October 2026] Manchester Angels hits 22 investments with double deal | https://businesscloud.co.uk/news/manchester-angels-hits-22-investments-with-double-deal/
[Millilux, August 2026] Ghost Shift - helping governments and industry achieve information… | https://www.millilux.io/future-frontiers-podcast/ghost-shift
[F6S] F6S | https://www.f6s.com/company/ghost-shift
[Ghost Shift] Ghost Shift | Online operations | https://www.ghost-shift.com/
[Ghost Shift, retrieved 2026] Run like a company three times your size. | Ghost Shift | https://ghostshift.io/
[CB Insights] Top Ghost Security Alternatives, Competitors | https://www.cbinsights.com/company/ghost-security/alternatives-competitors
Articles about Ghost Shift
- Manchester Angels Back a Cyber Intelligence Bet in Contested Information Environments — The Manchester-based startup, founded by a former UK intelligence operative, aims to build cyber capabilities for governments and industry.