Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAT&T did not completely sell or abandon cybersecurity. It formed LevelBlue with WillJam Ventures as a standalone managed-cybersecurity joint venture. The agreement was announced on November 17, 2023; LevelBlue launched on May 6, 2024, with AT&T retaining a minority stake and board representation. LevelBlue later acquired Trustwave, with the transaction closing on August 19, 2025.
What happened to AT&T’s cybersecurity business?
AT&T and WillJam Ventures agreed to separate selected cybersecurity assets and personnel into a standalone company. The transaction covered selected security software, managed-security operations, consulting resources and related managed services—not every AT&T security product, employee or internal security function.
The formal structure matters: the announcements describe a joint venture, not a complete divestiture. AT&T kept a minority ownership position and board representation, although the cited announcements do not disclose an exact percentage.
The timeline
| Date | Event |
|---|---|
| November 17, 2023 | AT&T announced an agreement with WillJam Ventures to create a standalone managed-cybersecurity business. AT&T announcement |
| April–May 2024 | The joint venture closed and began operating under the LevelBlue name. |
| May 6, 2024 | LevelBlue was formally launched at RSA Conference. Launch announcement |
| July 1, 2025 | LevelBlue announced an agreement to acquire Trustwave. Agreement announcement |
| August 19, 2025 | LevelBlue announced that the Trustwave acquisition had closed. Closing announcement |
| August 18, 2026 | LevelBlue is an established standalone managed-security provider rather than a newly renamed AT&T department. |
Who owns LevelBlue?
LevelBlue is jointly owned by WillJam Ventures and AT&T. WillJam provides investment and cybersecurity-industry leadership; Bob McCullen, WillJam’s managing partner, became LevelBlue’s chief executive. AT&T retained a minority interest and board representation. No precise ownership percentage is stated in the cited official releases.
#1 Best Overall
- BEST VALUE: Protect all your eligible Amazon purchases including: tech, tools, appliances, furniture and more. All for one low monthly price.
- PAST AND FUTURE PROTECTION: Covers malfunctions and failures, plus drops or spills for eligible portable items. Protection begins immediately for eligible purchases from the past 90 days, plus all eligible future purchases (products used commercially are excluded).
- TRUSTED CYBERSECURITY: Digital security with scam detection for emails and texts.
- EASY CLAIMS: File in minutes at www.asurion.com/amazon for fast repair or reimbursement - up to the purchase price.
- NO HIDDEN FEES. CANCEL ANYTIME: Up to $5,000 in total claims per 12-month period. Your plan renews monthly until canceled (coupons applied at checkout don’t renew monthly).
What moved into LevelBlue?
The original separation included selected AT&T security software, associated managed-security operations, consulting resources, managed services and related personnel. AT&T said LevelBlue launched with more than 1,000 employees globally. That is a May 2024 launch figure, not a verified 2026 headcount.
Public announcements do not provide a complete asset-by-asset inventory. Therefore, customers should not assume that every legacy AT&T security product, network-security capability or employee transferred.
What stayed with AT&T?
AT&T said it would continue offering managed security while concentrating on security capabilities embedded in its connectivity products and core network. In practical terms, AT&T remains the provider for connectivity-linked and network-embedded capabilities, including telecommunications security functions.
Rank #2
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
AT&T’s April 2026 Information & Network Security Customer Reference Guide documents AT&T’s Chief Security Office, network security operations, DDoS mitigation, perimeter protection and incident-management responsibilities. That documentation confirms that AT&T continues to operate customer-facing and internal security functions.
What LevelBlue sells now
LevelBlue’s current catalog spans managed services, professional services, software and security-operations platforms. The full catalog is listed at LevelBlue Services.
Managed security services
- Threat detection, investigation and response, including managed detection and response (MDR) and managed extended detection and response (MXDR).
- Managed cloud, network and endpoint security.
- Co-managed SOC and SIEM monitoring.
- Managed SASE and secure service edge.
- Web-application and API protection.
- Advanced threat hunting.
- Managed DDoS defense, content-delivery-network security and next-generation firewall services.
- Unified endpoint management.
Consulting and professional services
- Incident readiness, incident response, digital forensics and resilience retainers.
- Exposure management, vulnerability management and penetration testing.
- Cyber advisory, security architecture, integration and remediation.
- Threat intelligence, digital-risk protection and digital executive protection.
- Intellectual-property consulting.
Security software and platforms
- Email security.
- Database-security products including AppDetectivePRO and DbProtect.
- USM Anywhere, described as an Open XDR platform for security operations and managed-service providers.
- Fusion Security Operations Platform for security operations and managed services.
How Trustwave changed LevelBlue
The Trustwave acquisition expanded LevelBlue beyond the assets contributed at launch. LevelBlue says the combined company now includes managed detection and response, AI-driven threat detection, incident response, offensive security, strategic advisory services and security software, in addition to Trustwave’s managed-security capabilities.
LevelBlue describes the combined business as the world’s largest pure-play managed security services provider. That is the company’s characterization, not an independently verified market ranking. The closing confirms the acquisition, but it does not establish that every Trustwave product, portal, contract or support process was immediately consolidated.
What AT&T customers should check
Being an AT&T customer does not automatically mean that your service moved to LevelBlue. Check the documents and operational details for each product.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify the contracting entity. Review the master agreement, order form and invoice to see whether the provider is AT&T, LevelBlue or a third-party reseller.
- Match the service scope. Separate connectivity or network-security services from MDR, consulting, incident response, software and other standalone services.
- Confirm support routes. Verify the portal, account team, SOC contact and incident-response telephone number that apply to your contract.
- Review data terms. Confirm processing locations, retention periods, subprocessors, regulatory commitments and any sovereign-cloud requirements.
- Check integrations. Ask whether agents, APIs, log formats, collectors or telemetry requirements changed after a rebrand or transition.
- Read service-level language. Check detection, escalation, response, restoration and breach-notification commitments, as well as renewal and termination terms.
- Request written clarification. Have the account team identify any changes to billing entity, portal access, service levels, pricing or migration obligations.
Is LevelBlue a fit for a new buyer?
LevelBlue is aimed at organizations seeking a broad security provider rather than a single point product. Its portfolio can combine 24/7 monitoring, response, consulting, threat intelligence, incident services and security software, which may suit large enterprises, regulated organizations and hybrid environments that need an internal SOC augmented by an outside team.
The trade-off is complexity. A broad MSSP portfolio can require substantial governance, integration work and coordination across multiple service lines. Outcomes also depend on telemetry access, log quality, supported integrations and the customer’s willingness to grant response authority.
Compare these alternatives by operating model
| Option | Potentially better fit when… | Important question |
|---|---|---|
| LevelBlue or another full MSSP | You want monitoring, response, consulting and incident services from one strategic provider. | Which services are included, and which require separate statements of work? |
| MDR specialist | Your priority is outsourced detection and response rather than a large consulting portfolio. | Which endpoint, identity, cloud and network sources are covered? |
| Security-platform vendor | You already operate a major platform such as Microsoft Sentinel/Defender, CrowdStrike Falcon, Cisco Security or SentinelOne Singularity. | Who performs 24/7 monitoring and hands-on response? |
| Internal or co-managed SOC | You need direct control over telemetry, personnel, response authority or customized workflows. | Can your team sustain staffing, threat hunting and incident coverage? |
| Specialist consultancy | You need a focused penetration test, forensic investigation, advisory engagement or incident response. | What happens after the project or retainer is used? |
These are comparison categories, not endorsements. Buyers should evaluate coverage across endpoint, identity, cloud, SaaS, network and operational technology; analyst involvement; threat hunting; incident-response depth; certifications; data residency; contract flexibility; and measurable service levels.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Pricing and procurement
LevelBlue’s services page offers Request Pricing and Request a Demo; no standard public rate card is shown in the reviewed material. Treat pricing as quote-based and request a written scope covering monitored assets, response authority, integrations, log retention, onboarding fees, minimum commitments, incident-response entitlements and migration assistance.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Best Value
- SonicWall TZ370 High Availability Unit (02-SSC-6443) - Seamless Failover Protection: Designed to pair with a primary SonicWall firewall for automatic failover and continuous network uptime. Not a Standalone unit - requires an identical primary SonicWall appliance; cannot function independently.
- Protects against encrypted malware and intrusions using DPI-SSL inspection, IPS, anti-malware, and Capture ATP sandboxing with RTDMI detection.
- Secure SD-WAN intelligently steers traffic across links to reduce MPLS costs and improve cloud application performance for branch users.
- Zero-Touch deployment, SonicExpress onboarding, and centralized management via Network Security Manager simplify rollout and ongoing operations.
- Scales up to 900,000 to 1,000,000 concurrent connections depending on policy mix, supporting secure growth across users and devices.
Do not assume AT&T connectivity is required for every LevelBlue service, or that AT&T customers receive automatic discounts. Confirm each offering’s network dependencies and commercial terms product by product.
The Bottom Line
AT&T separated selected managed-cybersecurity assets into LevelBlue, a jointly owned company with WillJam Ventures, while retaining a minority stake and continuing network-centered security work. LevelBlue’s identity today reflects both that 2024 launch and its completed 2025 Trustwave acquisition. Customers should verify the contracting entity, service scope, support path and data terms rather than assume a wholesale AT&T transfer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
