Sonrai Closes 2025 with 4x ARR Growth as Its Permissions Bet Pays Off

Sonrai Security closed 2025 with 4x annual recurring revenue growth, driven by surging adoption of its Cloud Permissions Firewall — as strong a scoreboard update as any company in this publication's orbit posted last year.

The numbers behind the number

According to Sonrai's year-end announcement, the customer list added in 2025 reads like a diversified enterprise portfolio: Sandisk, Fiserv, ISO New England, PG&E, Haemonetics, LiveView Technologies, PIB Group and others — financial infrastructure, utilities, medical technology. The company says customers using the Cloud Permissions Firewall consistently cut their cloud permissions attack surface by more than 90%, and that some are actively blocking cryptomining campaigns that exploit excessive permissions.

That same announcement cited independent validation in December: testing by Software Secured found the firewall preventatively blocked 16 of 16 real AWS privilege-escalation attack paths.

Why we keep covering this company

Sonrai's headquarters may sit south of the border, but its engineering story runs through Fredericton and the Q1 Labs lineage — co-founder Sandy Bird's second act after building QRadar. The trajectory now visible — category creation in 2024, an AI agent in 2025, quadrupling revenue behind it — is the fullest version yet of the thesis this cluster has been proving for twenty years: world-class security products get built from New Brunswick talent.

The obvious question for 2026 is capital. Growth like this attracts term sheets, and eventually, acquirers. However that chapter ends, the pattern that matters locally is already secured: the diaspora keeps compounding, and the next founding team is probably in a Fredericton lab right now.

Sources

• Sonrai Closes 2025 with 4x ARR Growth — company newsroom (ARR, customers, attack-surface claims)
• Sonrai Closes 2025 with 4x ARR Growth as Cloud Permissions Firewall Adoption Surges — wire distribution of the same announcement