On June 3, Cy4Data Labs announced a product built on the assumption that Signal will fail. Not Signal's encryption, which the company does not dispute. The failure it has in mind is the ordinary kind, a message forwarded to the wrong person or a phone quietly compromised through a fake login.
Cy4Signal wraps individual Signal messages, voice calls, and video in a second layer of encryption that the company says stays attached to the data after it leaves the app. Pull a protected message off the platform, and what you get is a string of characters. Signal's own end-to-end encryption stops at the edge of the app, and Cy4Signal is meant to cover the ground past that edge. It extends Cy4Secure, the company's field-level encryption platform, which is designed to keep data locked even during use.
"Signal remains as susceptible to social engineering as any other technology," said Todd Carper, the company's chief technology officer and co-founder, in the launch announcement.
A Utah company, a federal customer
The company works out of both San Jose and Salt Lake City, with its engineering team based mostly in Utah. The April 2025 funding announcement went out under a San Jose dateline. The product launches go out under a Salt Lake one.
Salt Lake City's Pelion Venture Partners led the $10 million round, the company's first, with managing partner Blake Modersitzki on the deal. SecurityWeek reported it as a Series A. Cy4Data started in 2023, employs fewer than 50 people, and says it already has revenue and Fortune 100 customers.
Utah's cybersecurity sector leans heavily toward managed services, IT consulting, and the satellite offices of larger national firms. A company writing its own cryptography and selling it directly to federal agencies is rarer here, and the advisory roster matches that ambition. In September, the company added retired U.S. Army Brigadier General Paul G. Craft, a cyber-defense veteran with more than three decades of military and cybersecurity experience, to its board of advisors.
Chief Executive Lance Smith tends to explain the company through other people's disasters. After Nevada closed state offices, phone lines, and websites for two days following a ransomware attack in late August 2025, he told TechBuzz the lesson was a short one. "It only takes one password," he said.
Why now
The pitch depends on a change that Smith and his competitors all describe in the same way. Artificial intelligence has made the cheap attacks work better. Phishing that used to arrive full of spelling errors now arrives clean, and voice cloning has turned a phone call into something that can be forged.
The figures come mostly from security vendors and analysts, who have a product to sell, but the underlying reports are specific. Voice-phishing attempts rose 442 percent between the first and second halves of 2024, according to CrowdStrike's 2025 Global Threat Report, which tied the surge to AI-assisted social engineering. Deloitte's Center for Financial Services projects that generative AI could push fraud losses in the United States to $40 billion by 2027, up from $12.3 billion in 2023.
The case that gets cited most often involves the engineering firm Arup. A finance employee in its Hong Kong office paid out about $25 million after joining a video call on which the chief financial officer and the other participants were all AI-generated deepfakes.
Christina Richmond, an analyst who reviewed Cy4Signal, notes that Signal's reputation is itself part of the exposure. Because serious people trust it, it is worth attacking.
The clearest version of that played out inside the government, on Signal itself. In March 2025, a group of senior national security officials discussed an imminent strike on Houthi positions in Yemen over the app, and the national security adviser added a journalist to the thread by mistake. The encryption held. The conversation leaked anyway, the episode picked up a name, Signalgate, and the fallout ran for months.
The warnings had come first. In February 2025 the National Security Agency told its own staff, in a bulletin marked for official use only, that Signal's popularity among surveillance targets had made it worth intercepting. Within days of the Yemen leak, the Pentagon told its workforce that attackers were going after Signal users through phishing. Signal said it had added protections months earlier. That sequence, working encryption undone by a human slip, is the one Cy4Signal is built around.
What is still unproven
Cy4Data calls its encryption mathematically unbreakable at the atomic level and immune to any amount of computing power, quantum machines included. On a POLITICO stage in October 2025 it called Cy4Secure the first quantum-proof encryption and promised what it termed perfect secrecy. It says the work rests on NIST-approved standards.
Cryptographers do not give out the word "unbreakable," and they tend to distrust people who do, because the security of a system lies in the details a slogan leaves out. None of the company's strongest claims has been reviewed independently in public. That review, rather than the marketing, is what would settle whether the product holds up.
The rest is unsettled, too. No federal agency has confirmed a pilot. The mechanics of how Cy4Signal attaches to Signal have not been explained, and Signal, run by a nonprofit that has fought outside modification of its app, has not described any role in the product.
There is one image from the company's spring that sells the idea better than its press materials do. At the RSA security conference in San Francisco, the Cy4Data team worked the floor handing out Guy Fawkes masks, the anonymous face lifted from hacker iconography. A company that sells anonymity for data was giving away the masks.
