5 New Cybersecurity Companies Building Products Worth Watching
Lara B. — Building Cyberr
There are a lot of new cybersecurity companies right now.
And, unsurprisingly, almost all of them are talking about AI.
AI-powered SOCs, AI pentesting, AI detection, AI agents protecting other AI agents. After a while, it becomes difficult to tell which companies are genuinely building something new and which ones have simply found a new way to describe an existing product.
So we looked at some of the youngest companies in cybersecurity and tried to answer a slightly different question.
Who is actually building something that could change how security is done?
Not necessarily who has raised the most money. Not who has the loudest marketing. And not necessarily who will become the biggest company.
But products that made us stop and think: if this works, something about the way we currently do security could fundamentally change.
These five stood out.
TENEX.AI
TENEX is building an agentic security operations model where AI agents investigate alerts, correlate data and handle much of the traditional Tier 1 and Tier 2 SOC workload, while experienced security professionals remain responsible for higher-level decisions. TENEX says its agents currently own more than 95% of T1 and T2 work.
The real value is not simply making analysts faster. TENEX is questioning whether the traditional analyst-heavy MDR and SOC model is still the best way to run security operations.
Closest established competitor: Arctic Wolf
Arctic Wolf represents the established MDR model: a managed security service built around technology combined with human security operations. TENEX is essentially betting that far more of that operational workload can now move from people to autonomous agents.
Geordi.ai
Geordie is building security and governance specifically for AI agents. It discovers agents across an organisation, understands what they can access, records their behaviour and tool use, identifies risk and provides controls when something needs to be changed.
The value becomes clearer as companies deploy hundreds or thousands of autonomous agents. Managing access is no longer enough. Companies also need to understand what those agents actually do after access is granted.
Closest established competitor: CyberArk
CyberArk built one of the strongest businesses in identity and privileged access security. Geordie is attacking the next version of that problem, where the identity using company systems may no longer be a human or traditional service account, but an autonomous agent operating across multiple tools.
It is not a perfect 1:1 competitor, but increasingly they will be competing for part of the same security conversation and budget.
Armadin
Armadin is building autonomous offensive security agents that continuously attack an organisation's environment and search for validated paths to compromise across applications, networks, identity and infrastructure.
Instead of waiting for the next penetration test, the idea is to continuously test the company the way an attacker would and prove which weaknesses can actually be exploited.
Closest established competitor: Pentera
Pentera helped establish automated security validation and automated penetration testing as a category. Armadin pushes that model further by using adaptive swarms of AI agents designed to reason, learn from previous attempts and construct complete attack paths.
The interesting shift is from automated testing towards something much closer to an autonomous attacker .
Fig Security
Fig focuses on whether the security infrastructure itself is actually working.
It maps the dependencies behind detections, data pipelines and response workflows so teams can identify when a configuration, schema or infrastructure change quietly causes a security control to stop functioning. Fig describes this as Security Operations Resilience.
Your SIEM can still be running and your dashboards can still be green while an important detection underneath them has stopped working.
Closest established competitor: Splunk
This comparison is slightly different because Fig does not aim to replace Splunk, Sentinel or other SIEM/SOAR platforms. It sits across them and checks whether the data, detections and workflows connecting the security stack continue to work correctly.
In other words, Splunk helps run security operations. Fig is asking whether those security operations are still functioning as intended.
AegisAI
AegisAI is applying autonomous AI agents to email security. Instead of depending mainly on static rules, signatures and known malicious infrastructure, its agents analyse the sender, language, context, intent and other signals around each message.
That matters because modern phishing does not necessarily contain something obviously malicious. Sometimes the threat is simply an extremely convincing message designed to make somebody take the wrong action.
Closest established competitor: Proofpoint
Proofpoint is one of the established leaders in enterprise email security, alongside Mimecast. AegisAI is trying to disrupt that model with an API-native architecture and LLM-based agents that reason about new threats rather than depending primarily on previously known indicators and rules. Established email vendors such as Proofpoint and Mimecast are specifically among the companies newer AI-native email-security startups are trying to displace.
What connects them?
TENEX is challenging the traditional MDR and SOC model.
Geordie is expanding identity security into autonomous agents.
Armadin is pushing pentesting towards a continuously running autonomous attacker.
Fig is adding a resilience layer around increasingly complex SOC infrastructure.
AegisAI is trying to move email security from recognising known threats towards understanding context and intent.
And that may be the more interesting story here.
AI is not only giving cybersecurity companies new features. It is allowing new companies to go after some very established categories and ask whether the way we have been doing the work still makes sense.
Who wins is still very open.
But these are exactly the kinds of products worth watching.
7 reactions · 1 comments
Comments
Mario M.: Fig Security stood out to me here. The idea that a SIEM can look healthy while an important detection has quietly stopped working is an interesting problem. As security stacks become more complex, validating that the controls themselves are still working may become just as important as monitoring what they detect.