Above Security

• Microsoft ships Purview Insider Risk Management inside Microsoft 365 E5 bundles that Above’s 1,000-plus-employee targets often already license. If Purview adds agentic investigation narratives, Above loses its sharpest differentiation before a public reference base exists.
• Customer proof is named CISO testimonials inside the company’s own marketing. If independent named customer references remain absent by mid-2027, public traction stays unproven despite the $50 million raise.
• Identity and SaaS security vendors that already observe OAuth grants could ship agent-behavior monitoring as a feature, absorbing the agentic-insider use case Above treats as its entry point.
• Above markets itself as a managed platform. If investigations require human review as deployments scale, the ten-person team becomes the delivery bottleneck and the business takes on services economics.
• Above monitors communications tone and AI conversations across collaboration tools. European works councils and privacy regulators could block or condition deployments, shrinking the addressable market for the company’s most data-hungry capabilities.

Above Security defines insider risk as an investigation problem rather than a detection problem, and it names its buyer precisely. The funding release states that the platform targets organizations with 1,000 or more employees operating in SaaS-forward environments, and the product is built so that security, HR, and legal teams consume the same investigation in role-scoped forms. That three-department framing matches how insider cases actually conclude, in HR action or legal process rather than in a SOC queue.

Independent press corroborates the problem in its own voice. CTech reports that enterprises struggle with rising internal risk and that the definition of an insider is expanding beyond human employees as organizations deploy autonomous systems. Dror Nahumi of Norwest, quoted in the funding release, describes insider threats as among the most critical and under-addressed challenges in cybersecurity, an investor voice rather than an independent measure.

The AI-agent expansion is the company’s sharpest problem claim, and it is mechanically specific. Aviv Nahum argues that AI agents are becoming insiders in everything but name, and the vendor’s agentic AI page walks through the failure concretely, since an agent granted OAuth scopes reads corporate data at API speed on its vendor’s servers, where DLP sees no movement and UEBA sees no user-baseline deviation. [s7, s2, s8, s4]

A fleet of named investigative agents is the platform’s core design. As of July 2026 the homepage names five specialized agents, Shadow AI & IT, Data Exfiltration, Flight Risk, Inappropriate Use, and Communications, each described as purpose-built to detect a specific class of threat and together covering SaaS, endpoint, identity, and AI surfaces. The funding release adds the Arbiter engine, which the company says determines intent by correlating behavioral signals the way a human investigator would.

The investigation document is the unit of output, replacing the alert. The platform page presents each finding as one case with a behavioral timeline, contextual analysis, a risk verdict, and recommended actions, built so that security, HR, and legal act together on the same artifact. The about page adds real-time intervention, stating the product politely intervenes and stops risky actions before they happen.

Deployment claims are aggressive and partially corroborated by the lead investor. The funding release describes enterprises deploying in minutes without writing a single policy, rule, or configuration, and Ballistic Ventures writes that most Above customers are operational in minutes to hours with tuning that requires almost no effort.

Public technical depth lags the claims. The site offers no documentation portal or self-service trial, and the trust center that anchored the assurance story in June no longer resolved when probed in early July 2026. The clearest external validation is the CrowdStrike release citing Above for replacing alerts with full investigative narratives. [s1, s2, s7, s3, s10, s13, s14]

Above positions against the rules-and-anomalies generation by name. The homepage contrasts itself with DLP, access management, SIEM and SOAR, UEBA, and CASB, claiming intent understanding where those tools apply static policy, anomaly baselines, or alert orchestration. CTech repeats the core distinction in its own voice, noting the platform does not rely on predefined rules.

The incumbents it must displace are bundled or entrenched. Microsoft sells Purview Insider Risk Management inside Microsoft 365 compliance suites, Proofpoint and DTEX Systems hold dedicated insider-threat budgets, and Teramind serves the monitoring-centric end of the market. Above’s counter is that those tools produce breadcrumbs that still require a human investigation, the labor its agents replace.

The agentic-insider coverage is the differentiated foothold. Above treats an AI agent acting on an employee’s OAuth grant as a class of insider and investigates its behavior alongside the human’s, surface that rule-based incumbents do not yet model. CrowdStrike’s judges singled out exactly this proactive, narrative-producing approach when naming the company accelerator runner-up. [s1, s8, s4, s13]

Traction claims are early and mostly vendor-voiced. The funding release reports substantial revenue across the company’s first six months and quotes one named customer, Merlin Entertainments CISO Matt Wilmot, who credits Above with surfacing critical incidents within five days. The homepage shows a small logo wall under a Trusted by heading including Rogo, and carries titled CISO testimonials, yet no customer speaks in independent coverage.

Investor and program endorsement is the strongest independent signal. Ballistic Ventures, Merlin Ventures, and Norwest led $50 million across seed and Series A within eight months of founding, with Jump Capital and QPV Ventures participating, and CrowdStrike, AWS, and NVIDIA selected the company for their 2026 accelerator and then named it runner-up at the RSAC pitch day.

The motion is founder-led enterprise sales on a ten-person team. The founders front all press, the site sells a demo that assembles an investigation on the buyer's own data rather than a trial, and the funding release notes established integrations with CrowdStrike and others across identity, endpoint, and SaaS environments. No marketplace listing, reseller, or MSSP program appears in fetched sources. [s7, s1, s8, s12, s13, s2]

Both founders bring verifiable prior builds, and one maps directly onto the problem domain. CEO Aviv Nahum co-founded Ctrl and served as its CTO until Sana acquired it, with Workday later acquiring Sana, and CPTO Amir Boldo founded Trullion, served as founding SVP of R&D at identity-security vendor Silverfort, and held a VP role at DriveNets. CTech states in its own voice that both are seasoned entrepreneurs with prior exits and veterans of Unit 8200 branches.

Bench depth beyond the founders is invisible. CTech’s headline counts ten employees at the Series A, no other executives are publicly named, and the company carries a production platform, a managed offering, and an enterprise sales motion on that headcount. [s3, s8, s7]

Above stood up a trust center at trust.above.security with substantive collateral for a vendor this young. As captured on June 18, 2026, the center showed a SOC 2 Type 2 compliance badge and gated a SOC 2 report, a Sayfer Security pen-test report, privacy and security whitepapers, and a data flow diagram behind an access request. When probed on July 2, 2026, the subdomain no longer resolved and the served marketing site carried no trust link, so that collateral is a captured record rather than a page buyers can reach.

The genuine gaps sit around the attestation. No standalone ISO 27001 certification of Above's own showed in the captured record, no public vulnerability-disclosure policy appears in fetched sources, and the pen-test evidence was gated behind the access request rather than published.

Privacy resistance is a structural sales risk the company itself anticipates. The homepage frames intervention as coaching rather than consequences, and sentiment analysis across every collaboration channel will draw works-council and privacy-regulator scrutiny in European deployments. A months-old vendor requesting this telemetry should expect long counterparty reviews until references accumulate, and the SOC 2 attestation that answered procurement's initial questions currently has no public home.

Community positioning reinforces the trust collateral. Above is the inaugural sponsor of the Insider Threat Matrix, the open framework maintained by Forscie, a program limited to six annual sponsorships, which aligns the brand with practitioner-owned investigation vocabulary. [s14, s1, s2, s11, s5]

Add analyzed competitors to compare them side by side with Above Security.

Above names its segment with unusual precision for a stealth-stage vendor. The funding release states the platform targets organizations with 1,000 or more employees operating in SaaS-forward environments, which selects for companies whose collaboration, identity, and AI telemetry already flows through cloud systems the agents can read. The persona design is the distinctive choice, since the same investigation serves the security analyst, the HR partner, and counsel as one shared case, so the product courts three departments rather than one buyer.

The newest public proof of demand dates to the March 2026 stealth exit, and the homepage now carries several named security-leader testimonials, including CISO Oren Gur, whose card carries an unnamed company logo, and Yoni Kaplansky, a head of cyber architecture whose card carries the FICO logo file, alongside the Merlin Entertainments CISO quote the funding release first surfaced. The funding release and Ynet's launch coverage both carry the Merlin Entertainments CISO's described deployment outcome, while deployment coverage beyond that launch-day account remains absent, the freshness gap to watch, but the named-reference base has grown beyond a single customer.

Geography follows the founding story. The release carries a San Francisco and Tel Aviv dateline, CTech and Ynet cover the company as Israeli-founded, and the visible motion is US enterprise sales on Israeli engineering, the standard pattern for this cohort.

The claimed pain is specific and the claimed mechanism is consistent everywhere it appears. Above argues that DLP fires on data movement while agents read files in place, and that UEBA baselines never capture programmatic reads, so both miss the modern insider. Every fetched description, vendor and press alike, gives the same answer, a fleet of specialized investigative agents and an Arbiter engine that scores intent by correlating behavioral signals across systems and time, and as of July 2026 the homepage names five such agents, spanning shadow AI and IT, data exfiltration, flight risk, inappropriate use, and communications sentiment.

The claimed AI advantage is patient cross-system correlation no human team can staff. The platform page pitches the agents as doing everything an analyst would, automatically, with every signal investigated and no detection rules to write, the workload no human team scales to. No proprietary corpus or cross-customer data advantage is claimed in fetched sources, so the accumulating asset is each tenant's behavioral baseline. A latent flywheel sits one step past it, since the sponsorship announcement says the platform speaks the Insider Threat Matrix's behavioral language, a vocabulary alignment that could one day seed cross-tenant intent signatures, and the public record evidences no such shared corpus today.

Public recognition rests on third parties rather than published efficacy evidence. CrowdStrike's release describes the alert-replacement mechanism in its own words when naming Above runner-up, and Ballistic reports customers finding latent issues immediately. The vendor offers a demo that assembles an investigation on the buyer's own data but publishes no documentation, sandbox, or benchmark.

Above runs founder-led enterprise sales with a demo as the entry point. The site offers no trial, no free tier, and no published pricing, and the platform page sells a demonstration that assembles an investigation on the buyer's own data. Both founders are quoted in the launch coverage, which fits a ten-person company that reports substantial revenue without naming its sales organization, and matches the stage where founder-led selling is the healthy signal rather than the warning.

Where buyers encounter Above without the vendor selling is recognition programs, not channels. CrowdStrike, AWS, and NVIDIA selected the company for the 2026 accelerator and named it runner-up at the RSAC pitch day, and the Insider Threat Matrix sponsorship puts the brand inside the framework practitioners use for investigations. The site now advertises reseller and technology-alliance programs on a Partners page, though no fetched source documents partner counts or channel-sourced deals, so the demonstrated motion remains direct.

The integration surface hints at the eventual channel story. The funding release notes established integrations with CrowdStrike and others across identity, endpoint, and SaaS environments, proximity that the accelerator relationship reinforces, but none of it yet amounts to a channel an incumbent would have to buy past.

Above publishes no pricing, which signals negotiated enterprise deals and a sales-assisted motion. The unit the company charges by is not disclosed in any fetched source, and for a managed offering that unit will define the business, since per-employee pricing would track how buyers measure their insider population while outcome-based pricing would track the investigation service the marketing promises.

The managed framing invites comparison against the cost of staffing an investigation team rather than a software line item. Ballistic's investment note argues that only highly regulated banks or intelligence-grade organizations could historically afford fully staffed insider risk programs and that Above gives every organization the effect of a highly trained investigation team. That comparison invites buyers to price the product against analysts they will not hire rather than against tooling line items, the more defensible anchor if the claim holds.

Cost behavior at AI scale is the open pricing question. Continuous agentic analysis of communications and behavior carries real inference costs, and no fetched source addresses how consumption translates into the customer's bill or the vendor's margin.

Near-zero-configuration deployment is the operational claim and the lead investor corroborates it. The funding release describes enterprises deploying in minutes without writing a single policy, rule, or configuration, and Ballistic writes that most customers are operational in minutes to hours with tuning that requires almost no effort. The product plugs into the stack the customer already runs, with a published integrations catalog spanning identity, endpoint, cloud, SaaS, AI, and people systems.

Trust and procurement collateral caught up in June 2026, even where operational documentation had not. The trust center captured on June 18 showed a SOC 2 Type 2 attestation and a public risk profile with a four-hour recovery time objective, and it gated a SOC 2 report, a pen-test report, whitepapers, and a data flow diagram behind an access request, though the subdomain no longer resolved when probed on July 2. What still does not appear publicly is an SLA, a status page, an uptime commitment, or self-serve deployment documentation, and enterprises that route insider investigations through a vendor will demand those answers in procurement even when onboarding is genuinely instant.

The telemetry the product handles raises the delivery bar further. Reading communications tone and AI conversations means the data-handling architecture, retention, and residency posture will face scrutiny that ordinary security telemetry does not, and the captured trust collateral answered only part of it, so retention and residency positions still ride on the sales conversation.

Above stood up a trust center at trust.above.security that answered the questions its data access provokes. As captured on June 18, 2026, it carried a SOC 2 Type 2 badge and gated a SOC 2 report, a pen-test report, privacy and security whitepapers, and a data flow diagram behind an access request, and its public risk profile set the data-access level at restricted, impact at moderate, and the recovery time objective at four hours.

The subdomain no longer resolved when probed on July 2, 2026, and the served marketing site carries no trust link, so the collateral is a captured record rather than a live artifact. The other gaps stand as before, since no standalone ISO 27001 certification of Above's own showed in the captured record, no public vulnerability-disclosure policy appears in fetched sources, and the pen-test evidence was gated rather than published.

The company anticipates the surveillance objection rather than avoiding it. The homepage frames intervention as coaching rather than consequences, and the about page states the product politely intervenes and stops risky actions before they happen, positioning that acknowledges where deals will stall. Works councils and privacy regimes in European deployments remain the structural test no fetched source addresses.

The Insider Threat Matrix sponsorship is a further trust investment. Backing Forscie's open, practitioner-built framework as its inaugural sponsor, holding one of the program's six sponsor slots on a twelve-month renewable term, aligns the company with vendor-neutral investigative vocabulary and buys community standing alongside the attestations the trust center carried.

Above positions as the system of record for insider investigations rather than as infrastructure. The integrations catalog brings telemetry in from identity, endpoint, cloud, SaaS, AI, and people systems, and the single investigation case gives security, HR, and legal a shared artifact, which embeds the product in cross-departmental workflow without making other software depend on it.

The ecosystem play runs through the CrowdStrike orbit and the open framework. The funding release names established integrations with CrowdStrike and others across identity, endpoint, and SaaS environments, the accelerator relationship deepens that proximity, and the Insider Threat Matrix sponsorship ties the product's vocabulary to the framework practitioners are adopting for investigations.

A Partners page advertising reseller and technology alliances now appears on the site, while no API documentation or marketplace listing appears in fetched sources, so platform ambitions currently rest on integration breadth and community positioning rather than on third parties building against Above.

The founding pair brings prior exits and one directly relevant operating run. CEO Aviv Nahum co-founded Ctrl and served as its CTO until Sana acquired it, with Workday later acquiring Sana, and CPTO Amir Boldo founded Trullion and served as founding SVP of R&D at Silverfort, identity-security experience adjacent to the insider problem, plus a VP role at DriveNets. Both are veterans of Unit 8200 branches, Unit 81 and Unit 49, per CTech's own-voice reporting.

Ten people carry the entire mandate. CTech counts ten employees at the Series A, and that team runs a production platform, a managed insider-threat offering, founder-led enterprise sales, and a sponsorship program simultaneously. The $50 million the investors committed against that headcount reads as conviction in the founders specifically, and the next hires will show whether the bench grows toward the managed-service promise or toward product engineering.