All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
BlinkOps sells Blink, a platform where security teams build AI agents and workflows that handle security alerts. Those agents triage an alert, investigate it, and carry out the fix across security operations, identity, and compliance work. Gil Barak and Zion Zatlavi built Secdo, which Palo Alto Networks acquired in 2018, so they now sell against their former acquirer's automation line. Its alert-triage page says investigation accuracy can exceed 99% for well-defined alert types, and the same page says that accuracy is not a fixed number. Its documentation lists hallucinations among the constraints agents still face, and says the platform halts any chain deeper than five agents. Blink fits a team that wants those published limits in hand before it lets software act on its own systems.
| Description | BlinkOps builds Blink, a security operations platform where teams assemble AI agents and automated workflows that triage alerts, investigate them, and carry out remediation across security operations, identity, vulnerability management, and compliance work. | [f1] |
|---|---|---|
| Founded | 2021 | [f2] |
| Funding | $90M total | [f3] |
| Latest funding | Series B, $50 million, announced July 2025 | [f4] |
| Product | What it does |
|---|---|
| Blink | Ingests alerts from SIEM, EDR, cloud, identity, and email tools, normalizes and enriches them, investigates with AI agents, and produces a documented case for analyst review and response. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Blink automates alert triage, investigation, and remediation for security operations teams and carries the same automation into identity and access work. These capabilities are mapped to the Cyber Defense Matrix. [f1]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | The buyer is named plainly, since BlinkOps addresses security operations teams plus the identity, vulnerability and compliance functions beside them, and its pages state the pain of manual alert handling concretely. CSO Online inspects the same category in its own voice and warns buyers that a headline integration count tells them nothing, but no captured source measures that pain apart from the vendor. [s1, s4, s12] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | BlinkOps publishes per-module product pages, a REST API reference with named endpoints for connections, workflows and case management, and a limitations page carrying agent call depth, per-run execution caps and per-tenant rate limits, which is inspectable engineering detail rather than marketing copy. CSO Online is the one captured source that describes the catalog from outside the company, so a single outside account carries the whole independent case for that depth. [s21, s22, s5, s12] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | BlinkOps was founded in 2021 and its CEO told Calcalist the company grew in parallel with advances in artificial intelligence, which is the enabler its agent product depends on. CSO Online's January 2025 buyer's guide records genAI capability spreading across the automation category, which is trade-press coverage of vendor activity rather than buyer-side evidence, and the captured record carries no buyer survey, procurement document or budget signal specific to security automation. [s10, s12, s8] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | Gil Barak and Zion Zatlavi previously built Secdo, an incident response company Palo Alto Networks acquired in 2018 at a price Calcalist reports as $100 million, SecurityWeek records the same acquisition in its own voice, and the company's Series B announcement carries it as well. A verifiable prior build and exit in the same domain, multiply evidenced, is what this rung asks for. The top rung is not reached: the captured sources show one exit rather than a category-defining track record, and no publication record or independent recognition of the team beyond it. [s10, s9, s8, s2] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | BlinkOps publishes customer stories naming Spectro Cloud, Human Security, Larry H. Miller Company and BDO's Israeli managed detection practice, three of the four headlining a figure such as more than forty hours a week freed, and its trust center names Cloudflare, Carlsberg Group, Rapyd, National Instruments and KOHO. Fortune lists the company in its Cyber 60. Those stories and that trust-center listing all sit on surfaces BlinkOps controls, the trust center records a review rather than a purchase, and no captured source outside the company names a customer or reports revenue. [s18, s6, s14, s9] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | SecurityWeek reports $50 million raised in a Series B for $90 million in total, which is proportional to the age and progress of a company founded in 2021 that ships a documented platform. Calcalist reported headcount at about 100 people in July 2025. The one revenue-growth figure in the captured record is the company's own January 2025 claim of 400 percent year-over-year revenue growth, stated with no baseline, so output per dollar sits at the funded-private default. [s9, s19, s10] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | CSO Online places BlinkOps among multiple security orchestration, automation and response products with a starting price, which is one independent placement in an established budget line. The same guide records Forrester Research splitting the category into several kinds of product, so the shortlist a buyer works from is itself contested. BlinkOps also markets a category of its own and states on its homepage that it originated it, and independent placement rests on one guide rather than the plural evidence the next rung asks for. [s12, s1, s9] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Customer-built workflows and agents create real friction, and the integration and template library takes time to assemble. Palo Alto Networks markets Cortex XSOAR to security operations teams and markets an agent product called Cortex AgentiX alongside it, so an adjacent incumbent already sells automation and agents into the same function, and no captured source shows a proprietary data asset behind the friction. [s17, s5, s12] |
BlinkOps sells to security operations teams whose analysts still work the alerts that existing automation missed. Its own pages put the problem that way, saying most mature automation deployments cover a narrow set of high-volume cases while the rest of the alert queue lands on analysts. The company frames that buyer broadly, telling visitors its customers use Blink across nine domains that run from the security operations center through cloud security, identity, compliance and vulnerability management to IT service work. Its AI SOC page describes the loop as taking in an alert, gathering context, deciding, and acting.
The category is established rather than emerging. CSO Online's buyer's guide, written by David Strom and published in January 2025, compares multiple security orchestration, automation and response products, which shows a purchasing category with a recognized shortlist and published starting prices.
What the captured record does not contain is an independent measurement of the pain BlinkOps describes. The company states the problem in its own voice, and no captured source quantifies it apart from the vendor, so a buyer has only the vendor's word for how big the problem is. [s1, s4, s12]
Blink splits reasoning from execution. Reasoning agents interpret an alert while deterministic workflows run the exact path a builder designed, and case management holds the result. Workspace permissions control which systems an agent can reach and task-level controls govern what it may do, and the platform logs every decision an agent makes so a reviewer can see what ran and why.
Alert handling runs end to end. Blink extracts the observables from an incoming alert, normalizes, enriches and deduplicates them, hands the harder work to specialized micro-agents, and returns a case carrying the supporting evidence, a severity assessment and a recommended action. A copilot turns a written instruction into a workflow, which the company says lets a team start from a prompt without security engineers or coding.
The documentation is where the capability becomes checkable and where the marketing claim meets its limits. BlinkOps publishes a REST API reference with named endpoints for connections, workflows and case management, and a limitations page that caps an agent chain at five, caps a single run at twenty ability executions, caps one input at 100KB, and caps a tenant at 1,600 requests a minute. The same documentation says agents still face constraints including hallucinations, higher cost and execution limits. The product page says investigation accuracy can exceed 99% for well-defined alert types, and no captured source measures that figure. [s5, s4, s21, s22, s20, s1]
BlinkOps competes with the automation-first platforms and with the incumbents that bundle automation. CSO Online's guide files it under security orchestration, automation and response alongside other products in the category, with a starting price CSO Online reported at $17,500 a year in January 2025. Palo Alto Networks markets Cortex XSOAR to security operations teams and cites a KuppingerCole ranking naming it an overall leader in the category, and it markets an agent product called Cortex AgentiX beside it, so BlinkOps meets an incumbent selling both automation and agents into the same function.
The company answers with breadth and with a category of its own. It markets one platform covering security operations, vulnerability management, compliance and identity work, and it states on its homepage that it originated the Agentic Security Operations Platform category. SecurityWeek and Calcalist describe the product in the company's micro-agent vocabulary, while the one captured guide that puts BlinkOps on a buyer's shortlist files it under the established name.
Gil Barak and Zion Zatlavi built Secdo, which Palo Alto Networks acquired in 2018, so the founders now sell against the company that bought their previous one. A testimonial BlinkOps publishes on its homepage compares Blink to XSOAR by name. [s12, s17, s1, s10, s9]
Named customer stories are the strongest traction signal in the captured record. BlinkOps publishes stories covering a large insurance and reinsurance provider, Spectro Cloud, Human Security, Larry H. Miller Company, and BDO's managed detection practice in Israel. Four of those five headline a figure, among them thirty-second incident response, more than forty workflows in under two weeks, and more than forty hours a week freed. Its trust center names Cloudflare, Carlsberg Group, Rapyd, National Instruments and KOHO under a heading saying the company is reviewed and trusted by them, which does not say they are customers.
Those surfaces all belong to BlinkOps. No captured source outside the company names a customer, and neither captured press report of the Series B names one. Fortune lists BlinkOps in its Cyber 60, a ranking Fortune compiled with Lightspeed Venture Partners, which is recognition rather than a disclosure of customers or revenue.
No captured source discloses revenue. BlinkOps announced 400 percent year-over-year revenue growth in a January 2025 release of its own without stating a starting figure, and SecurityWeek puts total funding at $90 million. [s18, s6, s14, s15, s19, s9]
The founding credential is a completed exit in this market. Gil Barak and Zion Zatlavi built Secdo, an incident response company Palo Alto Networks acquired in 2018, and Calcalist reports the price at $100 million while SecurityWeek records the acquisition in its own voice. The captured sources show one prior build rather than a track record of several.
BlinkOps publishes a named leadership bench. Its about page names a chief technology officer, a senior vice president and five vice presidents beside the two co-founders, and states a team of more than 100 people across four continents and a founding year of 2021. Calcalist reported in July 2025 about 100 people, split evenly between Israel and the United States.
SecurityWeek and Fortune place the company in Austin, Texas, while BlinkOps lists offices in San Francisco and Tel Aviv and datelines its own Series B release from San Francisco. No captured source records published research or independent recognition of the team beyond the prior exit. [s2, s10, s3, s9, s14, s8]
BlinkOps runs a trust center on a third-party portal that lists SOC 2, ISO/IEC 27001, ISO/IEC 42001:2023, CASA Tier 2, GDPR and CCPA. The same portal records a twelve-hour recovery point objective and lists Amazon Web Services.
Everything that portal shows is a listing rather than an inspected document. BlinkOps offers its penetration test report and its SOC 2 report behind an access request, so the captured record stops at the entries the trust center displays.
The efficacy claim is where the assurance stops. BlinkOps states that investigation accuracy can exceed 99% for well-defined alert types and, in the same FAQ answer, that accuracy in agentic investigations is not a fixed number. Its documentation lists hallucinations among the constraints agents still face, and no captured source measures any of it. The attestations record standard compliance work rather than a barrier to a replacement. [s6, s4, s20]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Torq | competes with | Competes for the same enterprise security operations buyer. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Tines | competes with | Competes for the same security automation buyer. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Palo Alto Networks | competes with | Markets Cortex XSOAR and an agent product called Cortex AgentiX to security operations teams, an incumbent position in the same category. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Swimlane | competes with | Sells a security orchestration and automation platform to the same enterprise buyer. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
Add analyzed competitors to compare them side by side with BlinkOps.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Blink is software customers configure and run themselves, and the workflows and agents they build in it are the friction that keeps them. The captured record does not size what leaving would cost. Palo Alto Networks markets Cortex XSOAR and an agent product beside it to security operations teams, which is incumbent competition for the same function. Its certifications record standard compliance work rather than a barrier to replacement. Its terms of service take a perpetual license to the automations customers build and let the company offer those capabilities to other customers, a right the record does not show operating. Its customer stories describe an unnamed insurer and BDO's managed detection practice, accounts a rival could win, so they are a head start rather than a lasting one.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers buy a platform and build their own agents and workflows on it, with templates, a copilot and a published API reference as the enablement layer. Forward deployment engineers sit beside that, which is help with the software rather than a service that takes on the customer's outcome, so it stays at the software-product level where the customer configures and runs what it bought. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Workflows, agents, wired connections and case-management records a customer builds in Blink are friction of the data-history, integration and learned-workflow kind, and leaving means reabsorbing the automation the platform took over. The captured record documents that friction and does not size what a migration away would cost in duration, parties or complexity. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | SOC 2, ISO/IEC 27001, ISO/IEC 42001, a CASA review and a penetration test report are what a funded competitor obtains through ordinary enterprise-market preparation. No captured source shows a government authorization or a regulator-mediated approval attached to this product. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Reasoning agents that investigate an alert, coordinated with specialized agents for work like malware analysis and kept beside deterministic execution for the steps that must repeat exactly, put machine learning at the center of the product rather than at its edge. The published limits on agent depth, run length and input size are the boundaries its own documentation places on that agent work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Published customer stories describe a global insurance and reinsurance provider handling billions of dollars in premiums and name BDO's managed detection and response service in Israel, which is the regulated-enterprise class. The trust center separately names Carlsberg Group and National Instruments under its reviewed-and-trusted heading, which does not say they are customers. The homepage routes prospects to a demo request, and every one of these references is published by the company rather than by an outside source. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Blink is a platform teams build agents and workflows on rather than an application serving one use case, it exposes a REST API other systems can call, and a managed detection provider runs client delivery on it. The captured record does not show other software depending on it to function. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | The 30,000+ integrations and the 10,000+ workflow and 500+ agent templates BlinkOps reports are an accumulated content library, and a buyer's guide outside the company corroborates thousands of prebuilt workflows. The terms of service add contractual accretion: a perpetual, sublicensable license to reuse the applications customers build and rights over aggregated usage data. That is some accumulated advantage rather than none, and it stays replicable with time and effort, because the same guide credits comparable catalogs to rivals and nothing captured shows an asset that cannot be recreated. |
BlinkOps sells to organizations with a staffed security operations function, and it publishes named customers drawn from them. Its customer stories cover a large insurance and reinsurance provider that manages billions of dollars in premiums, Spectro Cloud, Human Security, and Larry H. Miller Company. Its trust center names Cloudflare, Carlsberg Group, Rapyd, National Instruments and KOHO among the organizations that have reviewed the company.
One published story shows the platform supporting a managed provider rather than an in-house team. BlinkOps describes BDO's managed detection and response service in Israel replacing its legacy automation product with Blink, cutting alerts by half and speeding its response times.
BlinkOps tells buyers its customers use Blink across nine domains, from the security operations center to IT service management. The captured sources do not show which of those functions pays.
The technical argument BlinkOps makes is a split between reasoning and execution. Agents reason about an alert while deterministic workflows run the exact path a builder designed, and case management holds the result. Its documentation states the division plainly, saying agents handle ambiguity and change while deterministic workflows provide reliability for structured, repeatable, rule-based tasks.
Alert handling runs end to end on that split. Blink extracts observables from an incoming alert, normalizes, enriches and deduplicates them, hands harder work such as malware analysis and threat hunting to specialized micro-agents, and returns a case carrying the supporting evidence, a severity assessment and a recommended action. Workspace permissions govern which systems an agent can reach, task-level controls govern what it may do, and every decision an agent makes is logged.
BlinkOps grounds the advantage in breadth of connection rather than in a modeling claim, and its own documentation bounds what the agents can do. It markets more than 30,000 integrations with more than 10,000 workflow templates and more than 500 agent templates, and those totals come from the company. The documentation caps an agent chain at five, caps a run at twenty ability executions, and names hallucinations among the constraints agents still face. The product page states investigation accuracy can exceed 99% for well-defined alert types, and no captured source measures it.
BlinkOps offers forward deployment engineers with security expertise to help a customer automate a use case.
Named customers and funding are the loudest signals. BlinkOps publishes outcome stories for Spectro Cloud, Human Security, Larry H. Miller Company, a global insurer, and BDO's Israeli managed detection practice, and SecurityWeek reports $50 million raised in a Series B for $90 million in total. The company's own announcement records the round as led by O.G. Venture Partners with Lightspeed Venture Partners, Hetz Ventures and Vertex Growth participating.
Every one of those customer surfaces belongs to BlinkOps. Its trust center says the company is reviewed and trusted by five named organizations without saying they are customers. Fortune lists BlinkOps in its Cyber 60, a ranking rather than a disclosure of customers or revenue, and no captured source outside the company names a customer.
CSO Online reports that BlinkOps pricing starts at $17,500 per year. That figure comes from a buyer's guide published in January 2025 rather than from the company, so a buyer should read it as an order of magnitude and not as a current quote. The same guide puts Swimlane at $72,000 per year and D3Security at a minimum annual price of $100,000, so BlinkOps starts below both of those.
Its terms of service describe subscriptions with usage limits, and state that exceeding a limit entitles the company either to seek a reduction in usage or to charge for the excess on a later invoice. Fees are non-refundable and non-cancellable. That is the shape of a metered enterprise contract, though the meter itself is not named.
What follows for a buyer is that only the floor appears in the reviewed sources. CSO Online writes that few vendors in this category publish full pricing and that potential customers will have to negotiate with sales teams, so a buyer can check where the price starts and has to ask for the rest.
Blink is delivered as a hosted service, and its trust center records hosting with a major cloud provider, lists Amazon Web Services, and gives a twelve-hour recovery point objective. The same portal offers a penetration test report and a SOC 2 report behind an access request.
Configuration sits with the customer, with vendor help offered beside it. Teams build their own workflows and agents from a template library, using a copilot that turns a written instruction into a workflow, and they set autonomy per agent and per action. BlinkOps offers forward deployment engineers with security expertise, which is the delivery muscle behind a build-it-yourself platform.
Documentation supports that self-service model and states its boundaries. BlinkOps publishes a REST API reference covering connections, workflows, executions and case management, authenticated with a key in a named header, and a limitations page giving per-tenant rate limits of 1,600 requests a minute and a 100KB ceiling on a single input.
BlinkOps runs a trust center on a third-party portal listing SOC 2, ISO/IEC 27001, ISO/IEC 42001:2023, CASA Tier 2, GDPR and CCPA. The portal also publishes a risk profile and a set of product-security controls a reviewer can open.
Everything that portal shows is a listing rather than an inspected document. It holds the underlying reports behind an access request, so the captured record stops at what the trust center displays.
The efficacy claim is where the assurance stops. The product page says investigation accuracy can exceed 99% for well-defined alert types and, in the same FAQ answer, that accuracy in agentic investigations is not a fixed number. The documentation adds hallucinations to the constraints agents still face and caps how deep an agent chain may run. No captured source measures any of it.
The connector catalog is the platform asset BlinkOps sells hardest. It states more than 30,000 integrations available at deployment, alongside more than 10,000 workflow templates and more than 500 agent templates.
That count is the company's own, and the one independent inspection reads differently. CSO Online describes the linked catalog as listing hundreds of integrations spanning a wide variety of third-party software, and it writes that a raw integration count is meaningless because a vendor can integrate with dozens of a cloud provider's services or with just one. A buyer who cares which of its own tools are covered has to check the list rather than trust the total.
The terms of service describe how the library can grow. A customer granting BlinkOps a perpetual, sublicensable license to the applications it builds also lets the company offer those capabilities to other users of the service, while excluding the customer's confidential information from what is distributed. The captured record does not show how much of the published library came that way.
The founding credential is a completed exit in this market. Gil Barak and Zion Zatlavi built Secdo, an incident response company Palo Alto Networks acquired in 2018, at a price Calcalist reports as $100 million, and SecurityWeek records the acquisition in its own voice. The captured sources show one prior build rather than a track record of several.
BlinkOps publishes a named leadership bench. Its about page names a chief technology officer, a senior vice president and five vice presidents beside the two co-founders, and states more than 100 people across four continents. Calcalist reported in July 2025 about 100 people, split evenly between Israel and the United States, and the company said in January 2025 that it had more than doubled its workforce in six months.
SecurityWeek and Fortune place the company in Austin, Texas, while the careers page names offices in San Francisco and Tel Aviv. No captured source shows conference work, published research or independent recognition of the team beyond the prior acquisition.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | BlinkOps homepage | official | 2026-08-13 |
| f2 | Calcalist CTech: BlinkOps secures $50M for its micro agent cyber platform | press | 2026-08-13 |
| f3 | SecurityWeek: BlinkOps Raises $50 Million for Agentic Security Automation Platform | press | 2026-08-13 |
| f4 | BlinkOps Series B announcement | official | 2026-08-13 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.