Daylight Security

• Expel, ReliaQuest, Arctic Wolf, eSentire, and Red Canary sell the managed detection and response Daylight groups itself against, so any of them could add agentic investigation to a service their customers already buy.
• No independent test of Daylight's performance appears in the reviewed sources, and the 90 percent false-positive reduction reaches the record only through funding coverage, so a benchmark or a customer teardown could contradict it.
• A verified buyer review from July 2026 on Gartner Peer Insights is critical, reporting slow onboarding of new alerts and AI capabilities short of what the buyer needed, so later reviews could widen that complaint rather than close it.
• Daylight advertises senior-only staffing with no junior analysts against a team of 25 recorded in November 2025, so customer growth could outrun the experienced responders who carry its cases to resolution.
• The coverage Daylight sells for AI systems is built on Claude Enterprise's compliance API and OTel session stream, so a change to either interface could remove the capability.

Daylight sells to security teams that want alert work finished rather than escalated. Its service page names the complaint plainly, that most alerts get escalated, that alerts arrive without the identity and cloud context needed to close them, and that the verdict arrives without the reasoning behind it. The buyer is a security leader who still ends up doing the triage.

Two published accounts describe that starting point. The Motley Fool had worked with established providers for several years, and its team compared what its provider had actually investigated against what its cloud security tool surfaced. LiveView Technologies ran an employee on-call rotation before it bought.

One account comes from outside the company. A verified buyer review on Gartner Peer Insights from May 2026 says the reviewer selected an MDR provider after evaluating multiple vendors, wanting round-the-clock monitoring without building an internal security operations center. What no non-vendor source supplies is a measure of how much triage returns to the buyer, so only accounts Daylight publishes give its size. [s2, s16, s17, s20]

Daylight describes a specific architecture on its service pages. Telemetry from identity, cloud, endpoint, and business systems flows into a central data lake. A central orchestrator dispatches task-scoped agents whose next step follows the evidence rather than a fixed playbook, and a context layer the company calls Daylight Knowledge holds policies, assets, and operations so an investigation reflects how the customer works.

Three services run on that base. The managed detection and response service covers detection through response, with security experts taking over complex or high-risk cases. The threat hunting service pairs an expert-defined hypothesis with agent execution across the customer's telemetry. The data lake keeps the last 90 days searchable and shifts older telemetry to archival storage that is rehydrated on demand, answering questions in plain English or in KQL directly.

Daylight extended the service twice in mid-2026. An MCP server, announced in June 2026, lets AI assistants such as Claude, Cursor, and VS Code Copilot pull investigation context through Daylight's APIs. Detection Program Visibility, announced in July 2026, shows customers the detections running for them, maps them to MITRE ATT&CK, and adds alert volume, case outcomes, overlap, and coverage gaps.

What the record lacks is validation from outside the company. No third-party technical evaluation and no public technical documentation appear in the reviewed sources. Daylight also writes detection rules against business tools such as Slack, GitHub, and Notion, and its coverage for AI systems rests on Claude Enterprise runtime telemetry, both of which a buyer has only the vendor's account of. [s2, s3, s4, s23, s22, s5, s1, s6]

Daylight names its own competitive set and sorts it into two groups. Its blog on SOC-as-a-service providers places Expel, ReliaQuest, Arctic Wolf, eSentire, Secureworks Taegis MDR, and Red Canary in the managed group, and it excludes Prophet Security and Dropzone AI from that comparison on the grounds that they are tools rather than managed services. The managed group holds the contract Daylight wants to replace.

Buyers reach for the same comparison. Gartner Peer Insights shows the top alternatives to Daylight's service as the Sophos, Arctic Wolf, and CrowdStrike managed detection products, which are all established providers rather than agentic newcomers.

Contractual ownership of the outcome is the difference Daylight leads with. It argues that established providers escalate too much and that AI tools leave the customer running the operation, and it offers to own the cycle from alert to resolution under a contractual commitment. Its service page heads the offering "A New Model of MDR" and says it is neither a traditional MDR nor an AI SOC tool, so a buyer meets the vendor's qualifications before meeting the service.

The established group already staffs and bills for the managed operation, so what Daylight adds on top of that model is the agentic investigation layer. A provider in that group could add the same layer to a service its customers already buy. [s14, s20, s2]

Daylight's traction shows up as named customers rather than numbers. SecurityWeek and Ctech articles each carry Cresta, McKinsey Investment Office, and The Motley Fool among dozens of enterprises, and place Daylight's operations across Asia, Europe, and North America. Four published customer stories add Lusha, LiveView Technologies, and Antidote Health, each with a named security leader on the record.

Independent buyer evidence now exists. Gartner Peer Insights carries nine verified ratings of the MDR service averaging 4.8, and one May 2026 reviewer says they selected the provider after evaluating multiple vendors. A July 2026 reviewer is critical, reporting slow onboarding of new alerts and AI capabilities that fall short of what they needed.

A buyer reaches Daylight through a sales conversation. The reviewed pages carry no price, no trial, and no self-service path, only a demo request. Gartner Peer Insights records the billing unit, a subscription typically structured by headcount and charged annually, and Lusha's proof-of-concept criteria asked for per-headcount or per-entity pricing rather than per-source or per-gigabyte. The amount stays undisclosed.

Revenue, retention, and contract-value figures are all absent from the reviewed sources. A buyer can confirm that enterprises bought and cannot tell what those accounts are worth or how long they last. An MSSP Alert brief states a reduction in false positives of up to 90 percent in its coverage of the funding round, and no buyer or independent evaluator states that figure in the reviewed record. [s8, s10, s18, s16, s17, s13, s19, s20, s12]

Both founders held the earliest technical and product roles at Torq, whose own founders press coverage groups among cybersecurity founders. Hagai Shapira and Eldad Rudich met at 18 in Israeli military intelligence, which press coverage identifies as Unit 8200, and later reunited at Torq, where Eldad Rudich was its earliest engineer and Hagai Shapira its earliest product manager. Neither has an exit in the reviewed record.

The investor roster reads as peer endorsement rather than ordinary venture interest. SiliconANGLE lists the individual investors as Assaf Rappaport of Wiz, three people from Torq, two from Cyera, two from Armis, and Ofir Ehrlich of EON, alongside Craft Ventures, Bain Capital Ventures, and Maple VC.

The operating bench is where the domain record sits. Daylight's leadership page lists Amnon Kushnir as head of security operations, and a SANS Institute profile records an Amnon Kushnir who directs incident response at Sygnia and presented at a 2024 SANS summit with Oren Biderman. Oren Biderman's byline runs on Daylight's own August 2026 threat research. The reviewed sources do not link the SANS records to the Daylight roles.

Daylight also describes the team that runs the service. A Times of Israel article states 25 employees across Tel Aviv, the United States, and Singapore at the November 2025 Series A, and Daylight advertises no junior analysts, no night shifts, four regions on a follow-the-sun rotation, and more than ten years of average security experience among its responders. [s7, s9, s11, s24, s26, s1, s2]

Daylight's homepage carries two attestation badge images. One image file is named SOC 2 and carries the alt text "aicpa soc 2 badge". The second carries that same alt text, and its file name and its rendered image identify an ISO 27001 certified seal.

Daylight points trust.daylight.ai at a SafeBase trust portal, and that portal answers "Trust Center Unavailable" to both a plain fetch and a browser render. A random subdomain of the same domain does not resolve, so the address is a deliberately configured portal rather than a wildcard answering everything. Security.daylight.ai does not resolve, and the /trust, /security, and /compliance paths return 404. A buyer therefore cannot read either report or its scope without asking.

Daylight ingests a customer's identity, cloud, endpoint, and business-tool telemetry into a data lake it manages, and its own experts define and maintain the detections that run against it. The privacy policy the record cites governs personal information tied to the website and the services, and it permits anonymized, aggregated, or de-identified personal information to be used for improving those services, including through artificial intelligence. Nothing in the reviewed sources sets out subprocessors or data residency for the telemetry the service ingests, so a buyer in a regulated sector such as Antidote Health would have to establish both in contracting. [s15, s27, s28, s25, s2, s13]

Add analyzed competitors to compare them side by side with Daylight Security.

Daylight targets security teams that want alert work finished rather than escalated, whether they outsource it today or carry it in house. The published customer stories describe that profile precisely, with LiveView Technologies running an employee on-call rotation before it switched and The Motley Fool leaving established providers at renewal.

Company size in the evidence runs wide. Gartner Peer Insights carries a verified review from a manager at a transportation business in the 1 to 10 billion dollar revenue band. The named customers are Cresta, McKinsey Investment Office, The Motley Fool, LiveView Technologies, Antidote Health, and Lusha, which Daylight describes as a unicorn-stage business-to-business sales intelligence platform.

Regulated buyers are on the record twice. Antidote Health is a United States health insurance business that Daylight describes as operating in a highly regulated environment, and Lusha's story names strict GDPR and CCPA compliance requirements. Daylight operates across three continents, with a SecurityWeek article placing its operations across Asia, Europe, and North America and a Times of Israel article recording offices in Tel Aviv, the United States, and Singapore.

The technical claim is orchestration rather than a model. A central orchestrator dispatches AI agents each scoped to one task, and each next step follows the evidence rather than a fixed playbook. Daylight builds a context store it calls Daylight Knowledge, which records what normal looks like across a customer's users, devices, access patterns, and workflows, and Daylight staff feed findings back into it.

Daylight owns the data layer that feeds the agents. Telemetry from every integration lands in a managed data lake with 90 days of searchable storage and archival storage beyond that, stored in its original format rather than normalized on the way in. The threat hunting service runs agents against that history under an expert-defined hypothesis, and advanced users can query the lake in KQL directly.

Two capabilities arrived in mid-2026. An MCP server lets AI assistants pull investigation context through Daylight's APIs under scoped, logged access. Detection Program Visibility gathers a customer's detections from security tools, from SIEM content, and from what Daylight runs on their behalf, and Daylight says every investigation feeds back into which detections find real threats and which create noise.

Daylight builds each customer's context layer from that customer's own telemetry, and the product pages name no corpus that accumulates across accounts, though its own August 2026 research describes one detection firing at six unrelated customers. Its privacy policy separately permits anonymized, aggregated, or de-identified personal information to be used for analyzing, enhancing, testing, training, and improving its services, including through artificial intelligence. That clause is written about personal information, and the reviewed pages do not say whether the telemetry the service ingests falls inside it.

Coverage for AI systems is narrower still. It is built on Claude Enterprise runtime telemetry, so it reaches customers who run that product and changes when that vendor changes what it exports.

Daylight sells through a sales team. The reviewed pages carry no pricing page, no trial, and no self-service sign-up, only a demo request. The leadership page lists a vice president of sales alongside a head of product and a business development lead, which points to a hired go-to-market team rather than founder-only selling.

Displacement is the pattern the evidence shows. The Motley Fool switched at renewal after comparing what its provider had actually investigated against what its cloud security tool surfaced, and it evaluated an AI MDR vendor and an AI SOC tool alongside Daylight. Lusha set nine written proof-of-concept criteria before committing. Antidote Health ran a proof of concept in which Daylight integrated the stack and built detection rules before the decision.

Independent corroboration now reaches past customer names. SecurityWeek and Ctech articles both carry dozens of enterprises and the names Cresta, McKinsey Investment Office, and The Motley Fool. Gartner Peer Insights carries nine verified buyer ratings of the service averaging 4.8, one of them a May 2026 review describing a competitive evaluation and one a July 2026 review that is critical. Beyond that the record carries no revenue, retention, contract value, or analyst placement, so the size of the business stays unverified.

A buyer can learn how Daylight bills but not what it costs. Gartner Peer Insights records the service as a subscription typically structured by the number of headcount, charged on an annual recurring basis, with threat hunting and phishing investigation available as additions. Lusha's proof-of-concept criteria asked for per-headcount or per-entity pricing rather than per-source or per-gigabyte charges, and named that as the fix for tooling whose cost rose with every new data source.

Daylight makes a cost argument about the log platform it replaces. Its data lake page states that most organisations use a fraction of their log platform's functionality while paying for the whole thing, and that the operational burden grows faster than the value. A SiliconANGLE article carries the company saying the service is not meant to replace every SIEM deployment. The public pages do not say whether the data lake is bundled with the MDR service or priced separately.

Two inputs the pages describe are the agents that run each investigation and the senior staff across four regions with no junior tier. The reviewed pages do not say how either reaches the customer's bill, so a buyer cannot model what a heavy month of investigations would cost.

Deployment is integration-led and fast by the company's own account. A SiliconANGLE article carries the company's claim that the system goes live in under an hour, the integrations catalog spans thirteen categories from endpoint detection to threat intelligence enrichment, and Daylight states it can build new connectors within days. Lusha's story describes its full stack of AWS, Okta, Jira, and its own API telemetry onboarded within 48 hours during the evaluation.

Daylight runs the operational work rather than handing it to the customer. Its staff define and maintain the detection rules, build the context layer, take over complex cases, and drive them to resolution, and the service page states a contractual accountability commitment from alert ingestion through to closure. Benign alerts are closed at the source rather than forwarded. For LiveView Technologies, Daylight wrote customized detection rules on top of the team's existing coverage.

Two operational details reduce work for the customer's own team. Daylight talks to employees directly through Slack, Teams, or email to verify activity, which removes the internal chase that usually falls to the customer. Coverage runs continuously across four regions on a follow-the-sun rotation rather than through night shifts.

Daylight's homepage carries two attestation badge images. One image file is named SOC 2 and carries the alt text "aicpa soc 2 badge". The second carries that same alt text, and its file name and its rendered image identify an ISO 27001 certified seal.

Daylight points trust.daylight.ai at a SafeBase trust portal, and that portal answers "Trust Center Unavailable" to both a plain fetch and a browser render. A random subdomain of the same domain does not resolve, so the address is a deliberately configured portal rather than a wildcard answering everything. Security.daylight.ai does not resolve, and the /trust, /security, and /compliance paths return 404. A buyer therefore cannot read either report or its scope without asking.

Daylight ingests a customer's identity, cloud, endpoint, and business-tool telemetry into a data lake it manages, and its own experts define and maintain the detections that run against it. The privacy policy the record cites governs personal information tied to the website and the services, and it lists categories of service providers without naming them. Nothing in the reviewed sources sets out subprocessors or data residency for the telemetry the service ingests, so a regulated buyer such as Antidote Health or Lusha would have to establish both in contracting.

Daylight positions itself as a service on one architecture rather than as a platform others build on. The company states that every service it delivers runs on the same foundation of deep integration, agentic investigation, and expert operators, which is a shared-delivery argument rather than an ecosystem one. No partner programme and no marketplace listing appear in the reviewed sources.

One interface opened in June 2026. The Daylight MCP server lets MCP-compatible AI assistants connect and retrieve investigation context through Daylight's APIs, under authentication, scoped permissions, and logging. That extends Daylight's data into other vendors' tools rather than inviting other vendors to build on Daylight.

Its ecosystem role is otherwise that of a consumer of other vendors' telemetry. The integrations catalog is organised into thirteen categories covering endpoint detection and response, identity and access management, cloud security, email security, data security, network security, log aggregation, threat intelligence enrichment, and AI security, and Daylight also writes detections against business tools such as Slack, GitHub, and Notion.

Daylight reads from security platforms that could add more investigation to their own consoles. Its coverage for AI systems is built on one model vendor's published telemetry, so what that line covers depends on what the vendor chooses to expose. Daylight's answer is that it works across all of those tools rather than inside any one of them.

Both founders held the earliest technical and product roles at Torq, whose own founders press coverage groups among cybersecurity founders. Hagai Shapira and Eldad Rudich met at 18 in Israeli military intelligence and later reunited at Torq, where Eldad Rudich was the earliest engineer and Hagai Shapira the earliest product manager. Press coverage identifies them both as veterans of Unit 8200, and the reviewed record shows no exit behind either of them.

The investor list reads as peer endorsement. SiliconANGLE lists the individual investors as Assaf Rappaport of Wiz, three people from Torq, two from Cyera, two from Armis, and Ofir Ehrlich of EON, alongside Craft Ventures, Bain Capital Ventures, and Maple VC.

The operating bench carries the domain record. Daylight's leadership page lists Amnon Kushnir as head of security operations, and a SANS Institute profile records an Amnon Kushnir who directs incident response at Sygnia and presented at a 2024 SANS summit with Oren Biderman. Oren Biderman's byline runs on Daylight's own August 2026 threat research, which reconstructs a campaign that triggered the same detection at six unrelated customers. The reviewed sources do not link the SANS records to the Daylight roles.

Daylight delivers the service with its own staff. A Times of Israel article states 25 employees spread across Tel Aviv, the United States, and Singapore at the Series A in November 2025, and the about page names a head of security operations, a head of product, a business development lead, and a vice president of sales alongside the two founders. Daylight advertises no junior analysts, no night shifts, four regions on a follow-the-sun rotation, and more than ten years of average security experience.