Exaforce

• Palo Alto Networks and CrowdStrike already own the telemetry pipelines Exaforce correlates at ingest, so an XDR incumbent could ship good-enough ingest-time investigation inside the console that generates the alerts.
• The $200 million raised against a disclosed base of 20 customers is a bet on land-grab speed. If named reference customers and independently reported revenue do not scale with the capital, the round funded a thesis rather than proven enterprise pull.
• The managed-service motion puts Exaforce against MDR and MSSP incumbents at the same time as the platform competes with XDR giants, doubling the set of well-funded competitors it must out-execute.
• Well-funded specialists including Dropzone AI, 7AI, and Prophet Security sell the same agentic SOC outcome, so if buyers cannot distinguish the platforms in evaluation, price competition compresses deal economics.
• The Exabots reason on frontier models every rival can license, so durable differentiation narrows to the ingest-time knowledge graph and the integration breadth that a funded competitor can rebuild.

Exaforce sells to enterprise security operations teams that cannot keep pace with attacks by adding people. The company frames the core constraint plainly: SOCs cannot scale by hiring more analysts and engineers, nor by writing more SIEM rules, so the answer is humans paired with task-specific AI agents that carry real context. The buyer is the in-house SOC at a company large enough to run an established security operation.

Voices outside the vendor corroborate the pressure. Help Net Security describes AI-driven attack methods accelerating faster than humans can keep up, and SecurityWeek frames the same machine-speed threat shift. Exaforce positions its platform as the way to deliver senior-analyst detection and investigation without the headcount the talent market cannot supply, the same capacity argument its closest rivals make.

The pitch extends from operating the SOC to running it for the customer. Exaforce offers the platform for teams that want to run their own agentic SOC and a managed service in which its analysts and Exabots act as an extended SOC, on the same architecture. The open question the materials leave is which budget pays, the security tooling line or the analyst headcount the pitch displaces. [s3, s5, s1]

The Exaforce platform runs the full detection-through-response lifecycle through four Exabots rather than scoring or routing alerts. Exabot Detect surfaces anomalies, Exabot Triage filters false positives, Exabot Investigate works cases, and Exabot Respond recommends or automates actions, each reasoning over a unified view of a customer's cloud and SaaS environment. SecurityWeek describes the agents handling detection, triage, investigation, and response across those environments.

The distinctive mechanism is correlation at ingest. Exaforce builds and maintains a real-time security knowledge graph as data arrives, connecting events, identities, permissions, configurations, code, files, and cloud activity, so its agents retrieve context rather than reconstruct it during an investigation. Help Net Security reports this yields answers in under a minute, a claimed 10x reduction in time and a significant reduction in tokens per investigation.

A multi-model AI engine underpins the agents. Exaforce combines data semantics, behavioral baselining, machine learning, and large language models to produce decisions the company frames as fast and repeatable, and it adds natural-language threat search for hunting. The verifiable footprint is strong for the category, with independent reporting describing the architecture, though no third-party benchmark of detection accuracy appears in fetched sources. [s6, s5, s2]

Exaforce competes on two fronts at once, specialist AI SOC rivals and platform incumbents. TechCrunch names 7AI, Dropzone AI, and Prophet Security among the startups selling agentic SOC outcomes in near-identical language, and BankInfoSecurity reports Singla naming XDR vendors Palo Alto Networks and CrowdStrike as the most credible competition because they already have a broad understanding of real-time data processing and endpoint behavior. CB Insights, scoring the field independently, names the security operations center AI agents market and ranks Exaforce a Challenger rather than a leader among more than a dozen vendors, widening the rival set with Tines, Torq, and Blink.

The company's stated edge is architecture plus operating model. Exaforce argues that most AI SOC products triage alerts after they trigger while it correlates at ingest, which it claims makes real-time triage and detection possible rather than after-the-fact reconstruction. It then offers that architecture either as software a team runs or as a managed service it runs, a dual motion that pure-software rivals such as Command Zero do not match.

The breadth of that positioning is the exposure as well as the edge. Running both a platform and a managed service pits Exaforce against MDR and MSSP incumbents at the same time as the XDR platforms, so the same dual motion that differentiates it doubles the set of well-funded competitors it must out-execute before the category consolidates. [s4, s7, s5, s12]

Exaforce shows stronger named-customer proof than most of its peer set. TechCrunch reports the product reached general availability in the fourth quarter of 2025 after two years with design partners, and the company has since added 20 customers including Replit and Guardant Health, with Singla projecting 40 to 50 by year end. Function Health and Invisible appear as named testimonial customers on the company's site.

Scale and investor signals reinforce the logos. Exaforce reports processing millions of investigations across its customer base, grew past 130 people, and tripled its valuation in a year to $725 million, and the Series B drew Mayfield, Khosla Ventures, HarbourVest, Peak XV, Seligman Ventures, and AICONIC. The round ranks among the biggest disclosed in the emerging AI SOC space.

The motion is demo-led into enterprise SOCs with a global expansion underway. Exaforce is investing go-to-market across Japan and Europe. The figures that would fully confirm momentum, independently reported revenue and a public customer count beyond the 20 cited, do not yet appear in fetched reporting. [s4, s3, s9, s1]

Exaforce's credibility comes from a repeat security founder. Chief executive Ankur Singla previously led F5's security products business, a fact BankInfoSecurity states independently, and that prior build in the same domain maps directly onto the security-operations product Exaforce now sells. The company was founded in 2023 and has grown past 130 people.

The backer bench reinforces the founder signal. Mayfield backed both the Series A and the Series B, and the investor set spans Khosla Ventures, HarbourVest, Peak XV, Touring Capital, Seligman Ventures, AICONIC, and Thomvest. A Qualys proxy filing with the SEC independently corroborates that bench, naming former Censys chief executive Brooks as a Thomvest-compensated board observer on Exaforce since January 2026. That concentration of specialist backing across two large rounds in two years is itself a signal about the team's standing.

The leadership page names a deep bench beyond the chief executive across engineering, product, and customer engineering, though individual prior builds below Singla do not surface in fetched press. The verifiable strength is the founder's domain track record and the investor confidence it has drawn across two large rounds in two years. [s7, s9, s8, s11]

Exaforce frames itself as audited and certified against established third-party standards. Its platform page displays a row of badge images covering SOC 2 Type 2, SOC 2 Type 1, ISO 27001, and HITRUST alongside compliance regimes such as PCI DSS, HIPAA, and GDPR, all linking to an inspectable trust portal at trust.exaforce.com. For an autonomous tool that ingests a customer's events, identities, configurations, and cloud activity, that breadth signals procurement readiness, though the genuine third-party attestations and the compliance frameworks are not all the same kind of assurance.

Architecture supports the trust argument. Exaforce frames its multi-model engine and ingest-time knowledge graph as producing precise and repeatable decisions, and it combines machine learning with large language models rather than relying on a single model, which the company positions as the path to trustworthy verdicts. The managed-service option adds human oversight from Exaforce analysts alongside the Exabots.

The badge set is enterprise-grade but table-stakes rather than a differentiator. Because the platform handles privileged telemetry and reasons on external frontier models, a buyer should still pull the underlying audit reports from the trust portal and resolve data-handling, model-provider, and retention terms in a formal security review beyond the displayed badges. [s10, s2, s1, s9]

Add analyzed competitors to compare them side by side with Exaforce.

Exaforce targets enterprises large enough to run their own security operations and feel the analyst-scaling ceiling. At the Series A, Singla described focusing on large enterprises with revenues over $5 billion, companies that he argued truly need to improve SOC productivity and efficacy. The buyer is the in-house SOC, not a small team outsourcing the function wholesale. CB Insights tracks Exaforce in its expert-systems matrix and, as the profile read in August 2026, places it as a Challenger in managed detection and response among 15 other companies including Rapid7, Cisco, and Google Cloud, which puts third-party analyst coverage on the managed side of the dual model.

The dual operating model widens that segment without changing the architecture. A team that wants control runs the platform itself, while a team without the staff has Exaforce run it as a managed extended SOC, on the same Exabots and outcomes. That lets Exaforce sell to both the well-staffed enterprise and the lean security team from one product.

Named demand is recent but real. The company reports 20 customers including Replit and Guardant Health after a late-2025 general availability. Separately, Function Health and Invisible appear as testimonial customers on its site. The open question is how far down-market the managed option pulls Exaforce before it competes head-on with the established outsourced-SOC providers.

The claimed advantage is correlating data at ingest rather than reconstructing it during an investigation. Help Net Security reports that where many AI SOC tools query logs and APIs after an alert fires, Exaforce builds a real-time knowledge graph as events, identities, permissions, configurations, code, and cloud activity arrive, so its agents retrieve context and answer in under a minute, a claimed 10x time reduction and fewer tokens per case.

The engine under the agents blends model types rather than wrapping a single LLM. Exaforce combines data semantics, behavioral baselining, machine learning, and large language models, which it frames as the path to fast and repeatable decisions, and SecurityWeek notes the platform runs without reliance on traditional SIEM rules or manual query languages. Four Exabots carry detection, triage, investigation, and response.

The verifiable footprint is strong for the category, though it rests on description rather than testing. Help Net Security and SecurityWeek report the ingest-time architecture and repeat the differentiation Exaforce claims for it, and neither describes independent technical validation. What does hold up is an engineering and data-architecture head start: the cited pages describe a large-language-model layer without identifying proprietary model technology, and no named non-public training corpus or third-party accuracy benchmark appears in fetched sources.

Exaforce ran a product-first motion before scaling sales. The company tested for two years with design partners before bringing the product to market in the fourth quarter of 2025, and the design-partner cohort spanned over 10 enterprises across technology, energy, and manufacturing. Fetched sources record that sequencing without stating the reasoning behind it.

Conversion is now visible and accelerating by the company's account. Exaforce reports 20 customers including Replit and Guardant Health and projects 40 to 50 by year end, processing millions of investigations, and it is investing go-to-market across Japan and Europe. The motion is demo-led into enterprise SOCs with a managed-service path for teams that want it run for them.

Investor confidence outruns disclosed revenue. The Series B drew Mayfield, Khosla Ventures, HarbourVest, Peak XV, Seligman Ventures, and AICONIC at a $725 million valuation. Independently reported revenue or a customer count beyond the 20 cited does not yet appear in fetched sources.

Exaforce does not publish pricing in fetched sources, so the charged unit and list price stay private. A vendor that hides prices usually targets large negotiated enterprise deals, which fits the over-$5-billion-revenue buyer the company named at the Series A. The absence withholds the budget-anchoring signal some peers publish.

The dual operating model implies two value meters rather than one. The self-run platform reads as a software subscription while the managed service reads as a labor-displacement spend, and the company leans on a no-extra-headcount argument across both. What the platform charges by, telemetry volume, assets, investigations, or seats, is not stated publicly.

The inferable belief is that buyers pay for SOC capacity rather than tooling features, given the framing around analyst tiers and headcount. Confirming the unit and whether consumption is capped would require a sales conversation, which the hidden-price posture signals is the intended path.

Exaforce delivers across two operating models on one architecture. A customer can run the platform with its in-house team or have Exaforce operate it as a managed extended SOC, with the same Exabots and outcomes either way, which lets the company meet a buyer wherever its staffing sits. The Exabots handle detection, triage, investigation, and response across cloud and SaaS environments.

The platform ingests and unifies high-volume telemetry into a correlated view without traditional SIEM rules or manual query languages, and an optional real-time data platform underpins it. Integrations shown span cloud, identity, and SaaS telemetry sources, with a broad connector roadmap. The cited pages link to a status page but do not include specific uptime metrics, incident history, or support SLA terms.

The managed option changes the operational risk profile relative to pure-software rivals. With Exaforce analysts overseeing the Exabots, the service accepts hands-on responsibility for outcomes rather than handing the customer software to run, which is the operational counterpart to the accountability differentiation in its positioning.

Exaforce displays a broad compliance surface for an autonomous tool that ingests privileged telemetry. The platform page states the company is audited and certified against established third-party standards and shows badge images for SOC 2 Type 2, SOC 2 Type 1, ISO 27001, PCI DSS, and HITRUST alongside HIPAA, GDPR, and US data privacy, the last three regulatory regimes rather than audited certifications. The trust portal at trust.exaforce.com lists SOC 2 Type II, ISO 27001, and HITRUST report artifacts plus three annual penetration tests, and states that access to that documentation requires a signed confidentiality agreement, so a buyer sees the vendor-displayed claims before the underlying evidence.

The architecture is framed as part of the trust case. The multi-model engine blends machine learning with large language models rather than relying on a single model, which Exaforce positions as the route to precise and repeatable verdicts, and the ingest-time knowledge graph chains every event to its context. The managed option adds human analyst oversight over the agents.

The displayed set is table-stakes assurance rather than a moat, and the scope and current validity of each item stay unverified until a buyer obtains the gated reports. Because the platform handles a customer's events, identities, and configurations and reasons over large language models, a buyer should still resolve data-handling, model-provider, and retention terms in a formal review beyond the published badges.

Exaforce positions itself as the data-and-reasoning layer for security operations rather than a point tool. It ingests and correlates telemetry, identities, permissions, configurations, code, and cloud activity into a real-time knowledge graph at ingest, and an optional real-time data platform can underpin that, so the platform claim rests on owning the correlated view its agents reason over.

That ownership is a sharper bet than rivals that only query a customer's existing tools. By building the graph at ingest rather than reconstructing context per investigation, Exaforce holds a richer per-customer view at decision time, though that view is rebuilt from each customer's own telemetry, and the platform still depends on the source tools it ingests from and on a large-language-model layer for reasoning.

The exposure is that the XDR incumbents already own the telemetry pipelines. BankInfoSecurity names Palo Alto Networks and CrowdStrike as the most credible competition precisely because they understand real-time data processing and endpoint behavior, so the ingest-time layer Exaforce is building is the ground those platforms are best positioned to contest.

Exaforce's credibility comes from a repeat security founder. Chief executive Ankur Singla previously led F5's security products business, a prior build in the same domain that BankInfoSecurity states independently and that maps onto the security-operations product. The company was founded in 2023 and has grown past 130 people.

The backer bench reinforces the founder signal. Mayfield joined both the Series A and the Series B, and the investor set spans Khosla Ventures, HarbourVest, Peak XV, Touring Capital, Seligman Ventures, AICONIC, and Thomvest. A Qualys proxy filing with the SEC independently corroborates that bench, naming former Censys chief executive Brooks as a Thomvest-compensated board observer on Exaforce since January 2026. That concentration of repeat and specialist backing across two large rounds in two years is itself a signal about the team.

The leadership page names a bench across engineering, product, and customer engineering, though individual prior builds below Singla do not surface in fetched press. The verifiable strength is the founder's domain track record and the investor confidence it has drawn, with depth below the principal the open question.