All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Exaforce sells enterprise security teams a security operations platform whose AI agents, called Exabots, detect, investigate, and respond to threats. Teams can run it themselves or have Exaforce analysts run it 24/7 as a managed service. Founded in 2023, Exaforce has raised $200 million, and TechCrunch reports its $125 million Series B, backed by HarbourVest, Peak XV and others, valued it at $725 million. TechCrunch names Replit and Guardant Health among 20 customers added by May 2026, and Exaforce also names Forcepoint and NTT Data among its customers. Guardant Health runs Exaforce as its SIEM, the system that stores and searches security logs, so leaving would mean replacing that system. BankInfoSecurity names Palo Alto Networks and CrowdStrike as Exaforce's most credible competition.
| Description | Agentic SOC platform and managed detection and response service that runs detection, triage, investigation, and response through AI agents called Exabots, built on a multi-model AI engine and a real-time security knowledge graph across cloud and SaaS environments. | [f1] |
|---|---|---|
| Founded | 2023 | [f2] |
| HQ | San Jose, California, US | [f3] |
| Funding | $200M total | [f4] |
| Latest funding | Series B, $125M (May 2026), from HarbourVest, Peak XV, Mayfield, Khosla Ventures, and Seligman Ventures, valuation $725M | [f5] |
| Product | What it does |
|---|---|
| Exaforce Platform | Agentic SOC platform whose four Exabots (Detect, Triage, Investigate, Respond) reason over a real-time knowledge graph and a multi-model AI engine of data semantics, behavioral baselining, and LLMs. |
| Exaforce MDR | Managed detection and response service in which Exaforce analysts and Exabots operate the platform as a customer's extended SOC, providing continuous monitoring and response on the same architecture. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
The Exaforce Platform ingests telemetry, identities, configurations, and cloud activity across endpoints, networks, identities, and data stores, then detects anomalies, triages, investigates, and responds. It is mapped to the Cyber Defense Matrix. [f4]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 | The buyer is specific, large enterprises with revenues over $5 billion and well-established SOCs, according to BankInfoSecurity. Independent sources quantify the pain. CSO Online reports a March 2026 Cloud Security Alliance survey in which 68% of organizations could not distinguish human activity from AI-agent activity, and Latio's 2026 report addresses teams modernizing the SOC amid a crowd of AI SOC vendors. No independent buyer voice appears, so the score stops short of 5. [s18, s21, s25] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Exaforce documents its architecture in detail, a Semantic Model that resolves entities by graph traversal beside a Behavioral Model that scores anomalies with statistical ML, on a data platform that correlates logs, identity and configuration. CSO Online quotes independent analyst Avivah Litan judging that its agentless approach lowers friction but is weaker for runtime inspection, a third-party technical assessment, and GigaOm's radar places it among SecOps automation vendors. No hands-on test or open code appears, so the score stops at 4. [s7, s8, s21, s24] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two buyer-side signal kinds fall within twelve months. In May 2026 TechCrunch reported in its own voice that Exaforce had added 20 customers, including Replit and Guardant Health, since launch. In June 2026 Latio's security operations report addressed teams sorting through a crowd of AI SOC vendors, and GigaOm's SecOps automation radar lists Exaforce among its vendors. Customer adoption plus analyst category recognition reaches rung 4. The customer count may trace to Exaforce itself. [s15, s25, s24] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | BankInfoSecurity reports that Ankur Singla founded the application delivery platform Volterra and sold it to F5 in January 2021 for $500 million, then led F5's security products group. Touring Capital adds that he built Contrail Systems, acquired by Juniper. That is plural prior builds with exits, one of them independently reported, and senior leadership of a named security products business. The builds sit in networking and application delivery rather than security operations, and no category-defining recognition appears, so the score is 4. [s18, s26] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Exaforce names customers under a trusted-by heading on its website, including Replit, Guardant Health, Forcepoint, Glean, and NTT Data. It publishes case studies for Guardant Health, Forcepoint, and Fuze. TechCrunch reported in May 2026 that Exaforce had added 20 customers since its late-2025 launch, naming Replit and Guardant Health. Several named reference customers, two of them also named in independent reporting, meet the multiply sourced bar. [s1, s10, s11, s12, s15] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 2/5 | SecurityWeek reports $200 million raised in total. TechCrunch reports that the $125 million Series B valued Exaforce at $725 million, a year after its Series A. At that round Exaforce had 20 customers and disclosed no revenue or margin. The raise outruns the commercial results the record verifies, whatever the named deployments. [s17, s15, s16] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | GigaOm’s report page describes its September 2025 SecOps automation radar as including Exaforce beside Torq, Prophet Security, and Dropzone AI. TechCrunch, SecurityWeek, and SiliconANGLE place Exaforce among agentic security operations vendors, and CB Insights lists Torq, Blink, and AirMDR among its competitors. An analyst firm, a market-data firm, and the press each place the product in an emerging AI SOC category. [s24, s15, s17, s19, s23] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Singla named XDR vendors Palo Alto Networks and CrowdStrike to BankInfoSecurity as Exaforce’s most credible competition. He cited their grasp of real-time data processing and endpoint behavior. CSO Online reports that CrowdStrike launched Falcon Guardian for AI agents in September 2026. Exaforce’s knowledge graph and its managed service add friction to absorption. No structural moat that bundling could not eventually replicate appears in the reviewed sources. [s18, s21, s19, s4] |
Exaforce sells to security operations teams that cannot keep pace with alert volume by hiring. Its Series B post argues that SOCs cannot scale by adding analysts or by writing more SIEM rules. The company’s answer pairs people with AI agents, called Exabots, that carry context about the customer’s environment.
The buyer comes in two forms. A team can run the platform itself, or Exaforce analysts and Exabots can run it as the customer’s 24/7 SOC. At its Series A, Singla told BankInfoSecurity that Exaforce was focused on enterprises with over $5 billion in revenue and established SOCs. Its website now describes customers from startups to large enterprises.
Independent analysts treat the problem as a market. Latio’s June 2026 security operations report is written for teams modernizing their SOC among many AI SOC vendors. No reviewed source quantifies the analyst shortage Exaforce describes beyond the company’s own framing and its customers’ accounts. [s3, s1, s18, s25]
The Exaforce Platform runs detection, triage, investigation, and response through four Exabots. SecurityWeek describes the agents handling that lifecycle for cloud and SaaS environments. Exaforce’s homepage now lists identity, endpoint, and code coverage as well.
The data layer is the foundation. Exaforce ingests over 100 sources, including GitHub and Google Workspace, and says the platform is built to replace a SIEM. Its data platform keeps investigation data in memory and retains raw data for over a year in a data lake.
Exaforce runs three model types under the agents. The Semantic Model resolves entities by graph traversal, and the Behavioral Model scores anomalies with statistical machine learning. The Knowledge Model adds large language model reasoning, which Exaforce frames as more predictable than one general-purpose model.
Exaforce AI Security extends the platform to AI agents. It inventories agents and AI apps, ties them to people and devices, and can revoke a session or end an agent’s process. SiliconANGLE reports that it feeds model-provider and endpoint logs into the same knowledge graph. [s17, s1, s8, s7, s2, s5, s20]
Exaforce competes with AI SOC startups and with platform vendors that already sell to security teams. TechCrunch names 7AI, Dropzone AI, and Prophet Security, along with Palo Alto Networks and CrowdStrike. CB Insights lists Torq, Blink, and AirMDR among its competitors.
GigaOm places Exaforce in the same analyst field as those startups. Its report page describes the September 2025 SecOps automation radar as including Exaforce beside Torq, Prophet Security, and Dropzone AI.
Exaforce frames its edge as correlating data at ingest. Singla told BankInfoSecurity that XDR vendors Palo Alto Networks and CrowdStrike are the most credible competition. He cited their grasp of real-time data and endpoint behavior. He said Exaforce’s use of code, identity, configuration, and threat feeds sets it apart.
CrowdStrike is also a technology partner. Exaforce’s CrowdStrike page describes building on Falcon detections and running approved responses through Falcon. CSO Online reports that CrowdStrike launched Falcon Guardian for AI agents in September 2026. CrowdStrike therefore supplies detections Exaforce investigates and sells its own agent security product. [s15, s23, s24, s18, s14, s21]
Exaforce names customers across technology, healthcare, and financial services. Its website lists Replit, Guardant Health, Forcepoint, Glean, NTT Data, and SunRun among others under a trusted-by heading. TechCrunch reported in May 2026 that Exaforce had added 20 customers since its late-2025 launch, naming Replit and Guardant Health.
Case studies describe how customers use the product. Guardant Health runs Exaforce as its primary SIEM and MDR, and Forcepoint consolidated its SIEM operations into Exaforce coverage. Fuze, a stablecoin platform, adopted the MDR service instead of hiring security engineers to build a SOC.
Scale figures beyond the named customers are Exaforce’s own. The company says it grew past 130 people and processed millions of investigations across its customer base. Singla told TechCrunch he expected 40 to 50 customers by the end of the year. Exaforce also reports holding AWS Security and AI Competencies.
The go-to-market motion is expanding abroad. Exaforce says demand from Japan and Europe outpaced what it could serve from the US. It is adding regional MDR coverage and local language support. [s1, s6, s15, s10, s11, s12, s3]
Chief executive Ankur Singla is a repeat founder from cloud networking. BankInfoSecurity reports that he founded Volterra, sold it to F5 for $500 million, and then led F5’s security products group. Touring Capital, an investor, adds that he built Contrail Systems, which Juniper acquired.
Touring Capital describes the wider founding team as veterans of Palo Alto Networks, Google, F5, and Juniper. Co-founder Ariful Huq leads product. Singla’s exits are in cloud networking and application delivery, and no named security-operations product build by the founders appears in the reviewed sources.
Investors have backed the team through two rounds. HarbourVest, Peak XV, Mayfield, Khosla Ventures, and Seligman Ventures took part in the Series B. A Qualys proxy statement filed with the SEC records a Thomvest-compensated board observer on Exaforce since January 2026. [s18, s26, s6, s15, s22]
Exaforce reports HITRUST e1 certification for its Agentic SOC Platform. Its blog says the assessment covered requirements across 19 domains. It says its controls address frameworks including HIPAA, ISO 27001, SOC 2 Type II, PCI DSS, and GDPR. The platform page states that Exaforce is audited and certified against third-party standards.
Tenant isolation is part of the pitch to regulated buyers. Exaforce says every customer runs on dedicated, isolated infrastructure, which it presents as removing data-level multi-tenancy concerns. Guardant Health, per Exaforce’s case study, weighs its HIPAA and SOC 2 obligations in every vendor decision. [s9, s2, s10]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Dropzone AI | competes with | TechCrunch names Dropzone AI among the startups Exaforce competes with for security operations teams. | |
| 7AI | competes with | TechCrunch names 7AI among the startups Exaforce competes with for security operations teams. | |
| Prophet Security | competes with | TechCrunch names Prophet Security among the startups Exaforce competes with for security operations teams. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Command Zero | competes with | Competes for the same enterprise security operations buyer. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Torq | competes with | CB Insights lists Torq among Exaforce’s competitors. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Palo Alto Networks | competes with | Singla named Palo Alto Networks among the XDR vendors he sees as Exaforce’s most credible competition. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| CrowdStrike | competes with | Singla named CrowdStrike among Exaforce’s most credible competition, and Exaforce also integrates with CrowdStrike Falcon as a technology partner. |
Add analyzed competitors to compare them side by side with Exaforce.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Exaforce holds customers through its managed service and the security data it stores for them. Its MDR service puts Exaforce analysts on round-the-clock detection and response, so customers buy an operated outcome as well as software. Guardant Health runs Exaforce as its primary SIEM, which turns leaving into a migration of stored data and detections. Each customer runs on isolated infrastructure. Its HITRUST e1 certification eases procurement without blocking a replacement. BankInfoSecurity reports that Palo Alto Networks and CrowdStrike are Exaforce’s most credible competition. CrowdStrike launched its own AI agent security product in September 2026.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Exaforce sells the platform as software a team runs itself. It also sells an MDR service in which its analysts run detection and response around the clock. Guardant Health and Fuze rely on that managed service, so code and analyst expertise blend in what Exaforce delivers. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Guardant Health runs Exaforce as its primary SIEM and MDR, and Forcepoint consolidated its SIEM operations into Exaforce. Leaving would mean replacing the system that stores and searches their security logs and runs their detections. The reviewed record documents that system-of-record role but does not size a migration. The friction therefore stays at data history and integrations. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Exaforce reports HITRUST e1 certification and says its controls address frameworks including HIPAA, ISO 27001, SOC 2 Type II, and PCI DSS. A funded rival can obtain the same assurances through ordinary enterprise preparation, so they ease procurement without blocking a replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Exaforce maintains a knowledge graph built at ingestion across identity, cloud, code, and event data, per SiliconANGLE. It pairs graph traversal and statistical anomaly scoring with large language model reasoning, which is machine learning and real-time systems work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Exaforce’s buyers include regulated enterprises. Guardant Health, which carries HIPAA and SOC 2 obligations, runs it as its primary SIEM. TechCrunch independently names Guardant Health as a customer. At the Series A, Singla described a focus on enterprises with over $5 billion in revenue. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Exaforce is a security operations platform whose data layer ingests over 100 sources and can replace a SIEM. Investigation and response agents run on top of it. Security teams work in it, and the reviewed sources do not show other applications depending on it to run. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | Exaforce names detection content of over 800 condition combinations and a Knowledge Model that blends curated external intelligence with each customer’s environment. No source states what the detection content accumulates from, and no vendor-retained cross-customer asset appears in the cited sources. Singla’s stated plan to build a cybersecurity-specific AI model describes work under way, and no source shows a retained model asset. |
Exaforce sells to security teams that need SOC coverage without adding analysts. At its Series A, Singla told BankInfoSecurity the focus was enterprises with over $5 billion in revenue and established SOCs. Exaforce now says it serves businesses from startups to large enterprises across healthcare, technology, and financial services.
The two operating models reach different buyers. Teams with staff run the platform themselves, while teams without a SOC buy Exaforce MDR as their 24/7 SOC. Fuze adopted the MDR service instead of hiring security engineers. Guardant Health’s case study says an internal SOC does not make sense at its size.
Regulated buyers appear among its managed-service customers. Guardant Health carries HIPAA and SOC 2 obligations, and Forcepoint consolidated its managed security operations under Exaforce. TechCrunch independently names Guardant Health as a customer.
Exaforce’s claimed advantage is building context before an alert fires. SiliconANGLE reports that Exaforce builds its knowledge graph at ingestion, linking events, identities, permissions, configurations, code, files, and cloud activity. The company claims answers in under a minute, a tenfold reduction over query-time approaches.
The model design separates deterministic steps from language model reasoning. Graph traversal resolves entities and statistical machine learning scores anomalies before the Knowledge Model reasons over them. Exaforce’s Series B post describes most rival products as wrappers around frontier models.
The performance figures are Exaforce’s own. SiliconANGLE attributes the speed claim to the company, and no third-party benchmark of detection accuracy appears in the reviewed sources. Exaforce AI Security applies the same graph to AI agents. Analyst Avivah Litan told CSO Online that passive, agentless oversight is weaker for runtime blocking.
Exaforce built the product with design partners before scaling sales. Singla told BankInfoSecurity he would perfect the product with design partners before scaling commercialization. TechCrunch reports that the product reached market in the fourth quarter of 2025 after two years of design-partner testing.
Named customers followed. TechCrunch reported 20 customers added by May 2026, naming Replit and Guardant Health. Exaforce lists more under a trusted-by heading on its website. Forcepoint, one of those customers, describes itself in its case study as a design partner.
The Series B funds regional expansion. Exaforce is scaling go-to-market in Japan and Europe with regional MDR coverage and local language support. It also reports AWS Security and AI Competencies, which place it in AWS’s partner program.
Exaforce publishes no prices on its homepage, platform, or MDR pages. Its homepage invites buyers to book a session with a product expert against scenarios that resemble their environment.
The two operating models suggest two ways to buy. A self-run platform resembles a software subscription, while the MDR service replaces analysts the buyer would otherwise hire. Fuze, for example, chose the MDR service over hiring two to three security engineers.
Singla framed the value for BankInfoSecurity as more security work inside the CISO’s current budget. The reviewed sources do not state the unit Exaforce charges by.
Exaforce delivers the same platform two ways. A customer’s team can run it, or Exaforce analysts run it 24/7 while the customer keeps full access. The MDR page says every data source, investigation, dashboard, and automation the analysts use is open to the customer.
Response runs through the customer’s existing tools. The MDR service draws on a library of over 200 automated response actions. With configured workflows, Exaforce can contain devices and run approved actions through CrowdStrike Falcon.
Deployment can start beside an existing SIEM. Exaforce says many teams offload high-volume sources such as IaaS logs to it while keeping their SIEM. Guardant Health went further and made Exaforce its primary SIEM and MDR.
Exaforce reports HITRUST e1 certification for its Agentic SOC Platform. Its blog says the assessment covered requirements across 19 domains. It says its controls address frameworks including HIPAA, ISO 27001, SOC 2 Type II, PCI DSS, and GDPR. The platform page states that Exaforce is audited and certified against third-party standards.
Exaforce isolates each customer’s environment. It says every customer runs on dedicated, isolated infrastructure, which it presents as removing data-level multi-tenancy concerns. Guardant Health, per Exaforce’s case study, weighs its HIPAA and SOC 2 obligations in every vendor decision.
Exaforce positions its data layer as the base for the rest of a SOC’s work. It ingests over 100 sources, including GitHub and Google Workspace, and says the platform is built to replace a SIEM.
Exaforce also builds on other vendors’ tools. Its CrowdStrike partner page describes investigating Falcon detections and running approved responses through Falcon. Its data platform can also run beside an existing SIEM.
Exaforce AI Security widens the data Exaforce collects. It adds OpenAI, Gemini, and Microsoft Copilot to an earlier Claude Compliance API integration. CSO Online reports that Exaforce gathers this data without a new gateway, browser extension, or endpoint agent.
Chief executive Ankur Singla is a repeat founder from cloud networking. BankInfoSecurity reports that he founded Volterra, sold it to F5 for $500 million, and then led F5’s security products group. Touring Capital, an investor, adds that he built Contrail Systems, which Juniper acquired.
Touring Capital describes the wider founding team as veterans of Palo Alto Networks, Google, F5, and Juniper. Co-founder Ariful Huq leads product. Singla’s exits are in cloud networking and application delivery, and no named security-operations product build by the founders appears in the reviewed sources.
Investors have backed the team through two rounds. HarbourVest, Peak XV, Mayfield, Khosla Ventures, and Seligman Ventures took part in the Series B. A Qualys proxy statement filed with the SEC records a Thomvest-compensated board observer on Exaforce since January 2026.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Exaforce homepage: Agentic SOC Platform and MDR | official | 2026-09-22 |
| f2 | SiliconANGLE: Exaforce Series B report | press | 2026-09-22 |
| f3 | CB Insights: Exaforce company profile | research | 2026-09-22 |
| f4 | SecurityWeek: Exaforce Series B report | press | 2026-09-22 |
| f5 | TechCrunch: Exaforce Series B report | press | 2026-09-22 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.