All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Legion Security sells AI software to enterprises with in-house security operations teams. Its browser extension records how analysts investigate alerts so AI agents can repeat that work in any browser-based tool, with or without human supervision. Founded in 2024, Legion has raised $38 million, including a $30 million Series A led by Coatue. Calcalist reported in July 2025 that Legion employed 25 people. Its named customers include Virgin Money, WELL Health Technologies, the University of Tulsa and IQ-EQ. The workflows Legion learns from a customer’s analysts could make leaving costly, and Legion does not document whether they can be exported. Google and CrowdStrike, whose marketplaces list Legion, could build similar automation themselves.
| Description | Legion Security sells a security operations platform that watches how analysts investigate alerts in the browser, learns the team's process, and runs those investigations as agent workflows with human oversight or autonomously. | [f1] |
|---|---|---|
| Founded | 2024 | [f2] |
| HQ | Tel Aviv, Israel | [f3] |
| Funding | $38M total | [f4] |
| Latest funding | Series A, $30M, led by Coatue (July 2025), joining Accel and Picture Capital | [f5] |
| Product | What it does |
|---|---|
| Legion | A browser extension that observes analyst investigations across browser-accessible security tools, learns the team's workflows, and executes investigations in learning, guided, or autonomous modes. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Legion's browser extension learns how analysts investigate alerts across SIEM, threat intel, and email tools, then investigates and responds to threats through those tools. Legion applies AI to defend conventional assets and is mapped to the Cyber Defense Matrix. [f2]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Legion names a specific buyer, enterprise security operations teams and the leaders who run in-house SOCs, and a specific pain, alert volume that outruns the analysts available. Calcalist quantifies the staffing gap at 26 to 45 percent of needed personnel and SC Media describes rising alerts against scarce analysts, so the pain is real and corroborated, but only one independent source puts a number on it. [s3, s9, s11] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Legion documents its workflow capture, its three operating modes and its agent internals in concrete detail, including an indicator-indexing method that Legion reports improved output validity from about 80 percent to 100 percent across 100 evaluation runs. The outside accounts relay the company’s own description, and the captured sources carry no third-party technical evaluation, open code or customer-written technical account that rung 4 would credit. [s5, s7, s17, s6] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Legion was founded in 2024 to apply vision models and frontier language models to recorded analyst work, a credible enabler for automating investigations. Buyer-side demand in the record is indirect: an SC Media award in March 2026, an Optiv channel partnership Legion announced in June 2026, and adoption figures that originate with the company, with no analyst category note, RFP language or budget-line signal. [s7, s6, s11, s15] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Calcalist reports that Ely Abramovitch and Michael Gladishev held senior roles on Microsoft Sentinel’s team and that Eyal Fisher brings AI research from the University of Cambridge, and Fortune reports Abramovitch spent nearly five years managing Sentinel. That is one named in-domain product build, shared by two founders, with no prior exit or sustained publication record in the cited sources. [s9, s8, s2] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | Legion's homepage names security leaders at Virgin Money, WELL Health Technologies, the University of Tulsa and IQ-EQ with results (s1), and its Virgin Money case study reports the alert backlog cut by 60% in under two months (s14). Legion lists on the CrowdStrike Marketplace (s18) and became an Optiv Authorized Partner (s15). All of these are Legion's own publications. SC Media's award write-up reports fourfold revenue growth with no base figure (s11), so no independent source corroborates the scale of these customers or channels and the score is 3. [s1, s14, s18, s15, s11] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | Legion raised $38 million, an $8 million seed and a Coatue-led $30 million Series A announced in July 2025, and now has Google Cloud and CrowdStrike marketplace listings and the DragonClaw orchestration layer. The raise fits an enterprise sales motion that keeps shipping, while no disclosed revenue figure or margin confirms output per dollar. [s9, s3, s18, s12] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | SecurityWeek describes Legion as an AI security operations center platform and SC Media’s award describes its AI SOC analyst, so press and an awards program place it among AI SOC tools. Legion now markets itself as an agentic security operations platform, its own label in a forming category, and the captured sources carry no analyst category placement. [s6, s11, s12] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Legion’s per-customer learning and its browser-based reach into tools without APIs add friction to absorption, because a platform vendor would need to learn each team’s own workflows. Legion sells through CrowdStrike’s and Google’s marketplaces, whose operators could eventually reproduce its customer-specific automation. [s3, s8, s18, s22] |
Legion Security sells to enterprise security operations teams whose alert volume outruns the analysts available to investigate it. The company says it built the product for CISOs, SOC directors and security operations managers at organizations running in-house SOCs. Calcalist reports that SOC teams typically lack between 26 and 45 percent of the personnel they need, and SC Media describes alert volumes rising while experienced analysts remain scarce.
Legion frames the gap as one of knowledge as well as headcount. Its homepage argues that tribal knowledge lives in the heads of analysts and that customized, homegrown and legacy tools are hard to integrate. CEO Ely Abramovitch told Fortune that his customers at Microsoft Sentinel had very little automation in place.
The Virgin Money case study shows the problem at one bank. Legion’s account says Virgin Money faced a backlog of around 50,000 alerts against a security team of about 200 people. [s3, s9, s11, s1, s8, s14]
Legion is a browser extension that records how a security team investigates alerts and turns that work into workflows its AI agents run. SiliconANGLE describes three modes: a learning mode that shadows senior analysts, a guided mode that performs tasks under supervision, and an autonomous mode. Legion says each learned investigation becomes an editable workflow that can be automated when the team is ready.
The product works through the browser instead of through vendor APIs. Legion says it reaches threat intel platforms and legacy internal tools without API configuration, and SecurityWeek reports it works with email, SIEM, threat intel and homegrown systems. Analysts can restrict which tools it touches and mask sensitive data during sessions, according to SiliconANGLE.
Legion added DragonClaw in July 2026, an orchestration layer that lets analysts and security leaders invoke its agents in plain language. Its release says DragonClaw asks for explicit permission before executing an action and uses only approved tools and credentials from secure vaults. The release says DragonClaw is available to existing customers.
Legion publishes engineering detail on its agents. A May 2026 post describes an indicator-indexing method it reports took valid structured output from about 80 percent to 100 percent across 100 evaluation runs. [s7, s3, s6, s12, s13, s5]
Legion competes with AI SOC vendors that automate alert investigation for the same enterprise security team. Prophet Security’s homepage describes AI agents spanning alert investigation and response, threat hunting and detection engineering, connected through more than 200 integrations. Dropzone AI’s homepage describes an AI SOC analyst that investigates alerts end to end and connects to the tools a team uses.
Legion’s stated difference is where it connects. Legion argues that most security automation platforms stall on integrations, while its browser-based approach reaches whatever an analyst can open, including homegrown tools. It also says it learns from each team’s own investigations, playbooks, runbooks and past cases.
The large SOC platforms are both rivals and channels. Fortune contrasts Legion with Palo Alto Networks, Microsoft Sentinel and CrowdStrike, which detect threats at the network, server and endpoint layers. Legion now lists its product on the CrowdStrike and Google Cloud marketplaces and calls itself a Google Ecosystem Partner. [s19, s20, s3, s8, s18, s22]
Legion names its customer results through security leaders’ statements on its own site. Its homepage quotes leaders at Virgin Money, WELL Health Technologies, the University of Tulsa and IQ-EQ. WELL Health Technologies’ CISO credits it with an 81 percent cut in investigation and response time on its most common use case.
A Virgin Money case study published by Legion gives the most detailed account. It says Legion processed 30,000 backlogged alerts in under two months, cutting the bank’s backlog from about 50,000 to 20,000. Legion’s Marketplace post adds a large insurance organization that automated 24,000 investigations.
Coverage outside the company carries Legion’s account. SecurityWeek reported adoption among Fortune 500 organizations in energy, finance and healthcare, and Fortune quoted the CEO on dozens of customers. SC Media’s 2026 award write-up reports fourfold revenue growth since launch and Fortune 500 customers in insurance, finance and retail.
Legion sells through partner channels as well as directly. It listed on the Google Cloud Marketplace in May 2026, lists on the CrowdStrike Marketplace, and announced in June 2026 that it had become an Optiv Authorized Partner. [s1, s14, s3, s6, s8, s11, s18, s15]
Legion’s founders come from Microsoft Sentinel and academic AI research. Calcalist reports that CEO Ely Abramovitch and VP of R&D Michael Gladishev held senior roles on Microsoft Sentinel’s team, and that CTO Eyal Fisher brings an AI research background from the University of Cambridge. Fortune reports Abramovitch spent nearly five years managing Sentinel before starting Legion in 2024.
The investors include security operators as well as venture funds. Coatue led the $30 million Series A, with Accel and Picture Capital, which led the earlier seed. Fortune reports that Picture Capital is run by Island co-founders Michael Fey and Dan Amiga and Transmit Security CEO Mickey Boodaei.
At the July 2025 funding announcement, Calcalist reported that Legion employed 25 people split between Israel and New York. [s9, s8, s2, s1]
Legion’s product reads and acts inside the security tools an analyst opens, so a buyer’s review starts with data handling and oversight. SiliconANGLE reports that analysts can restrict where Legion operates, mask sensitive data during sessions and audit every action. Legion says it shows what it plans to do, does it, and logs every step.
Legion publishes its assurance through a SafeBase trust center. The trust center lists HIPAA, ISO/IEC 27001:2022, ISO/IEC 42001:2023, SOC 2 Type 2 and CSA STAR Level 1, and invites buyers to request access to its SOC 2, HIPAA and penetration-test reports.
Legion also stages autonomy and records its work. SiliconANGLE describes a progression from observation to full automation, and Legion’s published guide to SOC automation says every action it takes is recorded with screenshots of the screens it read, so a team can check how it reached a conclusion. [s7, s1, s4, s14]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Prophet Security | competes with | Competes for the same enterprise SOC team with AI agents that investigate and respond to alerts, a comparison Prophet Security’s own homepage supports. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Dropzone AI | competes with | Competes for the same SOC alert-investigation budget, with an AI SOC analyst that Dropzone AI’s homepage says investigates alerts end to end. | |
| Radiant Security | competes with | Competes for the same enterprise SOC buyer that Legion targets with automated alert investigation. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Microsoft | competes with | Owns Microsoft Sentinel, the SOC platform two Legion founders worked on and one that Fortune contrasts with Legion. | N/AMicrosoft is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| CrowdStrike | competes with | Named by Fortune among the SOC platforms Legion differs from, and also a channel, since Legion lists on the CrowdStrike Marketplace. |
Add analyzed competitors to compare them side by side with Legion Security.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Legion Security learns automation inside each customer, recorded from that team’s investigations and past cases. A team that leaves could face rebuilding that tuned automation elsewhere, and Legion does not document whether it can be exported or how long a replacement would take to relearn it. Its agents reason with Gemini models from Google Cloud, so the underlying model comes from a vendor Legion does not control. Legion sells through the Google Cloud and CrowdStrike marketplaces and through Optiv, which gives it routes into accounts those firms already serve.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Legion sells software the customer installs and runs, and the customer’s team operates it and owns the investigation outcomes, granting autonomy in stages. Legion became an Optiv Authorized Partner and points to advisors such as Optiv to help enterprises evaluate fit and plan implementation. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Legion accumulates each customer’s learned workflows and a persistent memory of past cases and analyst feedback, which could make leaving costly for a team that relies on that automation. The cited sources describe the memory without specifying whether customers can export it or how long relearning would take. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Legion’s trust center lists SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 42001:2023, HIPAA and CSA STAR Level 1, attestations that ease enterprise security reviews. A funded competitor can obtain the same set through ordinary preparation, and the cited record shows no product-specific mandate or authorization that would block a replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Legion learns investigations by applying vision models to recorded analyst sessions and runs them through AI agents across heterogeneous browser tools. Its published work on indexing indicators so agent output stays valid, and its per-tenant evaluation of language models on triage decisions from eight customers’ investigations, show sustained ML engineering. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Legion is built and sold for enterprises running in-house SOCs, and its named customers include Virgin Money, a UK retail bank, and WELL Health Technologies, with SC Media reporting Fortune 500 customers in insurance and finance. Those are regulated-enterprise buyers of the scored product itself. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Legion is a platform that runs investigations and orchestrates agents across a customer’s existing security tools, writing results back into systems such as Google SecOps. It runs alongside the tools it automates, and the cited record does not show other applications’ requests passing through Legion before they proceed. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | The retained assets the record names are per-customer: each team’s learned workflows and a persistent memory built from its own cases. Legion’s model evaluation ran per customer tenant without mixing customer data, the reasoning runs on Google’s Gemini models, and no vendor-retained dataset, content licence or granted patent appears in the cited record. |
Legion Security sells to large enterprises that run their own security operations centers. The company says it built the product for CISOs, VPs of information security, SOC directors and security operations managers at organizations running in-house SOCs. Its buyer is the team that owns alert investigation.
Legion’s homepage quotes security leaders at Virgin Money, a UK retail bank, at WELL Health Technologies, at IQ-EQ and at the University of Tulsa. SecurityWeek reported Fortune 500 adoption in energy, finance and healthcare at launch, and SC Media’s 2026 award write-up names Fortune 500 customers in insurance, finance and retail.
Legion also sells to buyers through the platforms they already use. It lists on the Google Cloud Marketplace, where spend counts toward a customer’s annual Google contract, and on the CrowdStrike Marketplace, and it became an Optiv Authorized Partner, citing Optiv’s work with organizations that have complex security programs.
Legion’s product learns a team’s investigations from inside the analyst’s browser and turns them into workflows its AI agents run. It uses vision models and a browser extension to record how analysts work, and SiliconANGLE describes a progression from a learning mode to a guided mode to an autonomous mode. Legion says each learned investigation becomes an editable workflow.
Legion publishes concrete engineering detail on its agents. A May 2026 post describes indexing indicators of compromise so the model reuses compact references, which Legion reports took valid structured output from about 80 percent to 100 percent across 100 evaluation runs. A separate post describes an evaluation of language models on decisions drawn from eight US customers’ investigations, run per customer tenant without mixing customer data.
The reasoning runs on outside models. Legion’s Google partnership page says the product is powered by Gemini, and its Marketplace post says each workflow is executed by agents built on Google’s Gemini models. What Legion accumulates is each customer’s workflows and a per-customer memory of past cases, which the company describes as improving with every investigation.
Rival AI SOC vendors describe a different connection model. Prophet Security and Dropzone AI both describe connecting to a customer’s existing tools, Prophet through more than 200 integrations, while Legion markets working through the browser with no integrations.
Legion sells to enterprises directly and through partners. It presents results through named customer leaders on its homepage and a Virgin Money case study, which reports that Legion processed 30,000 backlogged alerts in under two months.
Partner channels widened in 2026. Legion listed on the Google Cloud Marketplace in May 2026, announced in June 2026 that it had become an Optiv Authorized Partner, and lists on the CrowdStrike Marketplace. In July 2026 it launched DragonClaw, an orchestration layer currently offered to existing customers.
Outcome figures come from Legion and its customers. Legion says a large insurance organization automated 24,000 investigations and cut mean time to respond from 20 minutes to 2. SC Media’s award write-up reports fourfold revenue growth since launch, without a base figure.
Legion publishes no price on the captured pages. Buyers reach it through direct sales, the Google Cloud and CrowdStrike marketplaces, and Optiv.
The Google Cloud Marketplace listing is the clearest commercial term in the record. Legion says customers can apply their spend toward their annual Google contract and simplify procurement, which lowers purchasing friction for Google Cloud customers.
Model consumption is a cost Legion engineers against. Its May 2026 indicator-indexing post says raw indicators inflate token costs and break structured output, and it describes the indexing method as the fix.
Legion delivers its product as a browser extension that works without connectors. Legion says its browser-based approach reaches threat intel platforms and legacy internal tools without API configuration, and that most security automation platforms stall on months of API work and custom connectors. SecurityWeek reports it works with email, SIEM, threat intel and homegrown systems.
Oversight controls are built into how the product runs. SiliconANGLE reports that analysts can configure when and where Legion operates, restrict its access to tools and mask sensitive data. Legion says every action it takes is recorded with the evidence behind it, including screenshots of the screens it read.
The platform runs on Google Cloud infrastructure and Gemini models, according to Legion. DragonClaw adds agents that can take actions, and Legion says those actions require explicit permission and use only approved tools and credentials pulled from secure vaults.
Legion’s access to analysts’ tools makes trust an early question in a buyer’s review. The extension observes and acts in the security tools a team permits, so data handling and oversight carry the evaluation.
Legion publishes its assurance through a SafeBase trust center. It lists HIPAA, ISO/IEC 27001:2022, ISO/IEC 42001:2023, SOC 2 Type 2 and CSA STAR Level 1, and invites buyers to request access to SOC 2, HIPAA and penetration-test reports.
Human control is the trust argument Legion leads with. Legion says it shows what it plans to do, does it and logs every step, and SiliconANGLE reports that security teams retain the final say over what Legion learns and deploys.
Legion builds its platform position at the workflow layer above a customer’s existing tools. It runs investigations through the tools analysts already open, and its Google partnership page says it writes results back into Google SecOps without replacing the existing setup.
Google is its deepest ecosystem tie. Legion calls itself a Google Ecosystem Partner, runs on Google Cloud infrastructure, uses Gemini models and lists on the Google Cloud Marketplace. Its CrowdStrike page adds a second marketplace and positions Legion as a way to standardize advanced use of CrowdStrike’s Falcon platform across a team.
DragonClaw extends the platform toward security leaders. Legion’s release describes it as an orchestration layer that lets analysts and leaders invoke Legion’s agents, and SecurityBrief reports it is aimed at analysts and leaders who query systems or trigger actions in natural language.
Legion’s founders combine Microsoft Sentinel experience with AI research. Calcalist reports that CEO Ely Abramovitch and VP of R&D Michael Gladishev held senior roles on Microsoft Sentinel’s team, and that CTO Eyal Fisher brings AI research from the University of Cambridge. Fortune reports Abramovitch spent nearly five years managing Sentinel.
Calcalist reported 25 employees split between Israel and New York at the July 2025 funding announcement.
The backers include security operators. Coatue led the Series A, and Fortune reports that Picture Capital, a seed co-lead, is run by Island’s co-founders and Transmit Security’s CEO.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | https://www.legionsecurity.ai/ | official | 2026-10-04 |
| f2 | SecurityWeek: Legion Emerges From Stealth With $38 Million in Funding | press | 2026-10-04 |
| f3 | PR Newswire: Legion Security Launches DragonClaw (company release) | official | 2026-10-04 |
| f4 | SiliconANGLE: Legion raises $38M to automate SOC workflows through browser-native AI | press | 2026-10-04 |
| f5 | Calcalist: Legion raises $30M Series A to train AI on how security teams work | press | 2026-10-04 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.