Maro

• Secure-browser and network-security vendors already selling to the same buyer could ship employee AI-usage coaching and prompt-level data-loss controls as platform features, folding Maro's standalone value into suites the buyer already owns.
• Vendors of security awareness training and human-risk management could add real-time browser interventions and compete for the same budget line with far larger installed bases.
• AI usage in native desktop apps and through APIs bypasses a browser-extension control point, so rivals with endpoint or network coverage could position Maro's visibility as partial.
• Maro's evidenced customers are mid-market firms on its own site. If referenceable enterprise deployments do not appear, the company competes on price in a segment where incumbents can bundle.

Maro targets the human side of security failures: employees pasting sensitive data into AI chatbots, falling for browser-level deception, and working around policies nobody enforces in the moment. The vendor frames the problem with Verizon's 2025 Data Breach Investigations Report, which it cites for breaches involving a human element at 60%, and argues that awareness training and static policy cannot reach an employee at the moment of a risky decision.

The company says it developed the product with input from 50 CISO and CIO leaders in financial technology, healthcare technology, and retail, who ranked ungoverned AI usage as the most pressing human risk factor, ahead of targeted social engineering and insider risk. That input process is vendor-run, so it evidences problem framing rather than independent demand. The buyer Maro names is the security leader who must let employees use AI tools without losing oversight. [s4, s8]

The product is a browser extension paired with a security-team console. The extension observes employee activity in the browser, classifies the intent and business context of each AI interaction, and intervenes in real time: coaching the employee toward a safer action or blocking the risky one. The console gives security teams usage insight down to the business case and prompt, decision traces for violations, policy management with team-level exceptions, and weekly governance reporting.

The marketing pages describe the mechanism concretely (out-of-the-box AI policy and sensitive-data detectors, context graphs across people, apps, actions, and data) and the vendor displays a Patent Pending badge, but the public record carries no documentation portal, sandbox, or independent technical evaluation of detection quality. Use cases the vendor names beyond AI governance include data loss prevention, insider risk, browser protection against clickjacking and typosquatting, and security behavior and culture programs. [s1, s2, s4, s12]

Maro competes for buyers who are already offered several ways to govern employee AI use, and it differentiates by leading with behavior: the extension is positioned as a coach that shapes what employees do, a replacement for awareness training, rather than another traffic filter.

The company brands this position as cognitive security, its own label. The label straddles two budget lines a buyer already recognizes, human risk management and AI governance, which gives Maro two doors into an account and two sets of incumbents that could absorb its capability as a feature. [s2, s4, s11]

Maro publishes its prices and lets small buyers purchase by credit card, which is uncommon in security. The 5 dollar per user per month visibility plan and the 10 dollar enforcement plan check out through Stripe, while the 25 dollar managed plan and the operated governance program at 10,000 dollars or more per month route through sales. The vendor also announced a partnership with Goliath Cyber Security Group in May 2025, a channel signal.

Evidenced traction is early and vendor-published: homepage testimonials whose speakers pair with Newbury Partners, PDG, and Coral AI, alongside STC Health and Elevate customer logos, including a chief executive crediting Maro as AI adoption grew from 5% to 20% in a few months. No independent reporting corroborates customer scale, and press coverage in the record is limited to the seed announcement. [s1, s3, s5, s8]

The founding team is the strongest fact in Maro's record. CTO Jen Andre founded Komand, which Rapid7 acquired, and co-founded Threat Stack, which F5 acquired in a deal TechCrunch reported at 68 million dollars. CEO Jadon Montero led MDR product at Bitdefender and SOAR product at Rapid7, and Gwen Betts led UX at Rapid7 and was on Komand's founding team. The three have worked together before, across Rapid7 and Komand.

The advisory bench is broad for a seed company: the about page lists product, engineering, and security leaders from established security and technology companies as advisors. A 4.3 million dollar seed from Downing Capital Group is modest against this pedigree. [s4, s5, s10, s8]

Maro publishes a Secureframe-hosted trust center reporting a SOC 2 Type 1 attestation with continuous monitoring, and the homepage badge states SOC 2 Type I complete with Type II pending. That is a credible posture for a company selling monitoring of employee behavior, where buyers will probe privacy handling before deployment.

The legal entity behind Maro is Cyberlume, Inc., with New York governing law in its terms of service and the application served from app.seekmaro.com. For a product that observes employee activity in the browser, the trust collateral is table stakes rather than differentiation, and enterprise buyers will likely wait for the Type II report the vendor says is pending. [s1, s6, s7]

Add analyzed competitors to compare them side by side with Maro.

Maro segments by role rather than by industry: the buyer is the security leader accountable for human risk and AI adoption, and the user is every employee with a browser. The vendor built the product with input from 50 CISO and CIO leaders in financial technology, healthcare technology, and retail, which signals regulated industries as the intended center of gravity.

The published pricing widens the addressable range in both directions. A 5 dollar per user self-service plan could reach smaller teams and buyers avoiding a formal sales process, while the operated governance program at 10,000 dollars or more per month targets organizations that want an AI governance function without hiring one. The cited customer evidence does not establish large-enterprise traction.

The core capability is real-time classification of employee intent and business context in the browser. The extension observes activity, matches it against out-of-the-box AI policy and sensitive-data detectors, and intervenes at the moment of a risky action with guidance or a block. The console adds usage insight down to the business case and prompt, decision traces for violations, team-level policy exceptions, and weekly governance reports.

AI is the method here, not just the subject: Maro uses machine classification to read what an employee is trying to do, which the vendor contrasts with static rules. The vendor displays a Patent Pending badge for the approach. The public record carries no documentation portal, benchmark, or third-party technical evaluation, so detection quality rests on vendor description, and the site's own sitemap lists marketing and blog pages with no documentation portal path.

Maro runs a two-speed go-to-market. The bottom of the funnel is self-service: the visibility and enforcement plans check out through Stripe at 5 and 10 dollars per user per month, so a security lead can deploy without a sales call. The managed plans route through sales, and a May 2025 partnership announcement with Goliath Cyber Security Group signals channel intent, its shape undescribed in the cited page.

Demand generation leans on content: a blog about AI governance and human risk, plus a newsletter and webinar series aimed at security practitioners. Evidenced traction is vendor-published testimonials paired with the customer names Newbury Partners, PDG, and Coral AI, including a chief executive crediting Maro as AI adoption grew from 5% to 20% in a few months. Independent corroboration of customer scale has not yet appeared.

Maro charges by the user per month, the same unit in which the buyer experiences the problem, since every employee is a potential source of risky AI usage. Published tiers run 5 dollars (visibility), 10 dollars (real-time enforcement), and 25 dollars (Maro's team manages policy and triage), each with a 20% discount for annual billing.

The top tier breaks the per-user model: Managed Maro Complete is an operated AI governance program at 10,000 dollars or more per month, including a dedicated virtual chief AI officer. Publishing prices at all, let alone a services program with a sticker price, is a transparency posture that fits the self-service motion and lets a buyer size the spend before any sales conversation.

Delivery is SaaS plus a browser extension, and the vendor leans on how light the deployment is: one click and a simple sign-in for employees, ready-made policies that cover top AI risks on day one, and tuning to business context afterward. The application itself is served from app.seekmaro.com.

At the managed tiers, delivery becomes an operation Maro runs: continuous policy management, critical alert triage and escalation by the company's FLARE team, and automated weekly AI usage briefings. That operated layer means Maro's own capacity to staff and scale service delivery, not just its software, determines how many managed customers it can carry. The vendor claims customers improve CIS coverage by 52% in as little as a week, a vendor-published figure without independent verification.

For a product that watches employee behavior in the browser, trust is a gating question, and Maro's posture is credible for its stage. The homepage badge states SOC 2 Type I complete and SOC 2 Type II pending, and a Secureframe-hosted trust center reports the SOC 2 Type 1 attestation with continuous control monitoring.

The corporate structure is plain in the legal pages: the entity is Cyberlume, Inc., operating as Maro, with New York governing law. The cited terms discuss deidentification, while deeper privacy handling of observed employee activity sits in a privacy policy the cited record does not include, and the SOC 2 Type II report remains pending.

The ecosystem story is early. The browser is Maro's platform dependency: the product lives as an extension, so distribution and capability both ride on what browser vendors allow extensions to see and do. Browser makers could change what extensions may observe, or ship native AI usage controls, and either move could reshape Maro's position.

Outbound, the record shows one channel relationship, the Goliath Cyber Security Group partnership announced in May 2025, and the public site names no integration catalog or public API. A documentation portal did not appear in the sitemap either, so integration depth cannot be assessed from public sources.

The founding trio has worked together before, and its CTO carries two exits: Jen Andre founded Komand, acquired by Rapid7, and co-founded Threat Stack, acquired by F5 for 68 million dollars. CEO Jadon Montero led MDR product at Bitdefender and SOAR product at Rapid7, and CXO Gwen Betts led UX at Rapid7 after serving on Komand's founding team.

The about page lists a chief of staff and an advisory bench of product, engineering, and security leaders from established security and technology companies. The public record does not yet show the operating team behind the founders, which matters for a company selling judgment-heavy managed governance services.