Native Security

• Wiz, Orca Security, and Palo Alto Networks are extending cloud posture products toward remediation. If their enforcement reaches parity before Native confirms reference customers, the differentiation narrows to simulation safety.
• AWS could fold intent-based multi-account enforcement into its own console, and the Security Hub Extended relationship gives it full visibility into Native's traction. The same channel that validates the company could absorb its single-cloud value.
• Press coverage names customers only by sector, and the homepage testimonials from named security leaders still need confirming as paying customers rather than advisors. If that confirmation does not arrive by mid-2027, go-to-market progress has not kept pace with the $42 million raise.
• Enforcement artifacts persist in the customer's cloud and can export as code, so a customer could complete initial hardening and then operate the guardrails without Native, capping renewal revenue.
• CTech reports plans to grow from 41 to around 90 employees by the end of 2026. Doubling headcount before confirmed reference proof exists would repeat the premature-scaling pattern if references do not materialize.

Native Security targets enterprises that run security across several clouds at once. The company argues that AWS, Azure, Google Cloud, and OCI already ship strong security primitives, and that customers struggle to operationalize them consistently, which leaves posture tools reporting problems that nobody converts into preventive controls. The homepage states the thesis directly, that the industry has gotten good at finding risks in the cloud and now needs to build defenses.

Independent coverage corroborates the gap in its own voice. CTech writes that the product addresses the accelerating pace of change in cloud and AI infrastructure, and Dark Reading frames the platform around keeping controls consistent when teams lack deep expertise in every cloud environment they use.

The urgency argument depends on attacker speed and arrives through interested voices. The launch release cites Google's Mandiant finding that average time-to-exploit hit minus one day in 2024, and Ballistic, the lead investor, repeats the same figure, so the quantified pain is third-party research curated by the vendor rather than buyer-side evidence. [s1, s8, s10, s12, s13]

Native discovers the estate before it enforces anything. The platform page describes a live topology of every account, workload, identity, and resource, with zones auto-discovered and actors mapped, which the product then uses as the basis for control decisions.

Intent translation is the core mechanism. A security team states an outcome such as no path from the public internet to regulated data, and Native generates the provider-specific enforcement, service control and resource control policies on AWS, network security perimeters on Azure, organization policies with VPC Service Controls on Google Cloud, and security zones on OCI. Teams can deploy guardrails directly, export them as code, or follow guided implementation.

Safety tooling addresses the reason enterprises fear preventive controls. Dark Reading describes pre-deployment impact simulation, intelligent rollout strategies, and built-in approval workflows, and the platform page details replaying historical cloud activity to model enforcement impact, plus post-deployment visibility into blocked actions. Drift detection and managed exceptions keep installed controls aligned over time.

Public technical depth stops at structured marketing. The site offers no public documentation portal, and trial access runs through AWS Security Hub Extended, where every activating AWS customer gets a 30-day free trial with full product access, rather than through a general website signup. Capability assessment therefore depends on the platform page and press briefings. An AI enforcement pillar extends the same model to managed AI services, governing which services and models can be provisioned across AWS Bedrock, Azure AI Foundry, and GCP Vertex AI. [s2, s1, s10, s5]

Native positions against the detect-and-react cycle rather than against a named vendor. The homepage dismisses inspecting the cloud and telling teams to fix what is wrong as reactive, and the company's blog sharpens the claim into a category argument, that seeing and detecting is mature and enforcement is what comes next.

The crowded side of the market is detection. Wiz, Orca Security, and Palo Alto Networks sell cloud-native application protection platforms that find and prioritize risk, and each is extending toward remediation. Native's bet is that enforcement through the providers' own control frameworks, simulated before deployment so it does not break production, is a different engineering discipline from generating fixes for findings. Sonrai Security's permissions firewall runs the nearest enforcement-first motion, scoped to identity.

The hyperscalers are partners, channel, and latent competitors at once. Native distributes through the AWS and Google Cloud marketplaces and joined AWS Security Hub Extended, while each provider also builds the single-cloud version of the same enforcement. Cross-cloud equivalence is the structural defense, because no provider has an incentive to operationalize a competitor's controls. [s1, s5, s10, s2]

Customer evidence is substantial in description and not yet confirmed at the named level. The press release and CTech report Fortune 100 organizations in finance, technology, and media, and Ballistic, the lead investor, describes deployments at a major global streaming service and a major chip manufacturer. The homepage now carries video testimonials from named security leaders, including Drew Robertson, CISO and CIO at Renaissance Learning, and Huy Li, Head of Global IT Infrastructure and Security at Monolith Power Systems, whose status as paying customers rather than advisors still needs confirming.

Distribution leans on the cloud providers themselves. Native lists on the AWS and Google Cloud marketplaces, both linked from the site footer, and in May 2026 the company announced availability through AWS Security Hub Extended, which puts procurement in the AWS console with pay-as-you-go pricing on the AWS bill. Amit Megiddo writes that AWS selected two vendors for the cloud security category, a curation the company presents as validation.

Founders front the selling at a stage where that fits. Megiddo authors the company blog and is the quoted voice across the launch coverage, and CTech reports plans to grow from 41 people to around 90 employees by the end of 2026, which implies the commercial organization is still forming underneath the founders. [s12, s8, s13, s1, s5, s6]

The founders previously built the controls Native now operationalizes. Amit Megiddo led product for Amazon GuardDuty, Gal Ordo led AWS Security Hub, and Eyal Faingold was VP of R&D at Dome9 and then led the cloud security portfolio at Check Point, roles that GeekWire, CTech, and Dark Reading each state in their own voice. The match between résumé and product is as direct as it gets in this category.

Senior endorsement around the company is dense for a Series A. Phil Venables, former CISO of Google Cloud, joined the board, and CTech lists Zohar Alon of Dome9, Doug Merritt of Aviatrix and formerly Splunk, and Udi Mokady of CyberArk among investors and advisors. The press release says the 41-person team draws from the major cloud providers, Israeli military cyber units, and companies including Palo Alto Networks, Lacework, Axonius, and Cyera. [s9, s8, s10, s12, s13]

Trust collateral matches what enterprise procurement screens for. Native runs a SafeBase trust center listing SOC 2 Type 2 and ISO/IEC 27001 alongside GDPR, CCPA, HIPAA, and CIS Controls postures, with a SOC 2 report, ISO 27001 attestation, and pentest report available on request. The homepage carries AICPA SOC and ISO 27001 marks. For a 2024-founded company requesting write-level control over enterprise cloud policy, that posture answers the procurement screening question before it is asked.

The remaining trust hurdle is operational rather than compliance-shaped. A platform that changes organization-level policies can break production, so the impact simulation, approval workflows, and staged rollouts that Dark Reading relays are the real counterparty argument. No SLA, status page, or public vulnerability disclosure policy appears in fetched sources, and customers named only by sector leave third-party risk teams leaning on certifications and founder pedigree. [s7, s1, s10, s2]

Add analyzed competitors to compare them side by side with Native Security.

Native sells to enterprises whose estates span several clouds, and the visible customer base begins with Fortune 100 organizations. Press reports those customers in finance, technology, and media, and the company’s blog adds fast-growing technology companies and regulated institutions, which together describe buyers with sprawling multi-cloud estates and heavyweight procurement processes.

The newest public proof of demand is current. The company left stealth on March 17, 2026, and announced AWS Security Hub Extended availability on May 15, 2026, so the record shows shipping into the present cloud and AI adoption cycle rather than a launch left to age.

The operating persona is the cloud security engineer, and the economic buyer is the leadership above that person. Megiddo’s blog pitches elite architecture leverage delivered to a small team, and the pay-as-you-go AWS channel is the one motion in the record that could eventually reach buyers below the enterprise tier.

The claimed mechanism is consistent everywhere it appears. Vendor pages and press describe the same pipeline, a discovered topology of accounts, workloads, and identities, intent translated into provider-native controls across the four clouds, impact simulation that replays historical activity, and drift detection once guardrails are installed.

The claimed AI advantage is translation rather than a proprietary corpus. The homepage shows security intent expressed in natural language and converted into provider-specific policies, and the platform page applies the same enforcement model to managed AI services, defining which AI services can be provisioned and which models can be called and preventing those services from reaching sensitive data or PII, enforced through provider-native controls the page names as Bedrock policies on AWS, Vertex AI restrictions on Google Cloud, and Azure AI Foundry guardrails on Azure. No cross-customer data flywheel is claimed in fetched sources.

Demonstrated capability is hard to separate from structured marketing. With no public documentation, sandbox, or independent technical evaluation, the verifiable footprint reduces to consistent press descriptions, the investor’s account of a streaming-service customer enforcing preventive controls after simulation, and the SafeBase trust center certifications, which fetched sources list without dating against the customer relationships.

Native runs an enterprise sales-assisted motion with founders out front. The direct site’s commercial calls to action are demo booking and contact, CEO Amit Megiddo is the quoted company voice in launch coverage, joined by investor and board quotes, and Amit Megiddo authors the company blog, a stage-appropriate posture for a company whose disclosed customers arrived early, with sales roles open on its careers page. The AWS Security Hub Extended motion adds a self-serve path the direct site lacks, with every AWS customer activating Native there getting a 30-day free trial with full product access.

Marketplace distribution is unusually developed for a company this young. Native lists on AWS Marketplace and shows Google Cloud as a partner, and in May 2026 it became available through AWS Security Hub Extended, in-console procurement on the AWS bill that the company says removes the friction of buying from startups. Megiddo notes that AWS selected two vendors for the cloud security category, which makes the slot itself a scarce distribution asset an imitator cannot simply buy.

The channel map now extends past the providers. The partners page publishes a reseller and channel track for VARs, MSPs, consultancies, and distributors with deal registration and co-selling, alongside a technology alliances track for integration partners, so the program reads as scaffolding more than evidence of an active partner roster. Distribution today rests on direct demo-led sales plus the providers’ storefronts, with the reseller and alliance program a stated intent whose live partner list is not visible in the reviewed record.

Native publishes no pricing for its direct motion, which signals negotiated enterprise deals. The website’s only commercial calls to action are demo scheduling and contact, and no fetched source reports deal sizes, so the direct revenue model stays opaque beyond the enterprise posture it implies.

The AWS channel discloses what the website withholds. Security Hub Extended sells Native with pay-as-you-go pricing on the customer’s AWS bill, which the company describes as transparent pricing a few clicks from deployment, opening with a 30-day free trial. The consumption unit behind that price does not appear in fetched sources, and the choice matters, because charging by accounts or resources covered would scale with estate size while charging by enforcement activity would penalize the proactive behavior the product exists to create.

Cost behavior over time is the question buyers will press. A guardrail estate grows with each provider service the customer adopts, and no fetched source explains how spend tracks that growth or what happens to price when coverage expands.

Native delivers as a managed platform that connects to the customer’s cloud control planes. A login portal at app.native.security fronts the product, and enforcement lands inside customer environments as provider-native policies, deployable directly, through Terraform or native IaC pipelines, or rolled out through guided implementation.

Blast-radius control is the operational core rather than an afterthought. The platform replays historical cloud activity to model enforcement impact, recommends rollout sequencing, routes changes through approval workflows, and reports blocked actions after deployment, the mechanisms Dark Reading relays as the answer to enforcement breaking production. Managed exceptions with documented approvals and expiration handle the cases policy cannot anticipate.

Public operational collateral lags the architecture. No SLA, status page, or deployment documentation appears in fetched sources, a normal gap at this age but a real one for a product whose failure mode is blocking legitimate business activity.

Native publishes a SafeBase trust center that lists SOC 2 Type 2 and ISO/IEC 27001 alongside GDPR, CCPA, HIPAA, and CIS Controls postures, and the homepage carries the audit marks, collateral that a young company rarely shows this early and that write access to organization policy makes mandatory. The portal also exposes a stack of security documentation behind access requests, including a pentest report, a privacy whitepaper, an SBOM, a data processing agreement, a master services agreement, and a subprocessor list.

The product’s design is the second trust argument. Native configures controls the customer already owns instead of inserting an agent or proxy into runtime paths, keeps humans in approval workflows, and simulates before enforcing, which converts the scariest part of the pitch into the most defensible part of the architecture.

The gaps are the ones certifications cannot cover. No public vulnerability disclosure policy appears in the reviewed sources, and the public customer case studies stay unnamed. The homepage does carry named security-leader testimonials, including Drew Robertson of Renaissance Learning and Huy Li of Monolith Power Systems, but it does not label them as production customers, so a third-party risk reviewer still leans on founder pedigree and audit reports rather than a clearly named reference to call.

Native’s ecosystem motion runs through the cloud providers rather than around them. The product is a layer over four providers’ control frameworks, the company distributes through AWS Marketplace and shows Google Cloud as a partner, and the partners page frames partnership as enforcing secure-by-design together with the providers’ own mechanisms.

The AWS Security Hub Extended slot doubles as ecosystem validation. Megiddo writes that AWS selected two vendors for the cloud security category and frames the split as detection on one side and enforcement on the other, positioning Native as the enforcement half of a category AWS just created inside its console.

Third-party builder mechanics stay thin even as a partner program exists. The partners page now invites integration and joint go-to-market through a technology alliances track for platforms, CNAPPs, IAM, CIEM, and data and developer tools, yet the reviewed pages expose no public API documentation, SDK, or integration directory for companies building on Native, so the platform claim currently rests on architectural breadth, provider distribution, and an early alliance program rather than network effects.

The founding trio covers both halves of the product’s requirement, insider knowledge of the providers’ security machinery and experience building and shipping cross-cloud security for enterprises. Amit Megiddo led product for Amazon GuardDuty, Gal Ordo led AWS Security Hub, and Eyal Faingold led Check Point’s cloud security portfolio after Dome9, where the lead investor’s post places him as VP of R&D. Independent outlets state the Check Point and AWS backgrounds in their own voice.

The organization was 41 people across Israel, the UK, and the US in CTech's March 2026 reporting, with plans to reach around 90 by the end of 2026. The careers page shows on-site Tel Aviv hiring including AI and ML engineering roles, and the press release says the team draws from the major cloud providers, Israeli military cyber units, and companies including Palo Alto Networks, Lacework, Axonius, and Cyera.

Senior validation around the company is dense for its stage. Phil Venables, former CISO of Google Cloud, sits on the board, and CTech lists Zohar Alon of Dome9, Doug Merritt of Aviatrix and formerly Splunk, and Udi Mokady of CyberArk among investors and advisors, operators who have built and bought in exactly this market.