Damien Lewke and the question nobody wants to leave unanswered

Before Damien Lewke wrote code for Nebulock, he went looking for people who might tell him he was wrong. He interviewed 90 prospective customers in 90 days. He had spent years working in cybersecurity, but a familiar problem still needed to survive an unfamiliar person’s questions. His new company began with listening.

The other early artifacts were modest: a 30-page manifesto and $40 in a company bank account. The manifesto was considerably longer than the bank balance. By July 2026, when he recounted those beginnings, Nebulock had announced a $25 million Series A. The money makes a convenient milestone. The conversations explain more about how he chose his work.

Lewke’s complaint was that organizations could buy capable security products, employ experienced people, and still leave an attacker room to move. He had seen the problem from several desks. Building a company meant finding out whether other people experienced it in the same way, and whether they wanted to do something about it.

A different kind of opponent

His earlier life had already involved a fair amount of starting somewhere new. Born in Greenwich, Connecticut, Lewke moved to Germany as an infant for his father’s work in executive recruiting. He spent parts of childhood in Germany and the Bay Area. At fifteen, he returned to Germany to pursue football, staying through his late teens.

He played for Quelle Fürth. In his own account, football began as an escape from the swimming team; scoring with his first touch in a game rather spoiled the plan to remain casual about it. Training followed. So did an early experience of living away from home and organizing life around improving a craft.

He later described that period as semi-professional football. Another early job was selling shoes at Sperry. The sequence resists the neatness of a founder biography written backward from a funding announcement. There was sport, retail, university, and then the discovery of a professional subject that held his attention.

At UCLA, he became interested in adversarial game theory: making decisions when another party is actively trying to frustrate them. Football and security both contain opponents, although that resemblance should not be asked to explain an entire career. What mattered was that he had found a question he wanted to keep investigating.

The work between the tools

Northrop Grumman gave that interest a practical setting. Lewke worked in defense and systems engineering, while completing a master’s in systems engineering at Loyola Marymount University. Studying alongside a full-time job made progress a matter of repeated effort. The work itself put security inside large systems with consequences beyond a computer screen.

The 2016 intrusion into the Democratic Party’s systems sharpened his interest in cyber espionage. The connection between technical decisions and public events was difficult to overlook. CrowdStrike’s involvement caught his attention, and he joined the company during its earlier growth, remaining through its initial public offering.

His work there crossed product marketing, solutions architecture, and integrations engineering. Later came Palo Alto Networks in Australia, where he worked in systems engineering. Endpoint security and network security gave him different views of the same enterprise. Neither view, by itself, described everything happening inside it.

Australia also gave him a professional community that remained part of his life. In a later reflection about catching up with former colleague Thomas Lavery in New York, he described two formative years at Palo Alto Networks. His phrasing was direct:

“Security is a team sport, and a global community.”

Damien Lewke

At Arctic Wolf, he went on to lead product work involving AI detections, intelligence, and security research. Across those jobs, the recurring difficulty was assembling enough context to recognize an intrusion. Each tool had a purpose. An attacker’s route could cross several of them.

The nine-year detour to MIT

In June 2023, Lewke marked his graduation from MIT with a personal accounting. He had first set himself the goal of attending the institution nine years earlier. Between the idea and the degree came four moves between cities, a change of continents, and people whose help he explicitly acknowledged.

He completed a master’s in Engineering and Management. MIT’s commencement book records him as Damien Gordon Lewke. Behind the graduation photograph was a longer exercise in returning to an ambition while the rest of life kept changing around it.

His university research addressed cloud security benchmarking. The MIT-IBM CloudSec 16 proposed a framework and scoring system for cloud deployments in financial services. Its starting concern was practical: existing security frameworks could be too broad or exhaustive to help organizations understand their position relative to peers.

Paired with MIT’s SCRAM secure computation platform, the proposed framework could support comparisons and help identify relative weaknesses. That was a research proposal, rather than a claim that a score could make an organization safe. It also showed him working on a familiar difficulty: turning abundant security information into something a decision-maker could use.

Giving the quiet dashboard a second look

By early 2024, Lewke had decided to leave his job and pursue the problem full-time. He has described testing his own commitment by asking whether he would still work on it without being paid. His answer was yes. Customer discovery followed, giving conviction some necessary company.

He describes those conversations as inquiries into how people had already spent time and money, and what continued to bother them. He also favors meeting in person. He has spoken about traveling to sit with customers over meals and listen, without making every encounter a product pitch. Sometimes a useful meeting involves Thai food and an unopened presentation.

Nebulock’s public launch in July 2025 framed the product around autonomous threat hunting. The intended work was to examine existing security data, develop and test hypotheses, and turn useful discoveries into behavioral detections. The founding question was brief enough to fit anywhere:

“What are we missing?”

The question in Lewke’s Nebulock launch essay

The distinction matters because a missed threat may produce no alert to investigate. A system that only processes alerts inherits the limits of whatever generated them. Lewke wanted hunting to run continuously across the security stack, including identity, endpoint, and cloud information.

By July 2026, he was discussing a broader security data platform that could support questions, hunts, and detections. The company describes its TRACE Graph as a persistent record of behavior: context from one investigation can inform the next. Its stated approach keeps human judgment involved while agents handle more of the investigative volume.

That evolution gives the founding idea a useful test. A hunt should leave something behind: a finding, a better detection, or context that improves a later decision. Otherwise the next analyst may inherit the same puzzle with a different timestamp.

Curiosity, with a publishing schedule

Lewke also writes in public. His newsletter’s name, ABC by D, expands to Always Be Curious by Damien. When he introduced it in 2024, he invited both specialists and newcomers, with an emphasis on explainability, threat hunting, and intelligence. He also asked readers what they wanted him to cover.

The titles have room for a joke. Two Dudes and a GPU, published in March 2026, examined his concern that machine assistance could put more sophisticated offensive capabilities within reach of smaller groups. His argument concerned changing economics and assumptions about attackers; it was a warning about where he thought the field was going.

In July’s Open Weights, Open Season, he returned to that subject after a travel delay gave him time to write. The newsletter allows a more conversational voice than a product description. It also exposes his arguments to people who may have no interest in buying software.

His interviews bring other practitioners into the discussion. A February 2026 conversation with CoreWeave’s Natasha Eastman focused on making intelligence useful in operations. Asking what information deserves attention is close to the concern running through his own work: collecting more does little unless someone can decide what to do with it.

A bigger company, the same unfinished question

Nebulock emerged from stealth in July 2025 with $8.5 million in total funding, including a $6 million seed round led by Bain Capital Ventures. In June 2026, it announced a $25 million Series A led by FirstMark, with participation from existing investors.

Those figures describe the company’s reported activity at that date. They do not settle the broader security argument. The important question for a customer remains whether an investigation finds something consequential and leaves the organization better able to recognize it next time.

On October 21, 2026, Lewke appeared with Dan Nathan on RiskReversal Pod to discuss AI, security, and Nebulock’s hunt-first approach. The company had grown; the subject remained recognizable. After years spent looking at different parts of an enterprise, he was still concerned with what happened between them.

His story contains a football pitch, a shoe shop, several security employers, graduate study, and a great many conversations. Nebulock gives that experience a continuing assignment. Somewhere behind an ordinary-looking sequence of events, something may deserve a closer look. Lewke has chosen to keep asking.