Consider the peculiar economics of a security setting. A company pays for software that can protect a device, restrict access or stop a dangerous attachment. The feature exists. The license is settled. Yet somebody must understand the setting, decide where it belongs and keep it working as the business changes. Until then, a purchased defense can remain a possibility. Discern Security has built its business around that small, expensive distance between possession and protection.
- Discern assesses and improves the security tools a company already uses.
- Its AI agents connect discovery, explanation, prioritization and remediation.
- The customer controls whether agents recommend, seek approval or act within an authorized scope.
The protection already paid for
In July 2026, co-founder and CEO Sai Venkataraman supplied the company’s diagnosis: customers typically use less than a quarter of the features in the security products they buy. That is Discern’s own finding, rather than an industry census. Still, it explains the proposition. There may be useful protection hiding in the tools already on the invoice.
“Our data shows that customers use less than 25% of the features of the security products they buy.”
Sai Venkataraman · July 2026
Founded in 2023 by Venkataraman, Santhosh Purathepparambil and Rohan Puri, Discern launched as a policy intelligence hub. Its mission, described today as democratizing security intelligence, has an operational meaning: give teams the context to understand their defenses and the means to improve them. Security expertise is scarce; an idle control does not become useful merely because its vendor releases another feature.
The platform connects to existing products through integrations, establishes configuration baselines and assesses controls across endpoint, identity, email and other systems. It maps findings to frameworks including MITRE, CIS and NIST. Those mappings help teams explain coverage and progress. A neatly colored framework map, of course, still needs functioning controls behind it.
Typical feature utilization among its customers, according to Discern. The opportunity is to activate and maintain more of what is already available.
A cast of agents, a single unfinished job
The current product, the Discern Security Loop, divides the work among named agents. Scout discovers and enriches assets and risks. Oracle supplies context. Pathfinder decides what deserves attention first. Resolve turns findings into tracked remediation. ATLAS lets users ask questions and build dashboards in ordinary language; MESH connects the wider security ecosystem. The names have the air of an expedition. The destination is an issue that actually gets closed.
Scout brings assets and exposures into view and helps establish a baseline across connected tools.
That design addresses a familiar administrative trap. One console identifies a device; another records its protection; a third holds the ticket. Discern brings those signals together so a team can examine coverage, identify drift and assign work. Its CrowdStrike joint solution brief describes using Falcon events to inform policies in other products, including Netskope and Mimecast. Cross-tool intelligence is useful when a risk crosses the boundaries drawn by the software vendors.
The Mac that knows too much
A September 24, 2026 Jamf integration makes the proposition tangible. Companies want to know which AI tools are running on managed Macs, including those employees adopted themselves. Discern uses Jamf inventory, matches applications against an AI service dictionary and adds five checks through Jamf extension attributes.
Those checks look for local model runtimes, MCP server configuration files, command-line AI tools, AI browser extensions and applications with microphone or screen-recording permissions. The integration uses read-only API access and the existing Jamf agent. No additional endpoint software is required. Device information is then combined with signals from identity, email and other security systems. The interesting move is finding another use for data the company already collects.
The security company with its own report problem
Discern has experienced a version of the problem internally. A June 2025 Beagle Security case study describes vulnerability reports that developers struggled to interpret, missing remediation context and findings passed to a security specialist. Feedback arrived too late in development. The report existed; responsibility stalled.
According to that supplier-authored account, Discern adopted Beagle’s contextual guidance and integrated testing into its CI/CD pipeline and sprint planning. Developers began handling vulnerabilities themselves. The transferable lesson is modest: put understandable instructions where the person doing the work will see them. Intelligence needs a place in the working day.
A subscription for finishing the work
Discern sells hosted software subscriptions, with fees and usage limits set in customer orders. Its audience includes CISOs, security and IT teams, and managed service providers. The website displays Carrier, TCS and Coforge among its trusted brands. For service providers, consistent assessments can also turn a client’s uncovered devices into a concrete service proposal.
The company announced a $3 million seed round in September 2023 and a $13 million Series A led by Forgepoint Capital in July 2026. The latter backs engineering, product development and a larger library of AI capabilities. Its market overlaps with Axonius in asset intelligence and remediation, and AppOmni in SaaS posture management. Discern’s particular pitch joins configuration assessment, cross-tool context and coordinated action.
There is a useful distinction between a missing control and an unused one. Discern’s asset coverage capabilities look for devices without endpoint protection, inactive agents and outdated versions. Its configuration assessments examine the protections available inside deployed products. That distinction changes the next task: install coverage where it is absent, or improve settings where a tool is present but poorly used. For a buyer, the appeal is a clearer explanation of what the existing investment does and where additional work is needed.
The boundaries matter. Discern’s published automation addendum defaults each action class to recommend-only. Customers can require approval or authorize bounded autonomous execution. Its own writing also acknowledges that prioritization needs accurate business context and knowledge of healthy controls. Incomplete telemetry or unclear ownership would weaken the loop. For a prospective user, a sensible trial is one supported workflow: establish a baseline, identify a gap, assign the fix and verify the result. The evidence worth keeping is the changed control, not simply another finding.