Exaforce wants to teach the SOC how to think.

01The room where the alerts come in

It's 2:14 a.m. somewhere, and a SOC analyst is staring at her seventeenth false positive of the shift. The SIEM has done what SIEMs do - shouted "look here," then refused to say why. Exaforce believes that scene is a design failure, not a labor problem. The fix, they argue, is not more humans squinting at dashboards. It is software that can read the dashboard for you, ask the next question on its own, and only knock when the building is actually on fire.

That is the company in one paragraph. The rest of this profile is the long version.

02The problem they saw

The Security Operations Center has, for about fifteen years, been a beautifully strange place: rooms full of expensive analysts running expensive software that mostly tells them they were already too late. SIEMs were supposed to make sense of the noise. Instead, they invented a market for tools that make sense of the SIEM.

Exaforce's founders - Ankur Singla and Jakub Pavlik - had a clear view of the mess from the inside. Singla had operated security at scale at F5, protecting some of the world's largest banks and social networks. The team's prior turf included Google's AI infrastructure and the cloud security platform at Palo Alto Networks. So when they say the SOC is broken, it lands with a certain weight - like a plumber telling you the house is plumbed wrong.

They identified three failures, in plain language: rules cannot keep up with cloud and identity sprawl; the people writing those rules are exhausted; and the LLM-only tools that arrived in 2023 mostly hallucinated about logs they had never seen. The pitch, then, was for a different shape of AI - one that respects security data the way a database does, but reasons about it the way a senior analyst does.

03The founders' bet

The bet is the multi-model AI engine. Where most of the AI-security crowd is gluing a chatbot on top of someone else's SIEM, Exaforce went the other direction. They built a data platform first, then taught a stack of models - semantic, behavioral, knowledge-based - to live on top of it. The agents are the application layer. The engine is the moat.

It is the kind of architectural decision that is either deeply boring or deeply important, depending on how long you have spent debugging a regex at midnight.

Investors apparently agreed. Khosla Ventures, Mayfield, and Thomvest led a $75M Series A in April 2025. A year later, HarbourVest and Peak XV joined in for a $125M Series B at a reported $725M valuation. Both Khosla and Mayfield wrote the second check too, which is the kind of signal you cannot fake with a press release.

04The product, named like it was built by someone with a sense of humor

The agents are called Exabots. They have job titles. They do not require benefits.

Four agents, one shared data lake, and a stubborn refusal to let analysts learn another query language.

05The proof, such as proof exists in year three

Customers are the part of a story you cannot fake for long, and Exaforce has begun to assemble a reasonable list. Replit and Guardant Health have been disclosed publicly. The company has said it expects to roughly double its customer base by the end of 2026. These are not Fortune 50 logos yet - they are something better at this stage: real cloud-native shops with messy environments and zero patience.

The partner side is starting to fill out too. Exaforce ships through AWS Marketplace and runs an MDR-partner network where managed providers offer the platform under their own brand. The platform itself can be self-hosted by an in-house team or operated by Exaforce's own analysts as a managed service. Same Exabots either way - choose your own staffing model.

06The mission, stated plainly

"10x improve the productivity and efficacy of security and operations teams using our transformative multi-model AI engine." It is a corporate sentence, and corporate sentences are not normally interesting. But there is a quiet decision inside it: the word is improve, not replace. The Exabots do not fire the analyst. They give the analyst something to do besides label false positives at 2 a.m.

This matters more than it sounds. The AI security category currently includes a number of vendors who - with the conviction of a TED Talk - argue that the SOC analyst job is done. Exaforce has politely declined that view. Their product is built around the assumption that humans will keep the judgment calls, and machines will absorb the toil. It is not the boldest claim in the room. It is, possibly, the correct one.

07Why it matters tomorrow

Cyberattacks now arrive at machine speed. The defenders, until recently, did not. If Exaforce is right about agents - and the early customer list suggests they are at least pointed in the right direction - the next decade of security operations will not look like the last one. The SIEM-as-billing-machine era ends. The analyst-as-query-writer era ends. What replaces them is, ideally, software that explains itself and humans who can read.

Whether Exaforce gets to be the company that defines that future, or simply the first to describe it convincingly, will be settled by whoever's checks clear next year. But the bet is placed. The Exabots are awake. The dashboard, for once, has someone watching it.

Back to that 2:14 a.m. analyst, then. In the Exaforce version of the room, her queue is not seventeen false positives. It is two real ones, already enriched, already correlated, with a recommended action waiting and a Slack message that politely asks if she would like Exabot Respond to take the next step on her behalf. She says yes. She goes back to bed. The dashboard, mercifully, stays quiet.

08Watch & read

A short shelf of further inputs if you want to verify the story yourself.

09Find Exaforce