Keith Palumbo has carried his graduation books through more than seven house moves in thirty years. By his own account, they are out of date, unlikely to help him and taking up a generous portion of a cabinet in his home office. Still, the books travel. Sentiment apparently enjoys a more forgiving retention policy than security data.
He offered this confession in February 2025 while explaining why companies should stop collecting digital material without deciding what they need it for. It is an appealing admission from someone selling a way to organize information: the person making the case for discipline has his own small archive of exceptions. A cabinet can accommodate affection. A security operation has other obligations.
Palumbo co-founded Auguria with Chris Coulter in 2022 and served as its CEO during its emergence from stealth and early commercial push. Their work concerns a familiar predicament with expensive consequences: organizations can collect far more evidence of activity than their people can reasonably examine. His career has approached that predicament through litigation, digital forensics, company operations and, eventually, software.
A business hiding inside a billable hour
In Los Angeles in 2009, Palumbo met Coulter during a trade-secrets case involving an algorithmic trading company. Coulter belonged to a PwC expert-witness team. The investigation demanded extensive forensic collection and analysis. About four weeks into the work, Palumbo began thinking about the economics on their own side of the table.
“We were selling hours,” he recalled. However skilled the people, the business remained attached to the clock. In 2010, they founded Skout Forensics. Its evidence-collection drives could be mailed to customers, reducing the need to send a specialist on a journey just to collect a computer’s contents. Palumbo put the acquisition price at $399.
His favorite practical detail is the packaging: preparing shipping labels took longer than making the drive. The ambition extended beyond collection to automated analysis. Cylance acquired Skout in 2012. That transaction carried both founders into a different kind of company-building, while the problem that brought them together would survive several changes in technology.
The machinery behind the sale
Palumbo graduated from Syracuse University and Cornell Law School. Cornell’s startup directory identifies him as a JD graduate of the class of 2003. The legal education matters to this story because so much of his subsequent work sat where technical promises meet commercial obligations. Software companies need someone to make the sale executable.
At Cylance, his responsibilities extended across contracting, intellectual property, procurement, legal functions, human resources and the structures needed for international expansion. He helped maintain contracting capacity as the company grew, supporting both direct sales and partners. This was work on the operating machinery of the business, with a lawyer’s tools close at hand.
A product can be ready while the organization around it is still learning how to deliver. Contracts, staffing and subsidiary structures rarely provide the opening scene of a technology story. They do help determine whether a customer can actually buy what the demonstration promised. Palumbo’s operating record gives his later interest in repeatable processes a concrete setting: the company has to keep working while it grows.
co-founded
by Cylance
co-founded
Before the next incident
By October 2015, as Cylance’s vice president of legal affairs, Palumbo was discussing cybersecurity in terms of business continuity. An intrusion could disrupt ordinary operations, divert resources and alter schedules before a lawsuit even arrived. Payroll and procurement belonged in the conversation alongside compromised machines. The consequences reached well beyond the technical team.
His emphasis was preparation: establish relationships with experienced security advisers, think through incident response and bring the relevant people together quickly. He also urged companies to understand the limits of their insurance coverage and keep talking to their brokers as policies and risks changed.
The perspective is useful for understanding his subsequent business. Security purchases have to serve an organization with employees, customers, deadlines and a finite budget. A detection that nobody can interpret quickly leaves a gap between acquiring a tool and receiving its promised benefit. His earlier legal work had already placed him near that gap, where operational trouble becomes a problem for the whole company.
The archive gets a budget
In January 2025, Palumbo gave indiscriminate collection an acronym: LASSA, for “Log All, Store All, SIEM All.” SIEM is the security information and event management software used to collect and analyze security records. The acronym captures an easy habit: ingest everything now and postpone the question of usefulness.
He argued that the habit carries several bills. Licensing is one. Storage, moving data, computing resources and the people needed to run the system add others. A collection can grow impressively while the time required to get a useful answer grows with it. His objection concerns the distance between possession and action.
The remedy he advocated begins with the use case. Decide which information a particular investigation or detection needs, how quickly it needs it and how long it must remain available. That makes the archive answer to an operational purpose. It is a less glamorous starting point than another dashboard, but considerably easier to explain to whoever has to pay for it.
“We were selling hours.”
Keith Palumbo, recalling the problem that preceded Skout
Give the analyst a reason
Palumbo’s January 2025 writing also considered the relationship between security teams and their tools. A system that repeatedly interrupts people with unhelpful warnings creates a credibility problem. The next alert arrives carrying the reputation of the previous ones. Giving an analyst another notification does little to establish why that notification deserves attention.
He described the tension between precision and recall: detecting as many threats as possible can generate excessive false alarms, while narrowing the selection too aggressively can miss an attack. There is no useful victory in making an alert counter look tidy if something consequential disappears from view.
His proposed standard was explainability. Teams should understand where a signal came from, why it was flagged and how to respond. That is a demand for an intelligible chain of reasoning. It also preserves a place for the human professional, whose judgment becomes more useful when the software supplies context rather than another unexplained instruction. The aspiration is a working relationship in which the tool earns attention.
A place for the ordinary
By March 2025, Palumbo was spelling out a practical approach to the archive. Keep material needed for immediate analysis in suitable systems, place bulk telemetry in less expensive storage, remove duplicates and enrich records before sending them downstream. Retention can have different destinations and different purposes.
He also resisted treating apparently unremarkable records as inherently worthless. A routine-looking authentication attempt or DNS log may acquire significance when examined alongside other activity. The challenge is to find relationships at scale. Sorting data therefore requires more judgment than dividing it permanently into useful and useless piles.
For an investigator, context changes the question. A failed login on its own offers one fragment. Connected with other accounts, assets or behavior, it may support a different line of inquiry. Palumbo’s argument keeps returning to that transformation. An organization has paid to collect the fragments; it still needs a way to make them explain something before asking a person to spend the afternoon on them.
The reunion at RSA
SentinelOne’s S Ventures first encountered the Auguria concept when Palumbo and Coulter presented it at RSA in 2022. The investor described the pairing in terms of complementary experience: Coulter brought digital forensics and incident response, while Palumbo combined legal and business work with data investigations. The partnership already had a shared operating history.
Auguria’s Security Knowledge Layer uses an embedding engine and a vector database to organize security events. In plain terms, the approach represents records so their relationships and similarities can be examined, then ranks and enriches material for subsequent analysis. It aims to make the incoming collection more navigable for both people and AI.
SYN Ventures lists Auguria as founded in 2022 and funded in 2023. Its description emphasizes automated classification and prioritization. These are the company’s proposed capabilities, rather than a universal promise about every customer’s results. What connects them to Palumbo’s earlier work is the ambition to make repeated analytical preparation a software task instead of a recurring claim on someone’s time.
Trust travels through other people
When Palumbo discussed Auguria’s commercial plans in March 2025, he described a business committed to channel partners from the outset. That year would mark its first full sales availability. His account of distribution was practical: larger partners could test technology in their labs and introduce it to customers who already trusted their judgment.
Smaller partners had a place too. Helping a small firm win a few initial deals could let both businesses grow together. Palumbo said his understanding of the channel had developed through his Cylance experience. He came to value its ability to carry a message through established relationships, as well as its ability to close business.
There is a human complement here to the software argument. An analyst needs a reason to trust an alert. A customer needs a reason to trust a young vendor. In each case, someone has to supply context before the next step makes sense. Palumbo’s sales approach puts existing relationships to work on that problem, giving unfamiliar technology an introduction from a familiar person.
What survives the change of title
When Auguria emerged publicly, Palumbo celebrated working with Coulter again and named former colleagues Grant Moerschel, Claudiu Teodorescu and Jackie Fenn. He also thanked the investors who supported the seed round. His announcement presented company-building as a return to working relationships, with people from earlier chapters helping begin another.
Today, Auguria names Jessvin Thomas as CEO and Coulter as co-founder and CTO. Palumbo’s place in its founding story remains clear. The company now describes a direction toward security software built for AI, with automated curation addressing the data preparation that otherwise occupies security teams.
Across Palumbo’s public work, the question persists: what must happen to a collection before it helps someone decide? A legal investigation, a growing software business and a security operations team each give the question a different urgency. His answer has repeatedly involved preparation, context and repeatable work. Somewhere in his account of all this sit the graduation books, still exempt from the efficiency program. Even a disciplined archive may allow a sentimental shelf.