The first thing to fail was not a firewall. It was an assumption. Ricardo Villadiego had sold his first cybersecurity company, Easy Solutions, and finally had time to study the breaches that embarrassed Target, Home Depot, UPS and Equifax. These were not careless businesses with no defenses. They had budgets, tools and people. Yet attackers could remain inside for 18 to 36 months. The industry had become excellent at counting what it bought and strangely incurious about measuring the result.
Villadiego's conclusion was almost impolite: security teams were looking for vulnerabilities and alerts, but they were not continuously looking for compromise. An attacker may evade an endpoint control or arrive through a credential, but eventually the attacker has to use the network. A compromised laptop resolves a domain, contacts an IP address, sends an email or creates a flow. The trail is smaller than a dramatic movie breach, but it is there.
“They weren't looking for the compromise. They weren't looking for the adversary within the company.”Ricardo Villadiego, founder and CEO
That observation became Lumu Technologies, founded in 2019 and launched publicly at the RSA Conference in February 2020. The company is based in Doral, just west of Miami International Airport. Its proposition fits on a whiteboard: collect network metadata, normalize it, correlate it with threat intelligence, identify confirmed points of compromise, then push the result into the security controls a customer already owns.
The security industry sold locks. Lumu built a smoke detector.
Lumu sits in the network detection and response market, beside alternatives such as Darktrace, Vectra AI, ExtraHop, Corelight, Ordr and Cyrebro. The category can sound like a parade of machines staring at other machines. Lumu's useful distinction is the unit it asks a buyer to manage: not raw traffic and not a fresh heap of alerts, but confirmed compromise.
The Lumu feedback loop
That last step matters. A buyer does not have to throw away CrowdStrike, Microsoft Defender, SentinelOne, Trend Micro, Fortinet, Palo Alto Networks, Sophos, Cisco or the service desk. Lumu is designed to sit among them. Its integrations can ingest data from existing defenses, send incidents to a SIEM or ticket queue, and direct a response control to block a malicious destination or contain an endpoint. In August 2026, it added an integration that streams network compromise data into CrowdStrike Falcon Next-Gen SIEM, where analysts can correlate it with endpoint telemetry and build response workflows.
The pitch is economic as much as technical. Enterprises have already spent heavily on a security stack. Another rip-and-replace project creates budget friction and months of integration work. Lumu promises to make the existing stack more observant. Its own product graphic says the quiet part out loud: manage all alerts, respond in seconds and reduce cost. Those are company claims, not laws of physics, but they reveal the intended buyer - a small or overloaded security team that cannot keep adding analysts.
Free is the diagnostic. Automation is the business.
Lumu uses a familiar SaaS ladder. Lumu Free is permanent, not a 14-day taste followed by a countdown clock. It offers network-level visibility into confirmed indicators, collectors and 45 days of incident retention. Lumu Insights adds asset-level context, broader metadata collection, remote endpoint monitoring, attack-pattern recognition, MITRE ATT&CK mapping and one year of retention. Lumu Defender adds automated response integrations, flexible reporting and up to two years of incident and traffic-log retention.
Public pricing directories in 2026 listed Insights at about $6 per asset each month and Defender at about $9, though enterprise and channel pricing can vary. That makes the cost legible enough to test against labor. If the product removes repetitive triage and prevents one analyst from swiveling between five consoles, the arithmetic can work. If it merely creates a sixth console, it cannot.
The financing followed the funnel. Lumu raised a $7.5 million Series A in 2021 from SoftBank's SB Opportunity Fund and Panoramic Ventures, then announced another $10 million in 2022. In September 2023, when cybersecurity venture funding had fallen sharply, Forgepoint Capital led a $30 million Series B, including $6 million of debt. Existing investors BIP Ventures, Exceptional Capital and SIMMA Capital participated. Lumu said it had 881 live deployments and 133 percent year-over-year annual recurring revenue growth.
The new money went toward US sales, go-to-market expansion and research and development. It also supported a broader product story. Lumu introduced Autopilot in 2024 to investigate and resolve confirmed compromises through AI-driven workflows. In 2025 it acquired Spanish threat-intelligence specialist Maltiverse for an undisclosed sum, adding curated and scored indicators plus a European foothold. By 2026, the company was promoting Threat Observatory, a view of active attacks by industry and geography.
What changed his mind: one company, built for the US on day one
Villadiego had already learned how geography shapes software. He began his career as an electronic engineer in Colombia, writing a driver that helped ATM machines speak to a transaction protocol. Seeing weaknesses in that protocol pulled him into security, then sales, then entrepreneurship. Easy Solutions eventually expanded from Latin America into the United States, Europe and Asia before its acquisition in 2016.
The expensive lesson was that a product shaped around one market does not travel untouched. In Latin America, lower labor costs can conceal software gaps because another person can be added to the process. In the United States, expensive labor pushes products toward self-management and automation. Easy Solutions had to refactor technology for US buyers. With Lumu, Villadiego exposed the product to the US market from day one. The company calls its employees “Illuminators,” but this choice says more about its culture than the nickname: build for the customer's operating reality, not the founder's home-field assumptions.
The customer base now runs from managed service providers and midsize businesses to schools, governments, banks, hospitals and global enterprises. Named references include Banco Davivienda, RCN Television and the City of Sedona. An anonymous retail case study describes 100,000 assets across 2,600 locations. Lumu deployed without an agent on every asset, giving the team one network-level view across employee devices, smart equipment and bring-your-own-device traffic. An anonymous financial institution found nearly 200 compromises in six months; more than three quarters were malware.
“Your enterprise already has all the data, we just need to connect the dots.”Lumu product documentation
Recognition followed. The World Economic Forum selected Lumu for its 2025 Technology Pioneers cohort. In August 2026, the company ranked No. 25 among security businesses on the Inc. 5000 after reporting nearly 300 percent revenue growth from 2022 through 2025. Lumu also said Autopilot had executed 7.2 million AI-driven workflows and reduced manual triage by nearly 70 percent. Those figures come from the company, and the real test is whether customers see the same reduction after integrations, permissions and escalation rules meet the mess of a live network.
The useful part to copy - and the conditions that break it
A security team can copy Lumu's operating idea without copying every product decision. Begin with the outcome: can the organization continuously say where compromise exists? Use metadata already generated by DNS resolvers, firewalls, proxies, cloud networks and email. Start with one representative slice, establish an incident owner, then connect one safe response control. Measure time from malicious contact to confirmation and from confirmation to containment. Only then expand collection and automation.
It works when
- Metadata represents on-premise, cloud and roaming traffic.
- Every confirmed incident has an owner and a response path.
- Existing controls expose reliable APIs or integrations.
- Teams tune automation in stages and review the outcomes.
It buckles when
- DNS and flow data miss large pieces of the environment.
- Alerts land in an unattended queue with no authority to act.
- Blocking rules can interrupt fragile production systems.
- A buyer expects detection to replace identity, endpoint or preventive controls.
There is a market risk too. Network detection is crowded, and buyers may already expect similar outcomes from an XDR, SIEM, managed SOC or endpoint vendor. Lumu has to prove that “continuous compromise assessment” is more than a fresh label for network analytics. Its defense is practical: a free entry point, broad collection, a vendor-neutral posture and response through existing investments. Its challenge is equally practical: every added source and automated action must earn trust.
Lumu's founding insight remains the sturdy part. Prevention can fail quietly. The network usually keeps the receipt. Six years after launch, the company has turned that receipt into a platform, a financing story and a growing set of automated decisions. The wager is not that attackers disappear. It is that defenders can make their presence brief, visible and expensive.