Mitiga began with a mildly heretical idea for a software startup: do the work by hand. In 2019, cloud incident responders Tal Mozes, Ofer Maor and Ariel Parnes saw companies moving critical operations into AWS, Microsoft 365, Salesforce and a swelling catalog of SaaS tools. When trouble arrived, investigators still reached for methods built around laptops and servers. The founders did not pretend they already knew the complete product. They sold cloud incident-response services, entered the mess, and watched for the chores that repeated.
Every engagement became field research. Which logs disappeared too quickly? Which identity changes mattered? How did a suspicious login in one service connect to a privilege change in another? The plan, Maor later explained, was explicit: start as a services company and finish as a product company. That meant accepting two different businesses under one roof - expert humans solving bespoke crises, and engineers looking for the common machinery inside those crises.
“We knew we were starting with services and would end up as a product company.”Ofer Maor, co-founder and CTO
Security’s missing middle
Mitiga sits between prevention and the traditional emergency-response retainer. Cloud security posture tools are good at finding exposed storage, excessive permissions and bad configurations. Endpoint products are good at watching machines. Neither necessarily explains what an attacker does after logging in with a valid token, moving through an identity provider, querying a SaaS database and changing a cloud resource. Native tools from each vendor can see their own neighborhood, but an attack does not respect product boundaries.
Mitiga’s answer is an agentless platform that connects to cloud infrastructure, SaaS applications, identity systems and AI services through their available interfaces. It collects activity into a normalized forensic data lake, applies behavioral detections and threat intelligence, groups related signals, builds an attack timeline, and offers guided or automated containment. In practical terms, the software is supposed to replace an analyst’s frantic tour of admin consoles with one investigation that follows the identity and the evidence.
The job, reduced to four verbs
The distinction is less glamorous than a dashboard demo and more useful: Mitiga preserves the evidence before anyone knows they need it. The company says its lake spans more than 50 platforms and keeps over 1,000 days of activity. That long memory matters because compromises can begin months before an alert, while many cloud services retain detailed logs for far shorter periods unless a customer deliberately exports them.
The product was hiding inside the service
The first thing that failed was the old incident-response assumption that the useful evidence lived on an endpoint. Cloud control planes and SaaS tenants do not hand investigators a disk image. Logs vary by provider, retention periods differ, and a single human identity may appear under several names. Mitiga’s early response work exposed those gaps repeatedly. The company built automation around collection, normalization and a library of cloud attack scenarios, then moved from episodic response toward continuous detection.
What changed the founders’ minds was not a philosophical revelation; product was the destination from day one. The change was confidence about what deserved automation. Services supplied examples and paid for learning. The hard pivot came when a culture built to improvise for one customer had to hand repeatable behavior to software used by many. Services reward judgment in the moment. Products demand consistent data models, interfaces and defaults. Mitiga chose to keep expert response available while making the platform the center of the subscription.
The business model reflects that hybrid. Enterprises buy a subscription whose price depends on scope, integrations and service needs; Mitiga does not publish a rate card. Customers can add readiness work, managed support and emergency cloud incident response. The company argues this makes breach spending more predictable than buying expertise only after alarms go off. It is also a demanding sale: deployment touches sensitive audit logs and identity systems, and the buyer needs enough cloud complexity to justify another security platform.
Who hires the gargoyle
Mitiga’s public customer list is short but recognizable: Blackstone, ZoomInfo, New American Funding and insurance company Lemonade. The users are CISOs, security operations teams, incident responders and cloud-security engineers who must defend several providers without staffing a specialist for each one. Regulated industries are a natural fit because investigations need durable evidence and clear timelines, but the core requirement is complexity, not sector.
Lemonade offers the most concrete view of the work. Its CISO described a readiness assessment that established a benchmark and roadmap, two tabletop exercises for technical and executive teams, help clearing a minor false alarm, and a compromise assessment during an acquisition. None of those jobs required a movie-scene breach. That is the quiet value proposition: know where the evidence is, rehearse who makes decisions, and have somebody answer when a suspicious event turns out to be boring.
The clever promise is not that every alert is an attack. It is that a false alarm should take minutes to dismiss, not days to assemble.
Mitiga competes from several directions. AWS, Microsoft and Google offer native security products. CNAPP and posture vendors such as Wiz, Palo Alto Networks and Orca Security map risk before an attack. Permiso focuses on identity threats across cloud environments. Mandiant and CrowdStrike bring incident-response brands and large expert teams. Mitiga’s wedge is the connective tissue: long-lived forensic data, behavior-based runtime detection, cross-service attack reconstruction and response expertise sold together.
AI arrives after the evidence
Mitiga launched Helios AIDR in June 2025, beginning with AI Insights for alert triage and investigation. The more interesting choice is architectural: the AI sits on top of the forensic data layer. It is asked to summarize connected evidence, prioritize incidents and suggest response rather than manufacture certainty from isolated alerts. By 2026, the company widened its language again, calling the category “agentic runtime security” and adding AI agents, non-human identities and third-party services to the territory it wants to defend.
The funding followed the expanding claim. Mitiga raised $25 million in 2021, completed a larger Series A financing path that brought reported total funding to $45 million by 2023, added Cisco as a strategic investor, and closed a $30 million Series B led by SYN Ventures in January 2025. Press coverage valued the company above $100 million in 2023. A month after the Series B, founding CEO Mozes moved to chief business officer and Deepwatch founder Charlie Thomas became CEO, a handoff designed for expansion in North America and Europe.
Mitiga said it doubled its workforce during 2025 and grew new sales 234 percent year over year. Those are company-reported figures, not audited public accounts, but they explain the louder 2026 posture. The firm joined Torq’s alliance program, built a 25-member CISO advisory board and pushed beyond cloud detection toward stopping attacks in motion. Its RSA Conference Innovation Sandbox finalist slot in 2024 gave it industry visibility before that acceleration.
Sell the painful manual outcome before polishing the product. Instrument every engagement. Look for repeated evidence gaps, not merely repeated customer requests. Automate only after the team can explain the work, and preserve the raw material so later tools - including AI - can show their reasoning.
The conditions behind the promise
The model has boundaries. A small company with one cloud, a handful of SaaS tools and no security-operations team may not need a cross-environment investigation layer. A business unwilling or unable to provide audit telemetry will starve any detection platform. Teams looking only for configuration scanning may be better served by a posture product. Automated containment also requires trust, careful permissions and rehearsed rollback; switching it on without governance can create a new operational hazard.
Nor does “zero impact” mean zero compromise. It is Mitiga’s positioning for catching and containing activity before material damage, not a guarantee that every attacker leaves empty-handed. The more defensible claim is narrower: when cloud evidence is collected continuously, normalized across services and placed in front of an investigator quickly, the organization has a better chance of deciding while the decision still matters.
That brings Mitiga back to its original lesson. Cloud response was not slow because investigators lacked talent. It was slow because the evidence was scattered, short-lived and written in dialects belonging to different vendors. The founders charged into that inconvenience first. The platform is their attempt to ensure the next investigator does not have to start there.