A security operations center can own excellent detection tools and still lose to arithmetic. Every sensor sends an alert. An alert asks for a decision. A person has only so many decisions in a shift. Chris Calvert, who had built security operations centers for large organizations, had watched that arithmetic turn expensive software into an unattended inbox. The premise behind Respond Software was almost embarrassingly specific: automate the judgment that sits between finding something odd and deciding it needs action.
- Respond Analyst joined evidence from existing security tools and investigated alerts automatically.
- Its buyers were enterprise security teams, government bodies and managed security providers.
- FireEye reported more than 150 customers when it bought Respond in November 2020.
- The useful lesson: choose one costly decision in a workflow, then make its evidence and handoff explicit.
The little human in the middle
Calvert had worked in government intelligence and commercial security, including IBM and ArcSight. In a 2018 interview, he described the industry's awkward arrangement: millions spent on detection, carefully prepared response processes, and a comparatively small human team between them deciding what deserved escalation. Respond's founders did not set out to invent another alarm. They wanted to make that middle decision repeatable.
Mike Armistead brought the software company experience. Robert Hipps led engineering. Calvert brought the operational scars. Together they founded Respond in Mountain View in 2016. Calvert later said the first nine or ten months were, in effect, a science project: could advanced probability methods reproduce how trained analysts reasoned through an event? The founders had a hypothesis before they had a scalable business. They tested the hypothesis, then raised a $12 million Series A in 2017 from CRV and Foundation Capital.
“We founded Respond Software to give cybersecurity teams a product that emulates - at scale - the judgement of expert security analysts.”Mike Armistead, 2019 company announcement
The result was Respond Analyst. It took evidence from network and endpoint controls, threat intelligence and data repositories, then assembled the context of a possible attack. By 2020 the company called it an XDR engine, the fashionable term for detection and response across several kinds of security tool. The older phrase, robotic decision automation, said more about the ambition. A rule can say “if this, then that.” Respond wanted software to weigh incomplete evidence the way a capable analyst would, and to tell the human team which situations merited a closer look.
The product in three moves. Respond sold the decision layer between sensors and responders.
A customer tested the night shift
Kyriba, a financial technology company, offers the clearest public account of what this meant in practice. It already ran several security services. Palo Alto Networks controls and McAfee endpoint antivirus fed data through Splunk. Respond Analyst plugged into that architecture through APIs. The customer story says setup began in February 2019 and the product was ready the next month. Kyriba then ran an internal red-team exercise to see whether the automated colleague noticed an attack. It did, according to the company's security team.
The remarkable claim in that case study is not that software found one simulated attack. It is the scale of the queue. Kyriba said that, over one month, Respond monitored 138 million events and escalated nine incidents, with all nine judged accurate by its team. The same material reports a 90 percent decrease in noise volume. Those are customer-reported results, not a universal performance guarantee. They do show the product's intended exchange: fewer routine reviews for humans, more time to hunt threats and respond to incidents.
Kyriba's team said human analysts worked from 7 a.m. to 7 p.m., while an on-call responder handled overnight escalations. That is less cinematic than replacing the SOC. It is also a more credible account of what the software could do: watch continuously, make the first pass, and let people deal with the cases that survived it. Respond still depended on good input data, integration with the customer's stack and humans capable of acting on the result.
It sold judgment by way of existing tools
Respond's sales argument was shaped by a common buyer's complaint: the security team had already paid for plenty of sensors. Asking that team to replace them all would be a hard sell. In its September 2020 release, Respond said Analyst connected more than 65 kinds of security sensor and IT device, added a model for identifying lateral movement, and mapped incident scope to MITRE ATT&CK. E*TRADE security executive Colin Henderson said the value was in scaling across the tools already in his environment. Skout Cybersecurity, a managed provider, described using it to connect suspicious events without flooding its customers with false positives.
This put Respond in an interesting market position. Traditional SIEM products collect and search events. SOAR products can execute response workflows. Managed security providers supply human monitoring. Respond's claim was the piece in between: deciding whether disparate events add up to an incident worth a workflow or a phone call. The company sold software to enterprises and through resellers and managed service providers. It also launched a First Responder managed detection and response service in 2019. Public list pricing was not published; sales material directed buyers to discuss return on investment with an account team. The actual cost therefore depended on a negotiated deal, not a self-service plan.
The channel mattered. In September 2020, Respond announced 23 new value-added reseller and managed service partners. A month later, it disclosed an alliance with Earthling Security, which would offer the Analyst through its managed service and advise Respond on FedRAMP work connected to a U.S. Air Force contract. FedRAMP authorization was a goal in that announcement, not a finished credential. The plan nevertheless showed the attraction of the model: one investigation engine could serve customers with quite different security stacks.
The price of an answer
ClearSky led a $20 million Series B in May 2019, with CRV and Foundation Capital joining. Respond said it would put the money into sales and customer operations. By the time FireEye announced its acquisition on November 18, 2020, the buyer's presentation counted 43 Respond employees and more than 150 customers across finance, energy, retail and government. The transaction was valued at about $186 million in cash and stock, excluding assumed unvested options. FireEye said the XDR engine would enter Mandiant Advantage and could save two to four years of internal development.
A later FireEye filing called the product Mandiant Defense, formerly Respond Security Analyst. Respond as an independent company was over. The idea survived the name change: a tool that makes existing security products more useful by deciding what their evidence means. Its story is a useful warning to anyone building “AI for operations.” Volume alone is not a product thesis. Respond found the particular decision that volume was making impossible, tested it against a customer's real workflow, and gave the next person in line a case to act on.
There are conditions to that lesson. If the inputs are thin, badly configured or missing the evidence needed to distinguish an attack from normal work, an automated investigator has little to reason with. If the team cannot verify escalations and respond, a shorter queue solves only half the problem. And if the buyer has few alerts in the first place, the economics of automation are less compelling. Respond's own best example started with 138 million events. That is a scale at which even diligent people need help counting.