Yasir Khalid spent ten years helping computers spot trouble. At FireEye, he led work on zero-day detection, the business of finding attacks that arrive before the usual warning labels. He helped develop a second generation of detection products. Then he founded a company concerned with the next question: what happens to the person who receives the warning?
An alert can be accurate and still leave plenty of work behind. Someone has to establish what happened, identify the affected systems and decide what to do. Khalid’s career took him from the machinery that raises the alarm toward the machinery that helps a defender answer it. There is a modest comedy in this progression. An industry can become very good at saying “Look over here” while leaving someone else to work out why.
StrikeReady, founded in 2019, is his attempt to shorten that distance. Its audience is the security operations centre, or SOC, where analysts investigate threats and coordinate responses. Khalid’s recurring concern is the defender’s working day: how much expertise it demands, how much context gets scattered and how much useful time disappears between tools.
The detector builder changes his question
Khalid studied computer engineering at COMSATS Institute of Information Technology in Lahore, studying there from 2004 to 2008. His subsequent work put him close to the technical problem at the centre of cybersecurity: recognising hostile activity when it does not announce itself politely.
At FireEye, his responsibilities included its Zero Day Detection initiative and the development of its second-generation threat detection technology. He is credited with 17 patents. That is a substantial technical chapter before the founder title enters the picture. It also helps explain why StrikeReady’s origin is rooted in the practical use of detection rather than a sudden discovery that computers might assist analysts.
After FireEye, he built a deep learning threat detection team at Blue Hexagon, where he served as head of threat intelligence and operations. The sequence matters. Detection, machine learning and operational responsibility all appear in his background before StrikeReady. The later company brought those strands into the same room.
By the time Khalid started StrikeReady, the question had widened. An organisation could own capable security products and still struggle to use them together. Better individual instruments did not automatically make an effective ensemble. Somebody still had to conduct, often while the music was already playing.
A company assembled around the handoff
StrikeReady’s early team included people who had worked at FireEye across engineering, threat research and other parts of the security business. Anurag Gurtu, its co-founder and chief product officer at the public launch, brought experience from Splunk, FireEye and Cisco. Khalid was building with colleagues who knew the tools and the effort required to operate them.
Before its public debut, the team described conversations with hundreds of analysts and chief information security officers. Three difficulties kept returning: gaps in skills, a shortage of experienced people and weak collaboration. The resulting product aimed to connect existing security investments and help people extract more use from them. There is a founder’s choice embedded here. Khalid chose the awkward space between products as a place to build a business.
In April 2021, StrikeReady emerged from stealth with $3.6 million in seed funding led by 11.2 Capital, alongside Outlier Venture Capital and angel investors. It said deployments already included enterprises and government agencies in the United States and overseas. The money would support sales, market entry and research and development.
Khalid described a “human-centered approach” and wanted analysts to develop expertise “without off-the-job training.” The phrasing is revealing. Learning would happen alongside the investigation, where an answer has immediate use. The ambition was to make experience more available at the moment someone needed it.
The assistant has a job description
That idea took a recognisable form in CARA, StrikeReady’s digital cybersecurity analyst. In its early incarnation, the assistant used a natural language interface to help defenders access knowledge and automation. The appeal was straightforward: ask for help in the language of the task, rather than first learning the private dialect of every product involved.
In a 2022 interview, Khalid described the competing demands of proactive security and reactive investigation. Threat hunting and vulnerability management require attention before an incident; forensics and response require it afterwards. His platform was intended to support both, with guidance informed by the working environment and the analyst’s actions.
That puts an unusual emphasis on the assistant’s surroundings. A conversational interface is only the visible part. The useful work depends on what it can know about the organisation and what actions it can carry out. Khalid’s early description connects assistance to accumulated operational knowledge, a theme that remains central to StrikeReady’s later architecture.
For a founder with a detection background, this is an intelligible expansion of scope. Finding something suspicious starts a chain of decisions. Helping with the chain means dealing with context, permissions, different products and human judgment. The assistant may have a friendly name; its employment contract is rather demanding.
The well-kept secret gets investors
In April 2024, StrikeReady announced a $12 million Series A led by 33N Ventures. Hitachi Ventures and Monta Vista Capital participated, as did Brian NeSmith, Arctic Wolf’s executive chairman and former CEO, and Rod Beckstrom, the former ICANN chief and founding director of the US National Cybersecurity Center.
Khalid said customers had called StrikeReady a “well-kept secret.” The new money was meant to help change that, funding the company’s product work, global commercial team and infrastructure. The founder’s job now included making the business easier to discover, alongside making the product useful.
The investor argument echoed the original product choice. Security teams should be able to choose different tools and still operate them coherently. That position gave Khalid a clear commercial proposition: make the equipment an organisation already owns work together more effectively. For a buyer with years of accumulated technology, keeping useful investments has an understandable charm.
By then, the company was based in North Texas, with additional offices reported in Fremont, Lahore and Dubai. Its reach had become international, while its core complaint remained familiar. Different tools, fragmented information and a finite number of people continued to shape the work.
Knowing when to use the expensive brain
StrikeReady now describes its architecture as Composite AI. The company’s platform combines deterministic processes with models capable of more open-ended reasoning. Repeatable work can follow established steps; a judgment call can draw on a richer model. The intention is to fit the method to the task.
The platform builds a standing memory of assets, identities and other environmental information, then brings that context into investigations. It also offers choices about action: automation, human approval or analyst initiation within configured controls. Its stated design includes a record of the evidence, reasoning and actions so the result can be reviewed.
- Gather contextConnect the evidence already held in security tools.
- Choose the methodUse repeatable steps or deeper reasoning as the task requires.
- Act and recordApply configured controls and retain the investigation trail.
Read as a continuation of Khalid’s career, the architecture suggests a preference for engineering around the whole investigation. The alert, the environment and the response all need a relationship. Giving a model a clever answer to produce is easier to describe than giving it reliable organisational context. The latter occupies much of StrikeReady’s product argument.
For the analyst, the practical test is whether a previous investigation leaves something useful behind. Starting again with every alert would squander the knowledge already acquired. Khalid’s emphasis on assistance gives the product a demanding standard to meet: make the organisation’s experience available beyond the person who first acquired it. That is also where collaboration becomes a software problem. Shared knowledge has to survive the handoff between people, shifts and systems if it is going to help the next decision.
A meter becomes the next adversary
By September 2026, Khalid was addressing another constraint: the economics of investigating. StrikeReady announced investment led by Wa’ed Ventures, Aramco’s domestic venture capital arm, bringing its reported total funding to $29 million. The company tied the investment to expansion in the Middle East and North Africa.
“We’ve seen this movie three times now,” Khalid said, discussing pricing tied to data ingestion, playbooks and AI investigations. His concern was that consumption charges encourage teams to ration analysis. StrikeReady’s current offer is unmetered investigation, with pricing based on the customer’s environment. The commercial promise follows the technical one: using the system more should remain practical.
“The Kingdom is our largest market outside the United States.”
Yasir Khalid · September 2026
The company announced plans for a Saudi subsidiary as its regional headquarters, local talent development and partnerships with Saudi institutions. It also described deployment in Google Cloud’s Saudi region and a self-hosted option. For Khalid, international expansion now includes where the data resides and how customers can control it.
There is also a less technical side to his public role. During Black Hat 2026, he was billed as the host of a small industry evening at Azuza Lounge in Las Vegas. The invitation offered food, conversation and a look at StrikeReady away from the conference floor. Even a company selling automated coordination still makes room for people meeting in person.
The line through Khalid’s work is the distance between recognising a threat and dealing with it. FireEye gave him years inside the first problem. StrikeReady has given him seven years pursuing the second, across software, staffing, collaboration and now pricing. His wager remains practical: a warning earns more of its value when the person receiving it has the means to act.