Vega Raises $120M Series B for AI-Native Security Operations

A security analytics startup founded by Granulate’s former research lead raised $120 million to create an artificial intelligence-native operating model for security operations.

See Also: Proof of Concept: Bot or Buyer? Identity Crisis in Retail

The Accel-led Series B funding round will help New York-based Vega build on existing capabilities around analytics, detection engineering and threat hunting and expand into AI-driven triage, investigations and full life cycle security operations, said co-founder and CEO Shay Sandler. Analytics is foundational since without contextualized, accessible enterprise data, AI can’t deliver meaningful outcomes, Sandler said.

“We built a very strong foundation that proved to the market that there is a new alternative operating model that can serve the enterprises at scale,” Sandler said. “We have very, very big customers that want to see Vega as the future of detection and response. And in order to really capture this and really bring them the value that they need, we need to accelerate very fast.”

Vega, founded in 2024, employs 121 people and has raised $185 million, having last closed a $65 million Series A funding round in September also led by Accel. Vega has been led since its inception by Sandler, who spent nearly five years as a security researcher in the Israeli Military Intelligence’s Unit 8200 before leading research at Granulate for three years. Granulate was bought by Intel for $650 million (see: Vega Secures $65M to Scale SecOps, Take On Traditional SIEMs).

Why Analytics, AI Agents Are Better When Distributed

The Series B will help Vega invest across product, AI research, broader deployment models including on-premises and air-gapped environments, and global go-to-market expansion, Sandler said. Accel’s continued involvement signals belief in building a category-defining company rather than a short-term exit play, Sandler said.

“There is a very, very big market opportunity right now,” Sandler said. “The customers want it, and it requires us to accelerate product, to accelerate go-to-market and to really go and capture the market.”

Rather than forcing customers to migrate data into a centralized platform, Sandler said Vega enables analytics and AI agents to operate across distributed data sources. This architecture enables AI agents to run detection logic, investigations and reporting on top of comprehensive enterprise context, Sandler said.

“The founding block of it is enabling AI-native analytics and natural language queries to run on top of anywhere the enterprise data lives,” Sandler said. “This is the interface, the operating model for agents to run and deliver value across all the verticals of security operations, building detections, marking blind spots, doing investigations, hunting for threats and even creating reports.”

How Life Cycle Integration Enables Faster Maturation

Vega’s focus on detection engineering and threat hunting was grounded in the principle that prevention is imperfect, and the true value of security teams lies in identifying threats before they materialize into incidents. Many organizations lack the ability to run meaningful detections across all their data because of architectural limitations, and may experience fewer alerts because they lack visibility, Sandler said.

“The purpose of security operations is to detect threats early,” Sandler said. “This is the goal, to stop threats as early as possible before they materialize. The perfect prevention is impossible. And hence detection is the bigger value you bring to the organization. A lot of organization didn’t have means to run detections and to hunt for threats because the data was so all over the place.”

In traditional models, detection tools and triage systems operate separately, preventing reinforcement learning between them, but Harrison said Vega aims to create a continuous cycle where insights from investigations improve future detections. Life cycle integration is what allows organizations to mature continuously rather than restarting from zero during migrations or infrastructure shifts, Harrison said.

“When you have one tool for the detections and the triage is another place, there is no reinforcement learning,” Sandler said. “So, the continuous life cycle will really enable the organization to mature and keep the content growing and improving over the life cycle of the organization. What happens now often is when organizations move to another cloud, they lose all the content.”

Vega supports customers keeping data wherever it resides to reduce compliance complexity for highly regulated sectors such as banking and pharmaceuticals, Sandler said. This accelerates time-to-value and lowers resistance from security teams that can’t afford large migration projects, Sandler said.

“To achieve security operations value in the traditional model, it takes time and migration complexity,” Sandler said. “We want to enable them to achieve AI-native outcomes as soon as possible. And this is why, from day one, we in Vega were operating very hard and developing very deep tech technologies to operationalize data in commodity storages and enable organizations to leverage their environment.”