Fig Security Raises $30M to Modernize SOC Infrastructure

A startup run by a former Google security architect leader raised $30 million to provide observability across the entire security operations infrastructure.

See Also: AI Agents Are Rewriting Risk for SOC Teams

The Ten Eleven Ventures-led Series A funding round will help New York-based Fig Security visualize for SOC engineers how data flows across systems such as SIEMs, data pipelines and automation platforms, said co-founder and CEO Gal Shafir.

Fig’s platform identifies silent failures, infrastructure drift and detection breakdowns that can cause organizations to miss critical security threats, Shafir said.

“Everyone understands that their SOCs are changing,” Shafir told Information Security Media Group. “Nobody knows what it’s got to look like in a couple of years, more technologies are joining. Yet CISOs today and organizations have no confidence in their foundation, in the reliability and efficacy, in the resilience of their SecOps infrastructure that is just getting more complex now these days.”

Fig, founded in 2025, has raised $38 million, having also completed an $8 million seed funding round led by Team8. The company has been led since inception by Shafir, who spent nearly four years as director of global sales engineering at Siemplify before it was sold to Google in January 2022 for a reported $500 million. Shafir was then head of global security architects for Google SecOps until April 2025 (see: Google Buys Siemplify to Bolster Security Analytics Tools).

Why SecOps Hasn’t Undergone the Same Changes as DevOps

Modern security environments are composed of multiple vendors, data pipelines, analytics systems and automation platforms. That creates operational complexity, since each tool may process data differently and interact with other tools in ways that may not be fully transparent to the security team. They often struggle to maintain a clear understanding of how their detection pipelines actually function.

“Fig is really there to give those organizations and engineering teams control over their complex and fragile and fragmented infrastructure,” Shafir said.

Fig addresses this problem by creating a comprehensive map of the entire infrastructure, which analyzes the various components of the SecOps stack and builds a graph that shows how data flows between them, Shafir said. This visibility helps organizations detect silent failures, which Shafir said occur when data stops flowing correctly through the system but does not generate an obvious error.

“Our goal was never to be a part of the infrastructure. We actually look at the entire infrastructure from above, giving those engineers the observability to actually see their infrastructure for the very first time,” he said. “That’s the ‘wow’ moment we see from our customers. And then to find issues and silent failures across that infrastructure that right now prevent their ability to detect and respond to threats.”

In the DevOps world, teams use observability platforms, CI/CD pipelines, automated testing frameworks, and infrastructure-as-code tools to help engineers deploy changes safely and confidently, Shafir said. But security operations has not yet undergone a similar transformation, meaning SOC teams still rely heavily on manual processes to manage detection rules, data pipelines and infrastructure changes.

“The way we look at the world is the same way that DevOps engineers run and develop their complex infrastructure with tools like Datadog and CI/CD and Claude Code,” Shafir said. “We like to call it DevOps for SecOps. We want to be that one place where SOC engineers come to run their complex infra, ensure it’s resilient through change, expend coverage and deploy to production with confidence.”

How Fig’s Knowledge Graph Can Help With Detection Rules

Security teams often make changes to their infrastructure without fully understanding the downstream consequences. Modifying a data pipeline might remove a field used by a detection rule, causing the rule to stop working. Fig addresses this challenge by analyzing how a proposed infrastructure change would affect the entire system before it is deployed and identifies potential issues before they occur.

“It gives me the ability to simulate those changes throughout my entire infrastructure, to understand their impact and outcome before pushing anything to production, which is far from how it’s done today,” Shafir said.

Once Fig’s knowledge graph exists, Shafir said the platform could help security teams create detection rules automatically by analyzing their infrastructure and generating logic that works with their specific data formats and pipelines. This could reduce the work required to implement threat detections since a majority of the effort today involves adapting the rule to the organization’s unique data environment.

“Beyond suggesting and telling me what’s the root cause and what’s broken, Fig tells me, ‘What do I need to do in order to fix it?'” Shafir said.

Making changes to security infrastructure such as adding a detection rule or modifying a parser can be risky and time-consuming since engineers often must manually analyze how the change might affect other parts of the system. Shafir said Fig aims to introduce several capabilities that mirror DevOps practices to reduce the risk of introducing errors that could disable security monitoring.

“Everybody invests in attack resilience all the time, but you can’t have cyber resilience if you don’t have operational resilience,” Shafir said. “And that’s really the missing piece to get into cyber resilience that Fig is focusing on.”