Cyderes Bets on Lucidum to Drive AI-Backed Identity Security

Cyderes purchased an asset visibility and identity telemetry startup led by Splunk’s former CISO to center identity as a primary driver within security operations.

See Also: AI-Powered Identity Fraud: What You’re Up Against

The Kansas City, Missouri-based cybersecurity services behemoth said its acquisition of Cincinnati, Ohio-based Lucidum will help connect disparate data sources quickly and cleanly, enabling high-fidelity insights for Cyderes’ AI engines, said CEO Chris Schueler. Consuming clean, structured data with minimal preprocessing will lead to a game-changing capability for preemptive threat detection, he said.

“I literally called my chairman, and I was like, ‘Hey, I think I may need to make an acquisition.'” Schueler told Information Security Media Group. “And he was like, ‘Okay, tell me about it.’ And I said, ‘Well, it’s a software acquisition.’ He’s like, ‘Well, we don’t buy software companies.’ And I said, ‘Well, I think we’re going to have to because I think this thing is going to be a pretty big game changer for us.'”

Lucidum, founded in 2020, employs 17 people and has raised $19 million, having completed a $19 million Series A funding round in November 2021 led by Point72 Ventures. The company has been led since inception by Joel Fulton, who spent more than three years as Splunk’s CISO, a year as Google’s global head of risk, and six years in Symantec’s global security office, including a year as deputy CSO (see: Cyderes’ New CEO Eyes Identity-Cybersecurity Convergence).

What Made Lucidum Appealing to Cyderes

The company was initially evaluated as part Cyderes’ broader search for platforms that could extend visibility beyond traditional SIEM systems, and quickly became the clear standout due to its extensive connectors and ability to process large data sets effectively. Lucidum specifically stood out for its rich ecosystem of connectors, ease of deployment, and particularly its patented data tagging system.

“We went on a three-month hunt and looked at a ton of different companies,” Schueler said. “And we decided, ‘You know what, these three can get us to the point where we can get visibility to those other ecosystems outside of the SIEM,’ and Lucidum was one of them. We put them through a pretty rigorous POC where we had a bunch of data pumping through it, and an army of people on it.”

The broader industry had finally matured to a point where identity could become a foundational layer in security rather than a bolt-on component, but to make this a reality, Cyderes needed visibility into data that lived outside of traditional SIEM platforms. By using Lucidum’s expansive data ingestion capabilities, Schueler saw the possibility of enabling proactive, identity-aware security operations.

“Cyderes obviously had one of the best security operations businesses and this tangential identity business as well that was quite powerful,” Schueler said. “To really make this happen, we need all the telemetry that doesn’t sit in a SIEM to be accessible, so we can actually have kind of the co-mingling of the right data elements from identity and all around awareness on the identity.”

Existing ITDR offerings didn’t have visibility beyond what a SIEM or endpoint detection system could see, and didn’t integrate well with identity sources or with contextual data from HR, training or credential systems. Lucidum opens up access to identity-related telemetry that sits outside traditional security ecosystems, including connectors into HR systems, training platforms, access governance tools, he said.

“We started the process with developing an ITDR service, but all of them were limited in what exposure you had,” Schueler said. “You couldn’t really build it on just SentinelOne or CrowdStrike, so that got us into the mode of like, ‘Maybe we need to open up our aperture.'”

How Cyderes, Lucidum Will Come Together

A full integration road map has been laid out, which includes replatforming efforts, overhauling backend infrastructure and ultimately creating a unified UI/UX experience for customers. The goal is to create a seamless interaction between Cyderes’ managed services and Lucidum’s software fabric, enabling a single-pane-of-glass view across diverse data stacks, from identity to endpoint to network telemetry.

“Our goal is, by the second half of this next year, to have one completely seamless view and one UI/UX experience,” Schueler said. “But as you can imagine, it’s a pretty heavy lift to get there. Even with vibe coding, it’s a pretty heavy lift to get there.”

Schueler envisions a future where behavioral telemetry such as an employee’s tendency to click on phishing emails or delay patching their system can be incorporated into real-time risk decisions. With this data, Cyderes can begin building adaptive risk models for individual users, meaning that if an employee regularly clicks phishing emails and is then targeted, the system would flag them as high risk.

“If I know Chris clicks the phishing attempt emails that we send out on a quarterly or monthly basis, and a threat comes in targeting Chris, immediately it goes to a pretty high risk,” Schueler said. “Because now I have like the corollary of, ‘Chris does dumb things because he clicks on stuff,’ and then also a threat that comes in.”

Cyderes hopes to see 100% adoption of the Lucidum platform across all managed services customers by the end of 2026. Already, Cyderes has signed 15 customers for Lucidum in the current quarter alone and is targeting 30 to 35 more clients in the first quarter of 2026. The true value of Lucidum lies in becoming the fabric of truth that both analysts and AI agents can rely on for clean, contextualized data.

“Our ultimate goal is to get 100% adoption of the mesh across our managed customers by the end of 2026,” Schueler said. “That is either through some of the components that are native through Lucidum that gives us additional connectors that we don’t have that clients have been asking for, as well as leveling up our service and be able to take it to that next level.”