Startup Exaforce Nabs $75M to Grow AI-Powered SOC Automation

A startup founded by the leader of F5’s security products business raised $75 million to automate previously human-dependent tasks in cybersecurity.

See Also: The Future of SIEM: Revolutionizing the Analyst Experience

Exaforce said the Series A proceeds will help the Silicon Valley-based company build a robust platform capable of ingesting diverse data sources and enable advanced agentic capabilities that replicate human analytical behaviors, according to CEO Ankur Singla. The company wants to build automated workflows that mimic human SOC analysts to streamline investigations and dramatically improve response times.

“The next three-to-four years will be spent on building up the product side and R&D, that’s going to be the focus,” Singla told Information Security Media Group. “And then working with the design partners, working with early customers, the sales investment is not going to be radical. It’s going to be a small, very targeted investment, because we are going after large enterprises.”

Exaforce, founded in 2023, employs 46 people, up from just 15 employees a year ago. The company has been led since its inception by Singla, who founded application delivery platform Volterra in 2017 and sold it to F5 in January 2021 for $500 million. After the sale, Singla led F5’s security products group until November 2022, when he transitioned into an advisory role (see: New Year Kicks Off With Vendor Consolidation).

How Exaforce Plans to Put the $75M to Work

With artificial intelligence reaching a level of maturity capable of enabling complex SOC automation, the $75 million raise will allow Exaforce to build a platform that wasn’t previously feasible with legacy tools, Singla said. This capital is intended to sustain long-term R&D efforts, reduce reliance on future funding, and align with deep technology development cycles that cybersecurity infrastructure demands.

“We’re building our own AI model that is specifically suited for cybersecurity as well as operations use cases,” Singla said. “And building a model just takes time. It takes a little bit of capital, and it takes the engineering skillset that you need, and that requires the kind of funding level that we raised.”

Instead of relying on human rules, Singla said agentic capabilities enable the platform to autonomously gather data, reason over it, analyze context, and even engage users or historical tickets to determine a course of action. While remediation actions like resetting MFA or quarantining VMs can be automated via scripts, the real power lies in automating daily, repetitive human analysis tasks that drain bandwidth.

“The big benefit is this is automatically done by the system in under two minutes, so the team can focus on more strategic priorities rather than mundane work of going and triaging a launch,” Singla said. “So, from our point of view, that’s the biggest net benefit in the agentic workflows.”

Exaforce’s road map includes expanding both horizontally by integrating more types of data such as SaaS, IaaS and developer tools as well as vertically by supporting more vendors such as Bitbucket in addition to GitHub and SentinelOne alongside CrowdStrike. Cloud infrastructure platforms can take eight-to-12 months for initial integration, while identity platforms like Entra ID or Okta can be done in weeks.

“What we think is very important for solving the problem holistically is to look at logs, code, config, threat feeds, identity data, all of that,” Singla said. “For us, onboarding a data source means putting all of those five elements together. A core part of the thesis is to provide a holistic overview of the data that we are to basically analyze. So, that’s the first ingredient.”

How Exaforce Stacks Up Against the Competition

Singla rejects the notion of heavy early sales investment, opting instead to perfect the product with design partners before scaling commercialization. He projects that meaningful sales and marketing investment will begin in late 2025 once the platform has matured through work with design partners. Exaforce is focused on large enterprises with revenues over $5 billion that have well-established SOCs.

“What I’ve seen in my last 10 years of managed cybersecurity services is that companies typically above this threshold are at a point where they truly need to improve productivity and efficacy of their SOC,” Singla said.

Exaforce’s most credible competition comes from XDR vendors including Palo Alto Networks and CrowdStrike, which have a broad understanding of real-time data processing and endpoint behavior, but Singla said Exaforce’s approach of leveraging code, identity, configuration and threat feeds offers differentiation. Legacy SIEM vendors are too entrenched in log-centric thinking and enabling human analysts, he said.

“The large companies that are building traditional SIEMs and outsource to help humans, they haven’t been able to fully automate this work yet,” Singla said. “I think it’s they are not yet players, but I do expect them to become players over time.”

The immediate value of Exaforce lies in augmenting human analysts rather than replacing them since the CISO is under pressure to deliver more security outcomes without ballooning the budget, Singla said. Exaforce boosts the effectiveness of existing staff, helping teams process more alerts, respond faster and build more resilient coverage – all without increasing headcount or infrastructure costs, Singla said.

“The main point for a CISO is, ‘How can I get much better coverage at the same cost point, or a lower cost points than I have today?'” Singla said. “I think that should be the most important metric for a CISO, and to do that, the more automation you have, the more you can do at the same cost. And we enable that. Our goal is to let the CISO do a lot more in his current budget.”