We Rebuilt Security Operations. It's Called AI-Gen.

Today we're announcing a $25 million investment co-led by Cheyenne Ventures and AVP, with continued participation from Crosslink Capital and Rally Ventures. The round brings Abstract's total funding to nearly $50 million, and it comes after a year in which we grew annual recurring revenue 380%, reached 264% net revenue retention, and tripled our customer base.

We've believed one thing since the day we founded Abstract: the architecture behind security operations needed to be rebuilt. So we rebuilt it. We call it AI-Gen Security Operations, and it's what our customers run today.

For more than two decades, SIEM has been the foundation of security operations. It still is, but the form it takes is shifting.

For years the industry has debated whether SIEM is dead, which misses what's actually happening. SIEM is best understood as a capability: the discipline of collecting security data, detecting threats, investigating incidents, and responding at enterprise scale, rather than any single product, box, or platform. That mission matters as much today as it did twenty years ago.

What is changing is that new systems are starting to absorb the old SIEM architecture rather than sit beside it. As they do, they begin to look more like SIEM, not because they are copying it but because they are taking on the same responsibilities, though in a fundamentally different way.

The architecture behind the first generation of SIEM was exactly what the industry needed at the time. Organizations centralized their security data, correlated events after they were stored, and investigated incidents from a single platform. It solved a real problem for a different era.

Then the world changed. Infrastructure moved to the cloud, enterprises went multi-cloud, and SaaS spread across every department. Machine-generated telemetry grew from gigabytes to terabytes, and increasingly to hundreds of terabytes a day. Attackers accelerated from human speed to machine speed. The architecture didn't keep up.

Security teams spent the last decade feeding every log into one platform and watching the bill climb as data volumes grew. Detection happened after everything was already written to storage. Visibility turned into a cost problem. And because moving data became harder than moving applications, organizations found themselves locked into a single vendor's architecture and roadmap. That's the pattern we set out to break.

What composable actually looks like

We believe the future of security operations is composable, which is a matter of better architecture rather than more products.

Collection should be independent of storage. Data should be routed based on business value rather than licensing constraints. Detection should happen while data is still in motion, not minutes later once indexing completes. Long-term retention should live in low-cost object storage rather than expensive indexed infrastructure. And security teams should be free to choose the tools that fit their business instead of being forced into one vendor's ecosystem.

That's exactly how we designed Abstract. Our streaming data pipelines ingest telemetry from virtually any source, enrich and normalize it in real time, and route it to one or many destinations in the schema each one expects, including OCSF, ECS, and CIM. At the same time, detections run directly in the stream, so organizations can identify threats before data ever reaches storage. That changes both the speed and the economics of security operations.

AI is not a standalone product in this picture. We call our platform AI-Gen rather than Next-Gen because we believe AI belongs throughout the architecture, not beside it. Astro AI assists analysts across detection, triage, investigation, and response, reducing manual effort while improving consistency and decision making. We built AI into every layer of security operations rather than bolting it onto the SOC as one more feature.

The result is something security teams haven't had in a long time: choice. Choice over where data lives, where it is stored, and how long it is retained. Choice over which analytics, investigation, and response technologies they use. That's what composable security operations really means.

Where we're investing

This funding lets us accelerate the roadmap we've been executing since day one. We'll widen our in-stream detection coverage so more threats can be identified before they reach downstream systems. We'll extend Astro AI across the entire SOC workflow so AI is a practical assistant at every stage of an investigation. And we'll keep growing our go-to-market team to match enterprise demand. It's the same direction we've had since day one, now with the resources to move faster.

Thank you

First, thank you to our customers. You trusted us before composable security operations was an industry conversation. You challenged us, pushed us, and helped shape the platform we have today. Every milestone we've reached started with your willingness to think differently about security operations.

Thank you to the entire Abstract team. Building a category takes conviction, resilience, and an enormous amount of work. I'm proud of what we've built together and even more excited about what's ahead.

And thank you to the teams at Cheyenne Ventures and AVP, and our partners at Crosslink Capital and Rally Ventures. We appreciate your confidence in the vision and your partnership as we build the next chapter of Abstract.

The funding gives us more room to do the work we're already doing: executing for our customers, pushing the architecture forward, and building the generational cybersecurity company we set out to create.

If you want to see the platform, we'll be at Black Hat USA, Booth 5918, August 4 through 6.

‍