Abstract has raised $25 million in funding to expand its composable security operations platform as enterprises seek alternatives to traditional security information and event management systems. The round was co-led by Cheyenne Ventures and AVP, with participation from Olive Hill Ventures. Existing investors Crosslink Capital and Rally Ventures also joined the financing. The investment brings Abstract’s total funding to nearly $50 million.
Abstract plans to use the capital to expand its in-stream threat detection capabilities, extend its Astro AI technology across additional security operations workflows, and grow its go-to-market team to meet enterprise demand.
The financing follows a year of substantial commercial growth. Abstract increased annual recurring revenue by 380%, achieved net revenue retention of 264% and tripled its customer base.
Net revenue retention measures how much recurring revenue a company retains and expands from existing customers after accounting for upgrades, downgrades, and cancellations. A rate above 100% indicates that growth from existing customers more than offset lost or reduced accounts.
Abstract also made 40 strategic hires during the year to support its enterprise expansion.
Founded in 2023, Abstract is developing what it calls a composable security operations platform. The system is designed to give organizations greater flexibility over how they collect, analyze, route and store security data.
Traditional SIEM platforms generally collect logs and other security information from across an organization, store the data in a centralized system and then analyze it for suspicious activity.
As the volume of security information grows, this model can create significant storage and processing costs. It can also tie an organization to one vendor’s data architecture, analytics tools, and pricing structure.
Abstract separates data sources from the systems where information is ultimately stored or analyzed. This approach allows companies to route different categories of security data to different destinations rather than sending everything into one platform.
The company’s streaming-first architecture can analyze data while it is moving through the system. This allows threat detection to occur before the information reaches long-term storage.
Earlier detection could help security teams identify suspicious activity faster and reduce the amount of unnecessary data sent to expensive storage or analytics platforms.
Abstract can also classify and route data based on its value, purpose and retention requirements. Organizations can send high-priority security information to active detection systems while directing lower-value logs to less expensive storage.
The platform transforms data into the schema required by each destination. Supported formats include the Open Cybersecurity Schema Framework, Elastic Common Schema and Splunk’s Common Information Model.
Standardizing security data can make it easier for organizations to use multiple analytics, storage and response tools without manually converting information for each system.
Abstract calls its broader approach AI-Gen Security Operations. The model combines streaming detection, composable architecture and artificial intelligence across the security operations center workflow.
A security operations center, commonly known as a SOC, monitors an organization’s systems for cyber threats and coordinates investigation and response activities.
Abstract’s Astro AI technology is designed to support detection, triage, investigation and response. The company positions AI as a foundational element of the platform rather than a separate feature added to an existing security product.
The system can help analysts review alerts, identify relevant patterns and investigate threats using security data from across an organization’s environment.
Abstract said its architecture allows enterprises to maintain control over their data, costs and technology choices while still applying AI across security operations.
The platform is designed to operate across hybrid and multicloud environments. This can help organizations manage security information from on-premises infrastructure and services hosted through multiple cloud providers.
Abstract is available through the Amazon Web Services, Microsoft Azure and Google Cloud marketplaces.
The company was founded by cybersecurity professionals with experience at ArcSight, Bank of America, Mandiant and Palo Alto Networks.
Abstract believes the security industry is entering a platform transition as enterprises reconsider whether all of their security information needs to be stored and analyzed within one SIEM ecosystem.
The company expects increasing AI adoption to make data architecture more important. AI security tools depend on accurate, accessible and properly structured information to generate reliable results.
Abstract’s investors believe organizations that maintain control over how security data is routed and analyzed will be better positioned to use AI without becoming dependent on a single technology provider.
KEY QUOTES:
“For more than two decades, SIEM has been the foundation of security operations. AI-Gen Security Operations is what’s next.”
“It gives organizations control over their data, runs detections while data is still in motion, and embeds AI into every stage of detection, triage, investigation, and response.”
“We built Abstract around that vision from day one because AI isn’t a feature bolted onto the SOC. It’s woven into every layer of security operations. This investment gives us the resources to continue building a generational cybersecurity company.”
Colby DeRodeff, CEO and Co-Founder of Abstract
“Every major platform transition creates a new systems architecture, and security operations is entering one of those moments.”
“Enterprises no longer want to be forced into a single data platform just to detect threats. Abstract has built the architecture for that next generation. Streaming-first. AI-native. Composable.”
J.R. Becko, Partner at Cheyenne Ventures
“We back founders with the depth and conviction to build something category-defining, and Abstract has both.”
“The teams that come out ahead will be the ones that own their data, route it on their terms, and detect in real time rather than after the fact. Abstract is building the platform to get them there.”
Manish Agarwal, General Partner at AVP
