Legion Security builds an agentic security operations platform that learns how a team’s own analysts investigate alerts and turns that practice into AI agents. It is aimed at SOC teams that want automation shaped around their real workflows rather than generic playbooks written from scratch.
Every SOC has its own way of working, much of it held in analysts’ heads. Legion turns that knowledge into agents that investigate alerts, clear false positives, escalate real threats and carry confirmed threats through to approved remediation.
At A Glance
| Vendor | Legion Security |
|---|---|
| Category | Security Operations (agentic AI SOC) |
| Deployment | Browser extension, no integrations or APIs required |
| Agentic AI | AI agents for alert investigation and response, gated by benchmarks |
| Customers | Virgin Money, IQ-EQ, The University of Tulsa, WELL Health Technologies |
| Certifications | SOC 2, ISO 27001, ISO 42001 |
| Funding | $30M Series A (July 2025) |
| Market classification | Security Operations |
What Legion Security Does
Legion captures how analysts handle cases in the browser, reads earlier cases and runbooks, and builds agents that repeat the same investigations. Its agents “reason where judgment matters and follow fixed steps where consistency does.” The work is not limited to the SOC: agents can cover identity, DLP, IT, GRC and vulnerability management tasks, and cases from several departments can be merged into one. Autonomy is earned rather than granted up front, and any action the customer chooses can be held for human approval.
Products
Learning Mode
Learning Mode records what analysts do as they investigate and respond, building maps of those investigations that the team can browse and reuse. A capture can start from a browser recording, a runbook or a past case.
Legion Investigator
Legion Investigator turns captured investigations into agents. The team reviews and refines each agent before deploying it, then investigates alerts and carries out approved responses with every step, decision and source visible and the logic open to editing. Agents start with pre-trained security expertise and improve the longer they run on a customer’s own cases.
DragonClaw
DragonClaw helps a team decide what to automate next. It shows which alerts, workflows and tasks take the most time, flags the workflows that are ready to become agents and turns investigation patterns into detection tuning mapped to MITRE ATT&CK. It also orchestrates: given a job, it works out the intent, chooses which agents are needed and coordinates them, asking for explicit permission before anything runs and using only approved tools and credentials drawn from secure vaults.
How It Works
Legion runs in the browser as an extension, so it can work across a team’s tools without integrations or APIs.
| Component | What it does |
|---|---|
| Capture | Analysts start and stop recording themselves, a browser level allow list restricts it to approved sites, customer defined masking rules redact sensitive data, and a built in DLP layer adds further protection. |
| Build | Captured context becomes two things: agents, for steps that need judgement, and automations, for steps that should always run the same way. Both are reviewed before deployment. |
| Act | Agents contain, eradicate and remediate threats within the authority the customer grants, and every action is kept in an audit trail with its evidence. |
| Data handling | Customer business data is not used to train models by default, and each organisation’s data is kept strictly separate. |
Agentic AI Capabilities
Benchmark Gated Autonomy
The customer defines the benchmarks and gates, and an agent acts on its own only after clearing them. Running an agent in parallel with analysts on live cases, and comparing its decisions one by one, gives the evidence for that decision. A team can therefore widen an agent’s authority step by step as its record builds, instead of switching autonomy on all at once. Because every action is logged with its evidence, the record behind each step can be reviewed later.
Integrations
| Area | Integrations |
|---|---|
| Technology partners | CrowdStrike, Netskope |
| Email and threat intelligence | Abnormal Security, Cofense, AbuseIPDB, AlienVault OTX, APIVoid, BrightCloud |
| Network and application security | Cisco Umbrella, Cloudflare, Apiiro, Axonius |
Company Background
| Founded | 2024 |
|---|---|
| Leadership | Ely Abramovitch (Founder and CEO), Eyal Fisher (Founder and CTO), Michael Gladishev (Founder) |
| Offices | Israel and New York |
| Funding | $30 million Series A in July 2025, led by Coatue with Accel and Picture Capital, plus angel investors from Wiz, Google and CrowdStrike |
| Availability | AWS Marketplace and Google Cloud Marketplace; channel partners include Optiv, Guidepoint, WWT, Trace3 and CDW |
Note: This overview is compiled from Legion Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.