LimaCharlie provides a security operations platform built for MSSPs, MDRs and enterprise security teams that run detection and response across many tenants. It supplies the telemetry, detection, response and automation a provider needs for every client, through an API that human analysts and AI agents use in the same way.
The problem it solves is scale. A provider watching dozens of client environments cannot afford a separate stack for each, and it increasingly wants AI agents to carry part of the workload under the same controls as its analysts.
At A Glance
| Vendor | LimaCharlie |
|---|---|
| Category | Security operations (SecOps Cloud Platform) |
| Identities covered | Identity provider identities, non-human identities and AI agent identities |
| Deployment | Cloud platform with sensors for Windows, Linux, macOS and Chrome |
| Agentic AI | Grid AI operators, Viberails guardrails for agent tool calls |
| Customers | Recon InfoSec, Black Hills Information Security, Blumira, Snapchat |
| Market classification | Security Operations |
What LimaCharlie Does
LimaCharlie offers a cloud-native, API-first SecOps Cloud Platform in place of a stack of separate tools. Every capability is reachable through the public API and CLI, so automation and AI agents can do anything an analyst can, within limits the team sets: “the only difference between a human operator and an AI operator is policy.” Detection logic is managed as code, and the same rules apply whether an event comes from an endpoint, a cloud account or an AI agent. A provider can therefore onboard a new client by configuration rather than by building infrastructure.
Products
Agentic SecOps Workspace
The Workspace is the multi-tenant core, where a provider collects telemetry and runs detection and response for each client.
- EDR and XDR, SIEM and log analytics, incident response and SOAR-style automation
- Detection engineering with YAML-based D&R rules and GitOps integration
- An observability pipeline that ingests, transforms and routes security data
- Email security built into the same stack
Grid
Grid is a SOC with no console of its own, “the headless SOC”, designed for AI agents to operate on rather than people. It ingests endpoint, cloud log and SaaS audit data in a format suited to AI, keeps a year of telemetry, and lets teams bring their own LLM key from Anthropic, OpenAI, Google or a local model. Forward Deployed Engineers create worker agents and open cases when an agent goes quiet. Grid is currently in beta.
Cloud Security
Cloud Security is a CNAPP for teams that want cloud posture, identity risk, attack paths and AI workloads covered by the same rules as their other detections. It connects with read-only credentials, and each posture rule is an ordinary D&R rule that can be read, forked and edited. Vulnerability findings carry CVSS, EPSS and KEV enrichment, and an AI service inventory comes with posture rules mapped to OWASP LLM and NIST AI RMF.
Viberails
Viberails is for organisations running coding assistants and other autonomous agents that can execute commands. It intercepts, audits and validates each tool call before it runs, and installs with a single shell command.
How It Works
| Component | What it does |
|---|---|
| Sensors and adapters | Sensors are deployed on Windows, Linux, macOS and Chrome, and log adapters bring in other sources. |
| Rules on one event stream | D&R rules hold custom detection logic with automated responses. Cloud findings arrive as native events in the tenant, so the same rules apply to them. |
| Outputs and extensions | Data and alerts flow out to SIEMs, extensions and third-party tools. |
| API and SDKs | Everything is API-first, with Go and Python SDKs for programmatic access. |
| Multi-tenancy | Agents are scoped per tenant, and Grid can provision a new tenant from an API call or a prompt. |
Identities And Systems Covered
| Identity providers | Ingested into the cloud security graph, with access classified by what an identity can actually do rather than by role bindings |
|---|---|
| Non-human and AI agent identities | First-class node types in the same graph |
| Endpoints | Windows, Linux, macOS and Chrome |
| Cloud and SaaS | Cloud provider organisations connected read-only, plus cloud logs and SaaS audit trails |
Agentic AI Capabilities
AI Operators
Charters scope what each agent may do, every action lands in an audit trail, and cost is reported per tenant. In Grid, teams decide which actions agents can take without approval, and any output can be inspected, changed or reversed through the API.
Viberails Guardrails
Policies auto-approve safe operations, block dangerous ones and send sensitive ones to a human approval queue. Each decision is audited before the call executes, so a team can see what an agent tried to do as well as what it was allowed to do. Viberails runs on LimaCharlie.
Integrations
| Area | Integrations |
|---|---|
| AI models | Claude, GPT, Gemini and local models through the CLI; Anthropic, OpenAI and Google keys in Grid |
| AI agents (Viberails) | OpenClaw, Claude Code, AutoGPT, BabyAGI, MCP servers |
Company Background
| Offices | Covina, California, United States and Vancouver, British Columbia, Canada |
|---|---|
| Founders | Maxime Lamothe-Brassard and Christopher Luft |
| Leadership | Maxime Lamothe-Brassard (CEO), Christopher Luft (CCO), Amrik Randhawa (Chief Operating Officer), Charlton Swearingen (Chief Business Officer) |
Note: This overview is compiled from LimaCharlie’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.