ReliaQuest runs security operations for organisations that want their alerts investigated and contained quickly without rebuilding their security stack. Its GreyMatter platform connects to the tools a customer already owns, and AI personas called Teammates work through alerts alongside the customer’s human analysts.
The problem it targets is the SOC team that spends its day switching between consoles and triaging alerts by hand, while attackers move in minutes.
At A Glance
| Vendor | ReliaQuest |
|---|---|
| Category | Agentic AI security operations platform |
| Deployment | Connects to existing tools through bidirectional APIs |
| Agentic AI | Six Agentic Teammate personas, AI Model Broker |
| Customers | Circle K |
| Funding | Privately held, valued at a reported $3.4 billion |
What ReliaQuest Does
Most security teams run many separate tools, each with its own query language and console. GreyMatter sits above those tools as a single operations layer and works with them in place rather than replacing them. It normalises their data, lets AI investigate every alert, and lets analysts direct the response across all connected tools from one place. Human analysts stay in charge: the Teammates are meant to augment them, not replace them, and human-in-the-loop governance controls what the AI decides and does.
Products
GreyMatter Agentic Teammates
The Teammates take on the repetitive investigation work that slows SOC teams down. There are six personas: IR Analyst, Detection Engineer, Threat Hunter, Threat Intel Analyst, IT Engineer and OT Engineer. Together they draw on more than 200 agent skills and 400 AI tools, and every alert is investigated by them before it reaches a human.
Agentic Orchestration
Orchestration lets analysts direct response actions across every connected tool in plain language rather than writing tool-specific scripts. Playbooks built on it handle containment, with a reported mean time to contain of 4.48 minutes.
Context Layer Products
These optional products add data and coverage on top of the core platform.
| GreyMatter SIEM-Less and Detect At Source | Detection where the data already lives, without the cost of sending everything to a full SIEM. |
|---|---|
| GreyMatter Transit | A security data pipeline with threat detection on data in motion. |
| GreyMatter Attack | Agentic red teaming and attack path mapping. |
| GreyMatter Discover | Continuous discovery of assets, identities, SaaS and AI, for exposure management. |
| Digital Risk Protection | Monitoring of the deep, dark and open web for impersonation and leaked credentials. |
| Phishing Analyzer | Email phishing defence. |
How It Works
GreyMatter is delivered as a platform over the customer’s security stack, and every action goes through API connections to existing tools. More than 300 technology connections use bidirectional APIs, so the platform can both read data and act. A patented Universal Translator normalises query languages and telemetry between tools, mapping fields to OCSF in real time without storing the data. The AI Model Broker chooses a model for each task from more than 20 available, balancing cost, speed and accuracy, with automatic failover, so the platform is not tied to one AI provider. Analysts can also work from a mobile app.
Integrations
| Area | Integrations |
|---|---|
| SIEM | Splunk, Microsoft Sentinel |
| Endpoint | CrowdStrike Falcon |
| Identity and IAM | Okta, Microsoft Entra ID, CrowdStrike Falcon Identity Protection |
Company Background
| Founded | 2007, by Brian Murphy. |
|---|---|
| Headquarters | Tampa, United States. |
| Leadership | Brian Murphy (founder and CEO), Joe Partlow (CTO), Krish Venkataraman (CFO), Colin O’Connor (President of Field Operations) and Brian Foster (President of Product and Technical Operations). |
| Funding | More than $500 million (2025), led by EQT, KKR and FTV Capital with existing investors Ten Eleven Ventures and Finback Investment Partners. |
| Scale | More than 1,000 reported customers. |
| Recognition | Included in the IDC MarketScape: Worldwide Standalone AI SOC Platforms (2026) and the Gartner Magic Quadrant for Cyberthreat Intelligence Technologies. |
Note: This overview is compiled from ReliaQuest’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.