Reveal Security detects and stops insider threats by watching how people, machines and AI agents behave across an organisation’s SaaS, identity and developer tools. It is aimed at security teams that need to know when an account, a service principal or an agent acting for an employee starts doing something it should not.
The problem is fragmentation. A single identity leaves traces in dozens of separate audit logs, so misuse that would be obvious on one timeline goes unnoticed when it is split across many tools.
At A Glance
| Vendor | Reveal Security |
|---|---|
| Category | Identity threat detection and response, insider threat detection |
| Identities covered | Human users, non-human identities, AI agents |
| Deployment | Agentless, read-only ingestion of existing logs |
| Agentic AI | Agent to human linkage, automated agent containment |
| Customers | Poste Italiane, Hewlett-Packard, LifeLabs |
| Certifications | AICPA SOC, GDPR |
| Funding | Series A, 2022 |
| Market classification | Identity Threat Detection & Response |
What Reveal Security Does
Insider risk no longer comes only from employees or from a stolen password. Copilots, embedded SaaS agents and OAuth-connected tools act with a person’s access, and their activity is spread across dozens of audit logs. Reveal Security’s approach is behavioural rather than rule based: it learns what normal looks like for each identity from the logs organisations already keep, and treats sustained drift from that pattern as the signal. Because detection does not depend on rules written per application, a new tool can be covered as soon as its logs are connected. Response is graded, with low-risk containment automated and high-impact actions left to a person.
Products
Continuous Behavioral Observability
Continuous Behavioral Observability solves the problem of identity activity being scattered across separate applications. It joins events from SaaS, cloud and custom applications into one journey per identity, so an investigator can see what a user or agent did in Okta, GitHub and Office 365 in sequence rather than in three consoles.
Behavioral Risk Detection
Behavioral Risk Detection is for teams that cannot write and maintain rules for every application. Machine learning builds a baseline for each identity, every event receives an Identity Risk Score, and drift from the baseline is flagged as an anomaly. Baselines take account of peer behaviour, how sensitive an action is and the identity’s own history.
Automated Risk Containment
Automated Risk Containment shortens the gap between detection and response. Soft containment runs on its own when an identity’s Trust Budget is depleted, while hard containment for high-impact actions can wait for human approval. Responses include suspending accounts, revoking sessions and updating risk scores in real time through bidirectional integrations, and every action is written to an audit trail.
Reveal Intelligence
Reveal Intelligence turns the behavioural journey into a narrative an analyst can read quickly, which helps less experienced staff triage an alert without reconstructing events by hand.
How It Works
The platform is agentless. It takes read-only access to identity telemetry that organisations already collect and ingests it from existing systems, so there are no endpoint agents to deploy, no detection rules to write and no log parsing or correlation pipeline to build. Any tool that exposes an audit log API can be connected through a generic HTTP connector.
| Component | What it does |
|---|---|
| Ingestion | Audit logs flow from identity providers, SaaS, cloud and developer tools into the platform over read-only connections. |
| Scoring | Events are stitched per identity and scored, and the Trust Budget falls from 100% towards 0% as anomalies accumulate. |
| Response | Containment actions are sent back to the connected systems, and alerts reach the SOC through SIEM, SOAR and Slack. |
Identities And Systems Covered
| Human identities | Employees, contractors, administrators and privileged users |
|---|---|
| Non-human identities | Service accounts, API keys, service principals and automation identities |
| AI agents | Vendor-embedded, OAuth-connected and employee-built agents, including Agentforce, ServiceNow Assist, Copilot, Context.ai, Otter, Fathom, Claude and MCP-based agents |
| Identity systems | Microsoft Entra ID, Okta, Duo, JumpCloud, Google Workspace and Office 365 |
| Cloud | AWS CloudTrail, AWS S3 and Google Cloud Logging |
| Developer and work tools | GitHub, Jenkins, JFrog Artifactory, Linear and ClickUp |
Agentic AI Capabilities
Each AI agent is tied to the human credential it uses, so its actions sit on the same timeline as the person behind it. This lets a team tell, for example, whether an unusual download came from the employee or from an assistant acting with their access. When an agent exhausts its Trust Budget, containment applies to the agent’s session and the underlying account alike. Approval steps for higher-impact actions apply to agents just as they do to people, so containing an agent does not mean unreviewed changes to the employee account behind it.
Integrations
| Area | Integrations |
|---|---|
| Security operations | CrowdStrike, Exabeam, SIEM and SOAR platforms |
| Security tools | Island, Aikido, Malwarebytes ThreatDown Nebula |
| Alerting | Slack |
More than 30 connectors are available across SaaS, IAM and developer tools.
Company Background
| Founded | 2020. |
|---|---|
| Headquarters | New York, United States. |
| Founders | Doron Hendler (co-founder). |
| Leadership | Dave McKinley (CEO). |
| Funding | A reported $23 million Series A in June 2022, led by SYN Ventures with Hanaco Ventures, SilverTech Ventures and World Trade Ventures. |
| Recognition | SINET16. |
Note: This overview is compiled from Reveal Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.