Sekoia is a French security operations company whose Autonomous SOC Platform uses AI agents to detect, investigate and contain threats for SOC teams, managed security providers and the organisations they protect.
The aim is to shorten response times and cut the operating cost of a security operations centre, so that a smaller team can handle more alerts without missing real attacks.
At A Glance
| Vendor | Sekoia |
|---|---|
| Category | Security operations, SIEM, threat intelligence and XDR |
| Deployment | Cloud platform, with a self-hosted option for government, defence and critical infrastructure |
| Agentic AI | Detection, investigation, response and hunting agents, plus Sekoia Elevate |
| Certifications | ISO 27001, SOC 2, PCI-DSS, ENS Alta (Spain) |
| Customers | URSSAF, GRDF, Pierre Fabre, NATO, CPX |
| Market classification | Security Operations |
What Sekoia Does
Most SOC teams face more alerts than they can review, spread across tools that do not share context. Sekoia’s approach is to organise security operations into four stages, Hunt, Detect, Investigate and Respond, run them on one platform over the data sources a customer already has, and let AI agents carry out the routine work in each stage. Analysts stay in charge of the decisions that policy reserves for people. The same platform is sold to MSSPs, who use it to run managed XDR services for their own customers.
Products
Sekoia Defend
Defend is the SIEM at the centre of the platform. SOC teams use it to collect security data from across their estate and correlate it into detections, instead of reviewing each tool’s alerts separately.
Sekoia Intelligence
Analysts who need context on attackers get cyber threat intelligence written by Sekoia’s in-house Threat Detection and Research (TDR) team. The same intelligence drives Sekoia’s detection rules and hunting agents, so new research reaches customers’ detections directly. Sekoia Digital Risk extends the same watch to threats outside the network perimeter.
Sekoia Reveal
Reveal answers the question of which alerts matter most. As a cyber asset attack surface management module, it correlates alerts with how critical the affected asset is, adding asset intelligence and risk scores to each alert.
Sekoia Elevate
Elevate is an agentic SOC analyst that takes an incident from raw security data to a verdict and drives the response. Sekoia puts that at a reported 99 seconds.
How It Works
Sekoia runs as a unified cloud platform. Customers connect their existing security data sources through the integration catalogue, and the platform processes that data in the cloud, with analysts reviewing cases and approving actions where policy requires it. Playbooks adapt to current findings rather than following a fixed script. Government, defence and critical infrastructure customers that cannot use a shared cloud can run it self-hosted. The architecture is designed to meet local data residency requirements, and a public Trust Center documents its security controls.
Agentic AI Capabilities
- Detection agents combine anomaly detection, behavioural analytics, signatures, machine learning and AI models to turn large volumes of data into prioritised findings.
- Hunting agents search the environment proactively with guidance drawn from Sekoia’s threat intelligence.
- Investigation agents enrich alerts by gathering process trees, network traces, threat intelligence and related alerts for the analyst.
- Response agents can isolate hosts, disable credentials or block activity, either autonomously or after one-click approval, and every agent action is logged.
Integrations
| Area | Integrations |
|---|---|
| Cloud | AWS CloudTrail, AWS GuardDuty, Google Workspace |
| Identity and secrets | Microsoft Entra ID, 1Password Enterprise Password Manager, Azure Key Vault |
| Network | Palo Alto NGFW, Fortinet FortiGate |
| Backup | Veeam Backup |
| Threat intelligence | Anomali ThreatStream |
| Exposure management | Holm Security |
Company Background
| Headquarters | Paris, France. |
|---|---|
| Leadership | Co-founders Freddy Milesi (CEO), Georges Bossert (CTO) and Therese Favet (CFO), with Cyril Simonnet (Chief Revenue Officer), Sara Verri (Chief Marketing Officer). |
| Funding | A reported €60 million raised, including a €26 million Series B in April 2025; investors include Bpifrance, Seventure, Omnes Capital, Revaia and BNP Paribas Développement. |
| Scale | A reported 200+ SOC teams across more than 2,000 organisations, protecting 1.5 million assets. |
| Recognition | Included in the Frost Radar: XDR (2024) and the Forrester XDR Platforms Landscape (Q1 2026). |
Note: This overview is compiled from Sekoia’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.