Stellar Cyber builds a security operations platform for enterprises and managed security service providers. It brings security data, detection, investigation and response into one place, so analysts are not working across many separate tools and data sources.
MSSPs can run many customers from one deployment, and AI handles much of the alert triage so smaller teams can keep up.
At A Glance
| Vendor | Stellar Cyber |
|---|---|
| Category | Security operations, Open XDR, AI SIEM and NDR |
| Identities covered | Users and services through ITDR and UEBA |
| Deployment | On-premises, public cloud or hybrid |
| Agentic AI | Agentic Auto Triage, AI Investigator, AI case analysis |
| Customers | Sumitomo Chemical, RSM US, University of Zurich, CoopCentral |
| Founded | 2015 |
| Market classification | Security Operations |
What Stellar Cyber Does
The platform, sold as the Agentic SecOps Platform, is an open, vendor-agnostic integrated security operations centre. Pre-built integrations pull in data from hundreds of security products as well as IT and productivity tools, and teams can keep the endpoint tools they already run through Universal EDR, also called Bring Your Own EDR. Detection relies on Multi-Layer AI, which combines static rules, supervised and unsupervised machine learning and automated threat hunting. On top of that sits a “Human-Augmented Agentic SOC” model, where AI handles triage and investigation steps while analysts keep oversight of decisions.
Products
Next-Gen SIEM
The SIEM collects and normalises data from connected security products and IT tools so analysts can search and correlate it in one place. Parser Studio lets teams manage and reuse parsers for new data sources, and AI-driven case management groups related alerts. Analysts can open the original records behind any correlation-based detection.
NDR And OT
Network detection and response covers IT and OT networks, either inside the platform or as a stand-alone product. Sensors capture raw network and log data, giving teams payload visibility and malware sandbox evidence when they investigate suspicious traffic.
ITDR And UEBA
These modules help teams spot identity-based attacks, such as compromised credentials, across users and services. Adaptive behavioural modelling learns normal activity and surfaces anomalies that point to an account being misused.
Threat Intelligence Platform And MITRE ATT&CK Coverage Analyzer
The threat intelligence platform enriches detections with adversary intelligence, so analysts see context about known threats next to each alert. The MITRE ATT&CK Coverage Analyzer, offered as a stand-alone product, shows how those detections map against the ATT&CK framework.
How It Works
The platform is built for on-premises and cloud use, with a multi-tier, multi-tenant, multi-site architecture that suits MSSPs serving many customers from one deployment.
| Component | What it does |
|---|---|
| Deployment options | Customers can deploy on infrastructure they already own or on Stellar Cyber appliances, run in AWS, Azure, GCP or OCI, or mix on-premises and cloud. Integrated, distributed and MSSP deployment models are available. |
| Data Lake and Sensors | The Data Lake and Sensors are installed separately. In the MSSP model, sensors sit in customer networks and on endpoints behind their firewalls. |
| Automated response | Automated incident response and scheduled threat hunting run through the connected tools, which carry out the response actions. |
Identities And Systems Covered
| Users and services | ITDR covers identity-based attacks against human users and service identities. |
|---|---|
| Credentials | Compromised credentials and misused accounts. |
| Systems | Network, OT, endpoint and log sources feed the platform. |
Agentic AI Capabilities
| Agentic Auto Triage | Prioritises incoming alerts and cuts noise before analysts pick them up. |
|---|---|
| AI case analysis | Analysis and automated triage work at the case-queue level, so teams choose where autonomy applies. Case Metrics measure the time from case creation to analyst acknowledgement and to resolution. |
| AI Investigator | Analysts hunt for threats in natural language and get contextualised root-cause analysis for a case. |
Integrations
| Area | Integrations |
|---|---|
| Endpoint response | Microsoft Defender for Endpoint, Cybereason |
| Network security | Fortinet FortiGate |
Company Background
| Founded | 2015. |
|---|---|
| Headquarters | San Jose, California, United States. |
| Leadership | Changming Liu (Chief Executive Officer and Co-Founder), Aimei Wei (Chief Technical Officer and Founder), David P. McKeough (Chief Revenue Officer). |
| MSSP reach | One-third of the world’s top 250 MSSPs are reported users of the platform. |
| Recognition | Included in the Gartner Magic Quadrant for NDR (2026), the GigaOm Radar for Autonomous SOC (2025), the Gartner Hype Cycle for Security Operations (2026) as a sample vendor for ISOC, and SACR’s 2026 AI SOC Technoscope. |
Note: This overview is compiled from Stellar Cyber’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.