TENEX.AI runs security operations and managed detection and response for organisations that already use Google Cloud SecOps or Microsoft Sentinel. Its AI agents investigate alerts, build cases and carry out pre-authorised actions inside the customer’s own SIEM, while a named human analyst owns every consequential decision.
The aim is to give security teams full alert coverage without replacing the tools they have already bought.
At A Glance
| Vendor | TENEX.AI |
|---|---|
| Category | Security operations, managed detection and response |
| Deployment | Overlay on Google Cloud SecOps or Microsoft Sentinel |
| Agentic AI | Agent pipeline for triage, investigation, hunting, detection and response |
| Customers | Grainger, Payabli, Kansas City Chiefs, TGR Haas F1 Team |
| Funding | $250M Series B led by Crosspoint Capital Partners |
| Market classification | Security Operations |
What TENEX.AI Does
Most SOCs cannot investigate every alert they receive, so real threats wait in a queue behind benign noise. The TENEX Agentic SecOps Platform layers on top of a customer’s SIEM rather than replacing it, and gives every in-scope alert an investigation, with the evidence and reasoning kept auditable so analysts can see why a case was closed or escalated. The offering is sold as three packages that build on one another, from engineering support for the existing stack up to a fully managed SOC, which lets a customer choose how much of the work it keeps in house.
Products
Optimize
Optimize is for teams that want their SIEM engineered and maintained without handing over the SOC. TENEX takes on platform configuration, health and updates, builds and tunes detections, parsers and playbooks, and onboards new log sources while keeping normalisation accurate. A named engineer handles onboarding and support rather than a ticket queue.
Agentic Overwatch
Security teams that run their own SOC but are short of analyst time use Agentic Overwatch to put agents to work alongside them. It adds agentic case creation and disposition for all alerts, threat hunting across environments, case quality assurance with reinforced learning, and forward deployed AI engineering. When a case needs expert judgement, it can be escalated to a TENEX analyst.
Agentic MDR
Agentic MDR suits organisations that want detection and response run for them around the clock. Operations run from the TENEX SOC under contractual service levels with 24×7 support and an included incident-response retainer. Parser, playbook, detection and integration work is covered by the subscription, and each customer gets a customer success manager and forward deployed engineers.
How It Works
TENEX works inside the Google SecOps or Microsoft Sentinel environment the customer already owns, and telemetry does not leave that environment. For customers with an active deployment and timely onboarding, go-live can take as little as a reported seven days; a new SIEM implementation or migration takes longer.
| Component | What it does |
|---|---|
| Security Context Graph | A living model of the customer’s users, devices, applications and vulnerabilities, built from endpoint, identity, cloud, email and network systems. Agents use it for context during investigations. |
| PromptBooks | Customer-specific procedures that set out the queries, tools, evidence, skills and escalation conditions for a given detection or technology. |
| Console and case output | Each agent’s reasoning is visible in the customer’s console. Evidence and timelines are written to the customer’s ticketing or case system. |
Agentic AI Capabilities
Specialised Agents
The platform runs hundreds of specialised agents, from triage to hunting to detection tuning. Each hands its findings to the next across triage, investigation, correlation, hunting, response and learning.
Autonomous Investigation
Every alert gets a context-aware investigation and a supported disposition. The reasoning for each alert covers context, investigation, precedent, challenge, findings and disposition, and every benign explanation is tested before an alert is closed.
Hunting And Detection Engineering
Agents search across SIEM and source-native telemetry, run multi-step hunts and evaluate the evidence, so new threats can be turned into defensive action quickly. Detection rules and PromptBooks are updated together through a governed path of assessment, recommendation, testing, deployment and monitoring.
Human-Governed Response
Agents take only pre-authorised actions within customer-defined policies. Decisions that are consequential, uncertain or out of policy go to human experts for judgement and approval.
Integrations
| Area | Integrations |
|---|---|
| SIEM platforms | Google Cloud SecOps, Microsoft Sentinel |
| Network detection | ExtraHop RevealX |
Company Background
| Founded | Launched in January 2025. |
|---|---|
| Headquarters | Sarasota, Florida, United States. |
| Other offices | Overland Park, Kansas, United States. |
| Leadership | Eric Foster, CEO; Ryan Shreve, Co-Founder and CFO/COO; Venkata Koppaka, CTO; Bashar Abouseido, President; Jan Grzymala-Busse, CISO; Richard Rogers, Chief Marketing Officer. |
| Funding | A $27M Series A, followed by the Series B. |
| Recognition | Included in the 2026 IT-Harvest Cyber 150 of fast-growing midsize cybersecurity companies. |
Note: This overview is compiled from TENEX.AI’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.