WRAITHWATCH builds an agentic cyber defence platform for security teams in the federal government and large enterprises. It connects the tools an organisation already runs into one data fabric and control plane, so that human analysts and AI agents can work from the same picture of the environment.
The problem it targets is speed. Security data is scattered across many products, identities multiply faster than teams can review them, and attackers now automate their work. WRAITHWATCH aims to let defenders find and close exposures at the same pace.
At A Glance
| Vendor | WRAITHWATCH |
|---|---|
| Category | Agentic cyber defence (Security Operations) |
| Identities covered | Human and non-human identities, inferred from source data |
| Deployment | Federated platform that queries source data in place |
| Agentic AI | AI agents that hunt and correlate across security data, with support for customer agents |
| Certifications | FedRAMP High (in process) |
| Founded | 2023, Austin, Texas |
| Market classification | Security Operations |
What WRAITHWATCH Does
WRAITHWATCH starts from the view that attackers are automating faster than defenders. CEO Nik Seetharaman puts it this way: offensive automation “is going vertical with no corresponding defensive counterpressure.” The company’s answer is defence that runs at machine speed. Instead of adding another console, the platform sits across the existing security stack and takes a team from raw telemetry to a prioritised risk and then to a control that closes it, with a person able to approve each change. Its customers range from Fortune 500 companies to federal agencies and operators in nuclear, aerospace and defence, maritime and advanced manufacturing.
Products
Federated Query Engine
Security data is usually spread across many products, and centralising it is slow and expensive. The Federated Query Engine reasons over that data at its source, wherever it lives, so a team gets answers across its stack without first building a SIEM, data lake or warehouse.
Identity Profile Engine
Identity sprawl makes it hard to know which accounts are people and which are machines, and how much damage each could do if taken over. This engine infers mathematically whether an identity is human or non-human, computes the blast radius of each one and tracks how its behaviour changes over time.
Controls As Code
Writing and maintaining prevention policies and detection logic by hand is a bottleneck for most teams. Controls as Code generates both, after first searching the existing stack for the configurations already in place. It can apply them autonomously or hold them for human approval.
Threat Intel Autocorrelation
Open source threat reports pile up faster than analysts can read them. This module analyses unstructured reports, matches the tactics they describe against the customer environment and turns relevant findings into controls or detection logic.
How It Works
| Component | What it does |
|---|---|
| Data fabric | The platform links existing security tools and leaves the data in them, querying it in place rather than copying it into a central store. |
| Digital twin | From that data it maintains a continuously updated model of the organisation’s environment and computes attack paths against it in real time. |
| Agent layer | AI agents, both the platform’s and the customer’s, run on top of the fabric and the twin, reading from the connected sources rather than from a copy. |
| Remediation | Evolutionary algorithms let defences adapt, and remediation plans are pushed back into the connected tools. |
Identities And Systems Covered
| Human identities | Profiled from source data, with a blast radius computed for each |
|---|---|
| Non-human identities | Separated from human ones by the Identity Profile Engine and tracked for behavioural change |
| Security tools | The existing stack, including CrowdStrike, Okta and Splunk, queried in place |
Agentic AI Capabilities
Agent Swarms
The platform’s own agents swarm across connected sources such as CrowdStrike, Okta and Splunk, hunting and correlating in parallel over data that would otherwise sit unused.
Open Agent Model
The platform is open and interoperable: customers can bring their own agents or use the ones WRAITHWATCH supplies.
Attack Simulation
The founders’ original design uses autonomous generative AI agents that explore novel vulnerabilities and attack strategies, simulate variations of an attack and apply defensive measures across security tools. This is the offensive side of the platform, used to test defences before an attacker does.
Company Background
| Founded | 2023 |
|---|---|
| Headquarters | Austin, Texas |
| Leadership | Nik Seetharaman (Founder and CEO), Grace Clemente (President) and Carlos Más (CTO) |
| Funding | A reported $8M seed round led by Founders Fund, with XYZ Capital and Human Capital |
| Federal contract | Selected in February 2026 for a $30 million contract to deploy the platform across federal agencies with national security missions, close to a dozen of them in parallel |
Note: This overview is compiled from WRAITHWATCH’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.