Mars Security: who they are, what they sell and what CISOs should ask

What Mars Security sells

Mars Security sells a threat hunting and detection engineering platform to security operations teams. The company was founded by Shahaf Galili (CEO), Ran Lerer (CTO) and Matan Caspi (chief architect). The founders wrote that the company is backed by TLV Ventures, Jibe Ventures, Bullet Ventures, CCL and XPS. At launch, the company said it was in early access with design partners and first customers.

The founders describe Mars as an autonomous threat hunting and detection engineering platform that connects to existing SIEM, EDR, identity providers, cloud telemetry and data lakes. The company's product posts describe several parts:

• Prevention. Mars checks every indicator against the customer's own environment before suggesting a block. The launch post claims that 40% of the malware files Mars identified were not recognised by customers' EDRs. That is the company's own finding.
• A Slack app. It lets a team run /mars hunt with a link to a threat report to start a hunt.

On delivery, the company's integrations page states that Mars connects to your existing security stack by API. Its homepage says Mars deploys in hours with zero ingestion pipelines. The playbooks post states that nothing runs against a copy of your data sitting in our environment. Queries run at the source.

The company also says plainly what Mars is not. The founders' post lists no ingestion, no rip-and-replace, no new headcount. The integrations page repeats no data ingestion, no tool replacement. In the company's account, Mars sits on top of an existing SIEM and EDR rather than replacing them. CISO Tribune lists it under AI SOC analysts and threat intelligence on the vendor record.

Figure: Mars Security's home page, captured 2026-10-29. Source: MARS Security.

The founders

Mars Security has three co-founders: Shahaf Galili, the CEO; Ran Lerer, the CTO; and Matan Caspi, the chief architect. All three signed the post that set out why they built the company, which carries the byline "Shahaf Galili, Ran Lerer & Matan Caspi".

Offensive backgrounds. The founders describe themselves as former attackers. In that post they wrote: ["We spent years on the other side. Cyber offense, hands-on operations.

A CTech author note states that Galili previously served as VP Product at Attribute and held senior cybersecurity roles at Claroty. The company's own pages do not name earlier employers for Lerer or Caspi. See /people for the security leaders on our record.

Why they started it. The founders' account is that they saw detection fail from the attacker's side. In the founding post they wrote that they "were amazed by how slow, inefficient, and just useless most detection capabilities were", and they called Mars "a detection platform designed by attackers". At a September product announcement Galili said "the thing that surprised us most was how rarely anyone saw us, even when the intel on our tradecraft was already public".

Each founder gave a short statement at launch. Galili said: "We built Mars to shift security teams from reactive alerting to proactive, continuous threat hunting so every organization can operate like an elite defense team." Caspi said: "Threat intelligence without context is just noise." Lerer said: "Most teams don't know which active campaigns their stack would catch today." Lerer later put the same point as a matter of time: "A SOC should not need a two-week backlog to act on a report that took an attacker two hours to make obsolete."

Galili in public. Galili writes most of the company's product posts. In one he opened with a view from the SOC floor: "Every SOC I've sat in front of has the same problem: the good hunts live in someone's head". He also wrote an opinion piece for CTech arguing against the idea of an AI super-hacker: "AI is not mainly creating a new species of attacker. It is making less-skilled attackers faster, cheaper, and more effective." In our reading, that argument follows from the founders' account of why they built the company: both treat the gap as one of detecting known attacker behavior faster.

What the product does

Mars calls itself an autonomous threat hunting and detection engineering platform, and its founders' post said it "continuously converts global threat intelligence into validated hunts and production-ready detections". In practice that work sits in a few named parts, each with a point where an analyst decides.

The intelligence side runs through a feature the company calls Detection Recommendations. As reports on active campaigns arrive, Mars writes the detection in the native query language of whichever telemetry can see the threat. Each rule comes mapped to MITRE ATT&CK, scoped to a data source and labelled with a severity rating, and the analyst chooses: "Accept Rule pushes it live, Dismiss clears it from the queue." Before that choice, a "Mars analysis" panel shows how the rule's query would have performed against the customer's own data over the past 30 days. The company says it also screens each reported indicator against its false-positive record before the indicator enters a rule. A separate coverage gap section compares what is deployed against connected log sources and lists the missing rules. For detection-as-code teams, some recommendations arrive as an open pull request.

The playbooks covered earlier are built as hypotheses, not saved queries, the company's post states. Galili described each one as "a codified investigation, not a flat checklist". Where telemetry may be absent, such as a Windows 4662 event that only fires if SACL auditing is enabled, the playbook "flags that as a coverage gap rather than assuming the telemetry exists". Each playbook carries a lookback window, a run history and a versioned author. A playbook can run by hand, on a schedule, or off an event: a CrowdStrike alert can start one. Teams take one from the built-in library or write their own with AI help.

Co-Hunter, the plain-language investigator noted above, now accepts standing guidance that Mars adds to every new session. The guidance is set under Settings in four sections. These cover points such as which tables to check first and which source wins when two overlap. Edits happen in a draft with a live preview, and each published set becomes a version that can be rolled back. The company says the guidance shapes how Co-Hunter investigates, not what the report looks like.

In Slack, hunt summaries go to channels the team picks and can be filtered to fire only when there are findings. The agent can also message a user to confirm or deny activity, with analyst review and approval on every send. Prevention reviews existing block lists. It flags indicators that were added but never enforced and needless duplicates. In October 2026 the company said Mars will manage block lists end to end inside the customer's EDR, a step it framed as the direction it was heading. Throughout, the launch announcement said the design keeps defenders in control of what is adopted.

Figure: Mars Security's product page, captured 2026-10-29. Source: Integrations | MARS Security.

How it works and what it connects to

Mars describes itself as a layer that reads data in place rather than a store that collects it. Its integrations page states that Mars connects to a customer's existing stack by API, with no data ingestion and no tool replacement. The page groups connectors into cloud platforms, security and threat intel, identity and access management, observability and SIEM, data and analytics, DevOps and CI/CD, SaaS and productivity, and networking and CDN, and says Mars connects to any source with an API. The founders' launch post named SIEM, EDR, identity providers, cloud telemetry, Snowflake and Databricks as places it queries, and said telemetry stays where it is. The homepage claims Mars deploys in hours with zero ingestion pipelines.

The CEO's playbook post put a name on the design: a federated query layer that everything in Mars sits on top of. The same post stated that nothing runs against a copy of customer data held in Mars's own environment. Queries go live to the source instead. The Co-Hunter assistant, the company says, plans and runs the investigation across every connected source, without ingesting or moving data.

On the intelligence side, Help Net Security reported that Mars draws on advisories from CISA, Mandiant and other sources. It then writes each detection in the native query language of whichever telemetry can see the threat, from CrowdStrike Falcon and Splunk to AWS telemetry and data lakes. A company engineer wrote that Mars read 1,800 threat reports from hand-picked sources. He described rule building as driven by AI and tailored to each customer's organizational profile.

For the Prevention feature announced in October, the post said Mars checked every indicator against dozens of reputation sources. Before suggesting a block, it runs a fast hunt with its own search engine to see whether the indicator has already appeared in the customer's environment.

Mars runs as a hosted platform with customer tenants. Its Slack page states that the app is installed from inside the Mars platform after signing in to the customer's tenant. From Slack, a user can start a hunt with a link to a threat report. Help Net Security also reported that the engine extends to monitoring AI coding agents and the credentials they leak into logs.

The company states one limit plainly. Playbooks are not a replacement for real-time detection. They are meant for correlations too complex to alert on directly. In our reading, the no-ingestion design means coverage depends on what each connected source already logs and retains. The playbook post's point about missing telemetry, noted above, points the same way.

The sources do not say where Mars hosts its platform or any data it stores, which AI models it uses, whether it holds security certifications, or whether a self-hosted option exists.

Where it sits in the market

CISO Tribune's record files Mars Security under two categories. The first is AI SOC analysts: software agents that triage, investigate and document security alerts with limited human input. The second is threat intelligence: feeds, platforms and research services about threat actors, infrastructure, malware and vulnerabilities being exploited. Mars uses a different label for itself. The founders' launch post called it "an autonomous threat hunting and detection engineering platform."

The chart shows how many companies CISO Tribune's record files under each of the two categories Mars Security sits in.

Other companies on the record in those two categories are, in alphabetical order: 7AI, Alphabet, Anomali, Anvilogic, Censys, Cyble, CYPFER, Cyware, D3 Security, Dataminr, Dropzone AI, EclecticIQ, Exabeam, Filigran, Flashpoint, General Dynamics Information Technology, Graylog, GreyNoise, Group-IB, Hunters, IBM, Indra Group, Intel 471, IRONSCALES, iVerify, Kai, Keepnet Labs, Leidos, Leonardo, Mave, Overwatch, Panther, Parsons, Peraton, Prophet Security, QuoIntelligence, Recorded Future, Red Canary, Secureworks, SecurityScorecard, Securonix, Sekoia, SOCRadar, Stellar Cyber, Sublime Security, Swimlane, Tego Cyber, ThreatConnect, Tines, Torq, VulnCheck and ZeroFox. Profiles of each sit in the vendor directory.

The company's own pages set Mars against several adjacent product types.

Alert-driven SOC tools. The founders' post said vendors "ship false-positive-resolving bots and call it a panacea." One of the company's guides argues that "An agentic SOC that only starts when an alert fires inherits every blind spot of the stack that fired it." Our reading is that Mars presents itself as starting work from threat reports and hunts rather than from alerts. That puts it beside, not inside, the alert-triage tools in the AI SOC category.

Threat intelligence products. The same founders' post said that threat intelligence "the single most valuable asset a defender has, sits in PDFs no one operationalizes." A Mars guide on threat intelligence platforms promises to cover what such a platform ingests and exports, and "where its output stops short of defense." Read together, the company's position is that it consumes intelligence and turns it into hunts and detections, rather than selling the intelligence itself.

Other hunt libraries. In a September post, chief executive Shahaf Galili wrote that most hunt library features in the space are, in his words, "glorified saved-search folders".

Claims of being first. At the September launch of its intel-based detection feature, Help Net Security reported that Mars believed it was the first platform to automate the full path from advisory to production detection. The founders' post went further: "Nobody else is shipping it." These are the company's claims. CISO Tribune has not tested them against the neighbours listed above.

Funding, investors and growth

Mars Security has disclosed one funding round.

The investor names come from the company. The founders' launch post states: "We're backed by TLV Ventures, Jibe Ventures, Bullet Ventures, CCL, and XPS" (Mars blog). The post does not say which of the five led, how the money was split among them, or whether any individual angels took part. No single passage ties the amount to those names, so reading them as the same round is our inference.

The company did not publish a plan for the money. The same founders' post described its backers only as "Investors who share the conviction: this problem is solvable, and the window to solve it is now" (Mars blog). It gave no split between hiring, sales or product work, and no runway.

By late October the company's blog was describing work done "against our customers' EDRs" (Mars blog), again with no count. The Substack post described the company as based in Tel Aviv (The Security Industry). We found no list of offices from the company itself.

The same post placed Mars among "Twenty newly tracked companies in the IT-Harvest Dashboard" and filed it under SOC automation (The Security Industry). That is a tracker's classification, not a disclosure from the company. Readers following later rounds or hires at Mars and the other vendors on our record can find them through /vendors and /moves.

Customers, partners and public evidence

Mars Security has published no named customers, case studies, partner programme, certification or award in the material we reviewed. Its homepage menu carries an entry titled "What security leaders think about Mars?", but the captured page showed no quotations or customer names under it. Readers comparing it with other vendors in its categories should treat what follows as mostly the company's own account of its work.

The company says "40% of the malware files Mars identified weren't recognized by our customers' EDRs." The post describes the inputs: Mars "read 1,800 threat reports from hand-picked sources" and, in "one month alone", extracted thousands of indicators from hundreds of campaigns. The post does not name the customers, the number of customer environments or which EDR products were checked. It also states that antivirus updates "take 72 hours on average, and can take weeks", and attributes this only to "research and industry estimates" without naming a study.

The company wrote that "Co-Hunter has become one of the most-used parts of the Mars platform" and that, as usage grew, "one request kept coming up: more control." The post gave no usage counts.

Integrations, not partnerships. The integrations page says Mars "connects to your existing security stack by API" and groups the connectors into categories such as cloud platforms, security and threat intel, identity, and observability and SIEM. The page also states that Mars "connects to any source with an API." The page names the products Mars connects to. In our reading, that is not evidence of a formal partnership or a marketplace listing with any of those vendors, and the page does not claim one.

Press coverage. Help Net Security ran an industry news item on September 8, 2026. It reported that Mars had "announced Real-Time Intel-Based Detection" and that each generated rule is "tested against 30 days of the customer’s own data before it goes live." The item relays the company's description and quotes its founders. It does not include outside testing. CTech also published an opinion piece by Galili, "AI isn’t creating super-hackers. It’s scaling less-skilled attackers". The piece argued for behaviour-based detection and did not present product results.

On present evidence, buyers would need to ask Mars directly for customer references and for the method behind its EDR comparison.

Research, open source and public work

Mars Security's public output, in the material we reviewed, was company writing: a blog of product posts, a library of guides and opinion pieces by its CEO. We found no open-source repositories, vulnerability disclosures, independent benchmarks or conference talks in the sources available to us. That is our reading of the record, not a claim the company makes.

Guides. The company's guides page describes the collection as "in-depth guides on detection engineering, threat hunting, and modern security operations". The guides are undated and credited to Mars Security rather than to named authors. One summary states that proactive threat hunting "covers the twelve days between a public CVE advisory and the first published detection rule". The listing does not say where the twelve-day figure comes from. Another guide promises to explain how to judge "any vendor's detection accuracy claim".

Playbook write-up. On September 16, 2026, Shahaf Galili published a post on Hunt Templates, which the company calls playbooks. It walked through one template in technical detail. It noted that one of those events only fires when SACL auditing is enabled, which the post said most environments have not turned on, so the playbook "flags that as a coverage gap rather than assuming the telemetry exists". Each playbook, the company says, is "versioned with a real author".

Prevention post. The October post on customers' EDRs, mentioned earlier, was written by Itay Amar, a software engineer at the company, and dated October 26, 2026. It described its method: Mars checked every indicator "against dozens of reputation sources". The post also reported problems Mars found in customers' block lists. It listed indicators "added but never enforced, because of how each EDR actually handles each indicator type", and needless duplicates. The post did not publish its underlying data, the list of reputation sources or a sample size for the block-list findings.

Opinion. In the CTech piece noted earlier, Galili argued that AI "is making less-skilled attackers faster, cheaper, and more effective." He supported the argument with outside work rather than Mars data. He cited a Huntress report describing a 1,380% rise in device-code phishing by one phishing-as-a-service operation. He also cited a 2024 study that found fully automated AI spear-phishing emails performed on par with emails written by human experts. He closed with questions for boards, including "How quickly can new threat intelligence become a hunt or detection inside our environment?"

Product notes. On October 19, 2026, the blog also documented Co-Hunter Instructions, which the company describes as standing guidance added to every new Co-Hunter session.

What a CISO should ask before buying

These questions are our reading of what a proof of concept with Mars Security should test. Each one is tied to a claim the company or its coverage has made, and each is meant to be answered on the buyer's own data rather than in a demo tenant.

1. Deployment time. The homepage says Mars deploys in hours with no ingestion pipelines. Ask the team to connect your SIEM, EDR and identity provider inside the trial window. Log how long each connector took, including the time spent on permission approvals.

2. Query load. As we read it, querying in place puts the compute on your own systems. Ask what query volume and cost a week of continuous hunting adds to your SIEM.

3. Intel sources. Mars said it read 1,800 threat reports from hand-picked sources. Ask for that source list and how a source is added or dropped.

4. The EDR gap claim. The company said 40% of the malware files it identified were not recognized by customers' EDRs. Ask Mars to run the same check against your EDR during the trial and show you the indicators behind the result.

5. The rest of the work. Mars says Detection Recommendations does the first 80% of the work. Ask which part stays with your engineers. Then time that remaining work on five real advisories.

6. Indicator screening. The company says it screens each reported IOC against its own false-positive track record. Ask whose data builds that record and whether noise from your environment feeds into it.

7. Block authority. Mars said it will manage block lists end to end in the customer's EDR. Ask what approval step sits before an automatic addition or removal, and how a bad block is reversed.

8. Triggered hunts. A playbook can start when CrowdStrike throws an alert. Ask how the number of triggered runs is capped during an alert storm.

9. Messages to users. In Slack, Mars's agent can contact users with analyst review and approval on every send. Ask for a demonstration that the approval step cannot be skipped, and ask to see the message as the user receives it.

10. Instruction versions. Published Co-Hunter Instructions become a version you can roll back to. Ask whether each investigation records which version of the instructions shaped it.

11. False positive rate. The launch post promised extremely low false positives. Ask how Mars defines and measures that rate. Keep your own count for the length of the trial.

Timeline

Mars Security's dated public record is short. The entries below fall between June and October 2026, and most come from the company's own announcements and the trade coverage that carried them. The list runs oldest first.

The chart below counts the milestones tallied for this profile by quarter of 2026.

Chart data: Milestones cited in this profile; most from cybersecuritytribe.com: Mars Security Emerges from Stealth with Threat Hunting Platform.

• June 16, 2026. Mars announced its emergence from stealth. The release described the company as "an AI-powered threat hunting platform for modern security teams" and said it was in early access with design partners and first customers. NewsBreak carried the announcement the same day.
• September 16, 2026. Shahaf Galili wrote that Mars had shipped Hunt Templates, which the company calls playbooks. How they work is covered earlier in this profile.

The pattern in this list is our reading of it: after the stealth launch, the company's public milestones have been product releases announced on its own blog or through trade outlets, roughly one a month, rather than funding rounds, acquisitions or named partnerships. The sources given here record no acquisition or formal partnership.

Undated material, such as the Slack app page, the integrations list and the guides library, is left out of this timeline because the sources give it no date. A reader tracking the company should check the vendors index and the newsletter for later entries.