Mate Security: who they are, what they sell and what CISOs should ask

What Mate Security sells

Mate Security sells software agents that run security operations work for enterprise SOC teams. The company was founded in early 2025 and is based in Tel Aviv. It is venture-backed. In July 2026 it raised a $35 million Series A led by Canaan Partners, with Microsoft's M12, Insight Partners and Team8 taking part. That round followed a $15.5 million seed and brought total funding to more than $50 million. At the time it employed around 50 people, 40 of them in Israel and the rest in the United States. Wiener said the company's focus is the U.S. market.

The product is one platform, which the company's relaunched homepage now presents as a single agentic cyber defense system. The homepage says Mate turns a deep understanding of your organization into what it calls purified knowledge, so its AI agents take the right action across every security use case. It lists those uses as SOC triage and investigation, threat hunting, incident response, insider risk and DLP, exposure management, detection engineering, security engineering and security architecture. At the centre sits what the company calls a Security Context Graph. Within that platform the company describes several working parts:

• Investigation. Gamebooks are structured investigation processes for its agents. They were launched in August 2026. The company says Mate translates existing SOAR playbooks into Gamebooks.
• Hunting. Analysts can paste a threat report or ask in plain language, and Mate extracts IOCs and TTPs and hunts across connected tools.
• Response. Response runs at three levels of autonomy: recommend only, supervised and auto-run. Each action is scored on confidence, precision and reversibility before it runs.

On delivery, Mate is a cloud service that connects to the tools a SOC already runs. SecurityWeek reported that it integrates with SIEM, EDR and email security platforms. The platform page describes the customer's first 24 hours with Mate: it starts in shadow mode on the customer's real alerts, one investigation shows the reasoning, and the first day shows the pattern across the alert queue.

The company states that Mate is built on AWS infrastructure. It was listed on AWS Marketplace in January 2026, so customers can subscribe and manage their account within existing AWS accounts.

The company's own pages also say what it is not. Wiener wrote that security operations need more than an LLM bolted onto a SIEM. The Gamebooks page sets the product apart from two alternatives: it calls SOAR playbooks deterministic and brittle, and unbounded AI SOC agents hard to trust. It presents Gamebooks as the structured step between them. On our reading, that puts Mate next to SIEM and SOAR tools rather than in place of a SIEM, since it queries those systems instead of storing the logs itself.

The relaunched homepage also sets out how the company sees its market. It says the cybersecurity market is splitting into three: governance, which keeps AI agents in check; offense, which thinks like an attacker to find gaps first; and defense, which protects the business. Mate places itself in the third. In the homepage's words, Mate is ACD: built from day one for AI agents to reason on, ACD standing for agentic cyber defense.

Figure: Mate Security's relaunched home page, captured 2026-11-03. Source: Mate Security home page.

The founders

Mate Security has three co-founders: Asaf Wiener, the chief executive; Oren Saban, the chief product officer; and Guy Pergal, the chief technology officer. The company's about page says its founders "led product at Wiz, Microsoft, Axonius and Apex" and that they saw what was broken in AI for security operations.

The seed announcement Insight Partners published gives each founder's earlier role. It describes Asaf Wiener as previously a product leader at Wiz and Microsoft, and the first Wiz alumnus to found a startup. The author note on his company blog posts calls him a cybersecurity product leader with expertise in cloud security, vulnerability management and SOC innovation. The same release says Oren Saban was former head of product for Microsoft Defender XDR and Security Copilot. It describes Guy Pergal as a veteran of Microsoft's threat intelligence center (MSTIC) and a former engineering leader at Axonius.

Wiener has explained the founding several times. When the company came out of stealth, he said "The old approach of configuring and maintaining endless playbooks doesn’t scale". In a later blog post introducing the Security Context Graph, he wrote that before Mate he and his co-founders had worked at companies that built earlier AI SOC agents. His diagnosis of why those agents fell short: "We saw why they were failing, and it wasn't the agent, it was the data."

He returned to the point in a post written after the Series A. There he named both co-founders and wrote that when they started Mate, they knew they had to build a new foundation. He tied that view to experience: before founding the company, the three had spent years building products like XDR and Security Copilot. The same post sets out three design principles. The first was organizational context, because, in his words, AI needs to understand more than alerts and telemetry. Trust was the second, and the third was openness. Around the Series A he told SecurityWeek that "we knew we had to invest in the foundation: context and trust, and build them deeply into our product".

Wiener has kept writing about how the company works. In October 2026 he published The A-Team: What Building AI Agents Taught Me About Building a Team, five lessons on context, structure, focus and scaling a startup team. Profiles of the founders and other security executives are on our people pages.

What the product does

Underneath Mate's AI SOC platform sits the Security Context Graph, which the company says its research lab built along with a patent-pending Reason Mining Engine. The platform page splits the graph into four parts. Memories are facts that each carry source, confidence and freshness so agents can judge what to trust. Decision Traces record why an analyst made a call, not only the final verdict. Guardrails note where regulations, business rules or internal controls constrain what an agent can do. Architecture maps network topology and where each part of the security stack is deployed. In a company blog post, Wiener wrote that the graph keeps rebuilding with every investigation, every ownership change and every policy change.

Investigation runs on top of that graph. For each alert, the company says Mate assembles an evidence chain of the artifacts, history, identities and tool outputs an expert would check. It then returns a conclusion with an evidence trail the team can audit and tune.

The steps follow Gamebooks, which SiliconANGLE reported the company had launched to govern how agents run investigations. A Gamebook fixes the intent: it defines what evidence is required, which actions are permitted, and what approval boundaries apply. Within those limits, agents decide which skills to invoke next and when to pivot. Tool calls sit in separate flows, each with access restrictions for their current task, so a connector can change without the investigation logic changing. Teams can bring existing work in two ways: Mate translates SOAR playbooks into Gamebooks, or an analyst writes a new investigation in plain language, which Mate tests against past cases before waiting for sign-off. The company says customised Gamebooks also pass through its own evals and tests before going live.

On response, the CPR checks described earlier are applied by the platform outside the agent's reasoning loop, so, the company says, Mate cannot widen its own permissions or grade its own accuracy. If accuracy drifts in a category, that category drops back to Supervised. Precision is defined as the smallest action that works, for example to revoke the session, keep the account.

Two loops feed the graph back. Detections are, by the company's account, created, tuned, or deprecated according to investigation outcomes. Beyond the report-driven hunts covered above, Hunt Agents build their own hypotheses and initiate hunts when the environment or threat activity changes.

The relaunched homepage lays the process out as an accuracy chain of six steps: collect, clean, structure, guide, act and learn. Every signal, log, and event is collected, then run through cleanup, normalization, and correlation. The data is stored as entities and relationships, and a reason mining engine keeps the underlying reason behind each conclusion. Gamebooks guide the agents, the CPR checks govern what they do, and every outcome is scored and fed back into the system, which the company ties to its continuous detection and response framework.

In our reading of these pages, the person in charge keeps three levers: approving each new or edited Gamebook, setting the approval boundaries agents must respect, and deciding which action classes may run unattended.

Figure: Mate Security's product page, captured 2026-11-03. Source: AI SOC Platform | Mate Security.

How it works and what it connects to

Mate's own pages describe a layer that sits on top of a customer's existing tools rather than replacing them. SecurityWeek, covering the seed round, reported that the product integrates with SIEM, EDR and email security platforms. The company's homepage describes a wider set of sources. It says Mate works with knowledge that runs from firewall rules and Terraform setups to custom apps, wikis and SOPs, and that it learns an organisation by ingesting tickets, documentation, incidents, configurations and behavior patterns. The homepage's FAQ puts that learning at hours, not months.

Tool access runs through the separate flows described earlier. The Gamebooks page gives an endpoint example in which a single flow draws on CrowdStrike, Microsoft Defender, Device42, an MDM platform or a custom data lake, depending on what the environment has. For hunting, the platform page says a user can paste a threat report or ask a question in plain language, and Mate then extracts IOCs and TTPs and hunts across every connected tool.

On methods, SecurityWeek reported that Mate relies on AI agents, LLMs and reasoning models to investigate and resolve incidents. After the Series A, Wiener told Calcalist that Microsoft's involvement brought a strategic partnership and access to advanced AI models. Neither source names the models.

On deployment, the company's AWS Marketplace announcement said Mate is built on AWS infrastructure, and that buyers could subscribe and manage their account within existing AWS accounts. The company says rollout begins in shadow mode on real alerts.

The company states some limits of its own. Beyond the supervised mode and the drop-back rule covered above, the platform page says autonomy grows one action class at a time. The Blue City benchmark write-up from Mate's lab tested AI security agents in a simulated enterprise. It stated that its results describe performance on this selected challenge set, and that the cost budget in its current implementation was measured and reported rather than strictly enforced.

The sources do not say where customer data is stored, which hosting regions are offered, whether a self-hosted option exists, or how one customer's graph is kept apart from another's.

Where it sits in the market

CISO Tribune's record files Mate Security under three categories. AI SOC analysts covers software agents that triage, investigate and document security alerts with limited human input. SOAR and security automation covers workflow and playbook engines that automate security operations tasks across tools. Threat intelligence covers feeds, platforms and research services about threat actors, infrastructure, malware and vulnerabilities being exploited.

The chart counts the companies CISO Tribune's record files under each of the three categories Mate Security sits in.

Other companies on the record in those categories, in alphabetical order, are 7AI, Alphabet, Anomali, Anvilogic, Censys, Cyble, CYPFER, Cyware, D3 Security, Dataminr, Devo, Dropzone AI, EclecticIQ, Elastic, Elbit Systems, Exabeam, Filigran, Flashpoint, General Dynamics Information Technology, Graylog, GreyNoise, Group-IB, Guardsix, Hunters, IBM, Indra Group, Intel 471, IRONSCALES, iVerify, Kai, Keepnet Labs, Leidos, Leonardo, Mave, Overwatch, Panther, Parsons, Peraton, Prophet Security, QuoIntelligence, Rapid7, Recorded Future, Red Canary, Secureworks, SecurityScorecard, Securonix, Sekoia, SOCRadar, Splunk, Stellar Cyber, Sublime Security, Swimlane, Tego Cyber, ThreatConnect, Tines, Torq, UnderDefense, VulnCheck and ZeroFox.

Mate's own pages draw the line against SOAR most sharply. Its Gamebooks page states that "SOAR playbooks are deterministic and brittle. Unbounded AI SOC agents are hard to trust." (Mate). The same page says of SOAR tools with AI authoring that "AI-assisted authoring reduces maintenance but all other problems remain" (Mate). It describes open-ended agentic investigation as "Dynamic, but unbounded - inefficient and hard to trust." (Mate). The platform page gives an example in which "CrowdStrike becomes SentinelOne." It says a SOAR playbook then has "6 of 12 nodes need rewriting." A Gamebook, the company says, stays the "Same Gamebook. New connector swapped in automatically." (Mate).

Against other AI SOC products, the company's homepage states: "Three things set Mate apart: instant organizational context, works with any tool, and keeps getting smarter. Most AI SOC tools start blank and need weeks to tune." (Mate).

On threat intelligence, the hunting page says Mate's agents use the organisation's context "alongside emerging threats and threat intelligence, to determine what to hunt and where to focus." (Mate). The same page claims that "Mate is the only platform running contextual, architecture-led hunts." On our reading, Mate's pages present threat intelligence as an input to its hunts, not as a feed or research service it publishes in the way several neighbours in that category do.

Funding, investors and growth

The sources show two funding rounds. The Series A followed in July 2026: $35 million led by Canaan Partners, with participation from Microsoft's M12 venture fund, Insight Partners and Team8, CTech reported. CTech put the gap between the two rounds at eight months and the company's total funding at more than $50 million. In his post announcing the round, Wiener thanked the two seed investors for "continuing to believe in this vision from the very beginning" (Mate blog).

The chart shows the two rounds reported in the sources, in millions of US dollars, as reported by CTech.

Chart data: Insight Partners; ctech.

The company tied each round to specific uses. The seed money was meant to support expansion of the engineering team, extended design-partner collaborations and preparation for a broader enterprise rollout, Insight Partners' release said. At that point the company said it was working with large financial institutions and critical infrastructure operators across the U.S., Europe and Israel. The Series A was earmarked for the sales, customer support and research and development teams, according to CTech. SecurityWeek added market presence to that list and quoted Wiener saying the company would expand "into new markets and categories". Microsoft's part in the round, covered earlier, was described as more than capital.

On headcount, CTech reported that Mate employed around 50 people at the time of the Series A, 40 of them in Israel and the rest in the United States. The company said it planned to roughly double its workforce by the end of the year. Wiener told CTech the company's focus was the U.S. market, where he said he saw growing demand among Fortune 500 companies.

CTech reported that Mate had grown by more than 500% since the third quarter of 2025, "according to the company".

For other funding announcements on our record, see /moves and /companies.

Customers, partners and public evidence

Mate's relaunched site names far more customers than before. Under the line "Built for agents. Trusted by enterprises.", its homepage and platform page show the logos of Bridgewater Associates, Lead Bank, FitchGroup, AlphaSense, OCBC, Merlin Entertainments, monday.com, Discount Bank, Freshworks, Demandbase, Applied Systems, Water-IT, Anaplan, Bright Data, Koan and Playtika.

Eight of those customers are quoted by name, most of them by their security chief:

• Bridgewater Associates. Anthony Candeias, Chief Information Security Officer, said Mate "continuously learns how our environment operates."
• Lead Bank. Gavin Grisamore, Chief Information Security Officer, said Mate's agents are "flexible enough to assign complex work to, but accurate enough to trust."
• Merlin Entertainments. Matthew Wilmot, Chief Information Security Officer, said the product "delivered deep investigative insights and incident summaries in minutes."
• OCBC. Hadar Michaelis, Group CISO and Head of Group TISO, described "real operational impact" from its automated investigations.
• AlphaSense. Pieter VanIperen, Chief Information Security Officer, said the company had moved nearly 100% of its investigations into Mate and planned to move away from high-cost external monitoring.
• Applied Systems. Tanner Randolph, EVP, CIO and CISO, said every alert now gets a thorough investigation.
• Demandbase. Derek Stephenson, Chief Information Security Officer, said Mate covered the company's entire stack within days.
• Water-IT. Alexander Kraus, Chief Technology Officer, wrote as a managed security provider that Mate made his team stack-agnostic for any customer.

The relaunched homepage also publishes three headline figures: 98.7% accuracy with Mate, 97% false-positive auto-closure and 6.1X investigation coverage. The platform page's summary says the product cuts MTTR by 93%. A chart on the homepage compares frontier models run alone with the same models run through Mate, measured as accuracy on 7,200 alerts. Earlier, at launch, Mate said that pilots with financial services and critical infrastructure organisations had led to significant reductions in mean time to respond and in false positives, and its accelerator announcement states that the product shortened investigations that once took 45 minutes to 45 seconds.

On partners, Mate was selected for the 2026 Cybersecurity Startup Accelerator run by CrowdStrike with AWS and NVIDIA. The eight-week program ran from January 5 through March 3, 2026 and ended in a Demo Day at the AWS Startup Loft in San Francisco on March 24, 2026. The product is listed on AWS Marketplace. The company says purchases there can count toward AWS spending commitments through private pricing agreements. Separately from the M12 investment covered above, Wiener told CTech that Microsoft's involvement provides a strategic partnership and access to advanced AI models.

On recognition, the homepage now lists five items. Gartner included Mate in its Emerging AI SOC Vendor Solutions research in July 2026. Latio covered it in its Security Operations Market Report in June 2026 and named it a Security Operations AI Innovator 2026. Google picked it for its Gemini Startup Forum in July 2026. LinkedIn listed it as a Top Startup in October 2026, and the same month it won "Security Response Solution of the Year" in the 10th annual CyberSecurity Breakthrough Awards, according to its newsroom.

The only benchmark in the sources is Mate's own. Blue City is the company's simulated enterprise for testing AI security agents. In Blue City, business activity continues during an attack and defensive actions have consequences. The writeup describes eight scenario families, each run as a pair of twins. It states that the Mate system resolves them correctly, and adds that this is a difficulty check that does not assign Mate a perfect score on every generated run. Other vendors in these categories are on our vendor record.

Research, open source and public work

Mate's public work, as its own pages list it, fell into three groups: incident write-ups, framework essays and one benchmark.

Incident write-ups. The blog carried a post on the npm Chalk and Debug compromise dated December 10, 2025, stating that 18 popular npm packages were compromised to hijack crypto transactions, with guidance on checking exposure. On December 22, 2025 it published a simulated React2Shell attack told from the SOC side, covering early weak signals, exploitation and detection. An April 5, 2026 walkthrough of the Axios supply chain attack described, in the company's account, how its own agents detected and contained threats in a CI/CD environment. A May 14, 2026 analysis argued that AI-generated variants of supply chain attacks bypass IOC-based detection.

Frameworks. CEO Asaf Wiener set out Continuous Detection / Continuous Response as a security operations framework on May 18, 2026. A June 30, 2026 post offered buyers a five-question rubric for testing whether an AI SOC vendor's claims about context hold up. The about page says the company's research lab built the Security Context Graph and a patent-pending Reason Mining Engine, and that it shares eval sets written by incident responders and SecOps engineers. On November 2, 2026 the company published a post on data collection and data cleaning as the starting point for accurate security agents, the first two steps of its accuracy chain.

Its design notes carried several limits worth knowing. The agents under test were run with a basic harness and without Mate's own system attached, so the write-up says results describe each defender, an agent paired with a model, not model ability alone. All scenario content was synthetic, with no customer data, logs or personal information used, and defenders worked through read-only SQL telemetry and operational tools through the Model Context Protocol. Spending was measured and reported rather than strictly enforced. One preparation phase served each of the 32 incidents, but the authors wrote that the run did not isolate the size of that effect and that a control without preparation was planned for a later release. The paper claims that a single score weighing business continuity against attacker damage is new, stating that no benchmark has measured a defender this way.

What a CISO should ask before buying

The questions below are our reading of what a CISO could test in a proof of concept with Mate Security. Each is tied to something the company says about its own product.

1. Shadow mode. The company says Mate starts in shadow mode on your real alerts. Ask how long shadow mode can run, which alert sources it covers, and how its verdicts will be compared with your analysts' own closures.
2. Time to context. Its homepage says Mate learns an organization in hours, not months. Ask what data it reads in its first 24 hours. Then test whether early verdicts change once the graph holds more history.
3. The headline figures. The homepage publishes 98.7% accuracy with Mate and 97% false-positive auto-closure. Ask how each was measured, on which alert mix, and run the same measure on your own queue during the trial.
4. Provenance of memories. Mate says every fact carries source, confidence, and freshness. Pick a sample verdict, ask to see the source and age of each fact it relied on, and ask what happens when a fact goes stale.
5. Decision traces. The company says it captures why an analyst made a call. Ask how a wrong analyst decision is corrected so that it does not keep shaping later verdicts.
6. Controls outside the agent. Mate says the platform enforces its action checks outside the agent's reasoning loop. Ask for a demonstration of an agent attempting an action beyond its permissions, and ask where that refusal is logged.
7. Irreversible actions. Mate says it sets a higher bar for actions it cannot roll back. Ask for the list of actions it treats as irreversible in your stack and the approval each one needs.
8. Tool swaps. Mate's Gamebooks page claims that after an EDR change the same Gamebook keeps running with a new connector. If your environment runs two EDRs or two SIEMs, put the same investigation through both.
9. Who tests your changes. The company says a customised Gamebook runs through Mate's evals and tests before it goes live. Ask what those tests contain and whether your team can read the results.
10. Self-started hunts and detection changes. Mate says its hunt agents build their own hypotheses and initiate hunts, and that detections are continuously created, tuned, or deprecated from investigation outcomes. Ask for a log of every hunt and detection change made during the trial, and confirm whether a person approves each deprecation before it takes effect.

Timeline

The dates below come from Mate's own pages and from press coverage of its two funding rounds. The list runs oldest first and holds only events a source dates. Most of them fell in 2026, the year after the founders started the company.

The chart counts the dated milestones cited in this profile by quarter, from founding in 2025 to the award in October 2026.

Chart data: Milestones cited in this profile; most from ctech: Former Wiz and Microsoft veterans raise $35 million Series A to build the “operating system” for AI cybersecu.

• November 17, 2025: out of stealth. Mate went public with $15.5 million in seed funding from Team8 and Insight Partners, according to the launch announcement. The round and its backers are covered in the funding section above.
• January 5, 2026: accelerator. Mate joined the 2026 Cybersecurity Startup Accelerator run by CrowdStrike with AWS and NVIDIA. Its announcement said the eight-week programme ran from January 5 to March 3, 2026. It also said the programme ended with a Demo Day at the AWS Startup Loft in San Francisco on March 24, 2026.
• January 15, 2026: AWS Marketplace. Mate announced that it was available on AWS Marketplace.
• June 2026: Latio report. Latio covered Mate in its Security Operations Market Report.
• July 2026: Series A, Gartner and Google. Mate raised its $35 million Series A, Gartner included it in its Emerging AI SOC Vendor Solutions research, and Google picked it for the Gemini Startup Forum.
• August 2026: Gamebooks. The company launched Gamebooks.
• October 2026: benchmark, LinkedIn and award. Mate published Blue City on October 12, was listed as a LinkedIn Top Startup, and won Security Response Solution of the Year.
• November 2026: new website. Between our captures of October 29 and November 3, 2026, the company rebuilt its website around agentic cyber defense, with eight named customer quotes and its first published accuracy figures.

Read together, the list shows a company that spent its first year building privately and its second announcing in quick succession: funding, a product launch, three industry listings and an award fell within about four months of one another in 2026.

The list leaves some things out. It has no entries for customer wins, because the customer statements on Mate's pages carry no dates. It also has no entries for hires or departures. Readers tracking the company's people can follow /moves and /people for dated changes as they are recorded.