DeepTempo

Market position

DeepTempo positions itself against rules- and signature-based detection systems and earlier-generation ML tools, and against AI SOC vendors that wrap agents around general-purpose LLMs, arguing that a purpose-built telemetry foundation model and readable open source agent code are differentiators. It presents itself as complementary to incumbent SIEM, NDR, EDR/XDR and SOAR products rather than a replacement.

Stated points of difference include: a purpose-built pretrained foundation model for telemetry rather than prompting over a third-party LLM; open source (Apache 2.0) Vigil code that customers can read, extend and fork; full in-boundary operation with no hosted tier, keeping weights, verdicts and learning inside the customer environment and allowing bring-your-own LLM; zero-shot operation without labeled data or lengthy tuning; agentless, flow-based east-west visibility; and an open benchmark (SOCBench) for measuring detection efficacy and drift.

Technology

LogLM is a deep learning foundation model pretrained on large quantities of security telemetry, focused on sequences and patterns of events including relative and absolute time, so that it operates zero-shot without labeled data or a lengthy tuning project. Detections arrive with contextual explanations, event sequences, entities involved and ATT&CK mappings. Company materials cite sub-second detection latency across petabyte-scale data, 99% detection rates for common TTPs such as command-and-control, less than 5% false positives, and day-one accuracy figures that are stated inconsistently across pages (85%+ improving to 94%+ after adaptation on one page; up to 99%+ on another). Vigil runs customer-supplied agents, playbooks and LLMs; SOCBench is presented as an open benchmark for measuring any detection stack. The team cites prior experience building StackStorm, an automation platform, as the source of its "attempt, verify, repeat" approach to earning trust in automation.

Go-to-market

Distribution runs through the Snowflake Native App Framework and Snowflake Marketplace, allowing security teams to trial the Tempo app inside their own Snowflake environment and integrate it with existing tools. The website offers a "Detection Assessment" run against a prospect's historical logs as an entry point, along with demo and assessment requests. The open source Vigil project serves as an additional adoption path. In February 2025 the company hired its first sales VP, Chris Bowen, signaling a move toward direct enterprise selling, with coverage suggesting the pitch would target Snowflake's channel.

Enterprise and large-scale security operations teams — including SOC analysts, detection engineers and threat hunters — at businesses and operators of critical infrastructure, spanning IT, OT and cloud estates. Named collaborators and reference environments include BNY (Bank of New York), Deutsche Telekom, Stanford's cyber teams, and TAC for OT management. Customers running Snowflake data lakes are an explicit channel, with integrations noted for tools such as Splunk and Anvilogic.

Geography

Evan Powell is listed in Palo Alto, California. Cited collaborations span US institutions (BNY, Stanford) and Europe (Deutsche Telekom).

History

DeepTempo was set up by Evan Powell in November 2023 and emerged from stealth in November 2024. It built its Tempo application as a Snowflake Native App and completed the BNY Ascent Program, including an extensive proof-of-concept validation with Bank of New York engineers, executives and clients. In February 2025 it hired Chris Bowen, previously SVP of sales at Hammerspace, as its first sales VP. In March 2025 Snowflake profiled the company in its Startup Spotlight series. The product line subsequently expanded beyond the Tempo Snowflake app to an "Intelligent Defense Platform" comprising the LogLM detection model, the Vigil open source AI SOC and the SOCBench evaluation layer, with collaborations cited with Deutsche Telekom, Stanford and TAC.

Risks & controversies

Performance figures published by the company are inconsistent across its own pages: one page states 85%+ accuracy on day one improving to 94%+ after adaptation, while another states up to 99%+ accuracy on day one. Reported outcome metrics are vendor-supplied rather than independently verified. Press coverage in February 2025 noted that the company's funding history was not public, inferring only that a Series A must have been completed as a condition of the BNY Ascent Program.