Palo Alto Networks

IDENTITY RESOLUTION NOTE: Database row 10012340 arrived with a corrupted name field reading "Exit Cloud Threat Security" and a website field of "paloaltonetworks.com" — a data-import artifact in which the real startup's name/site appear to have been overwritten with a generic description of its exit event ("acquired by Palo Alto Networks, in the cloud threat security space"). To resolve this I first compiled Palo Alto Networks' full acquisition history (Morta Security, Cyvera, CirroSecure, LightCyber, Evident.io, Secdo, RedLock, Demisto, Twistlock, PureSec, Zingbox, Aporeto, CloudGenix, Crypsis Group, Expanse, Bridgecrew, Cider Security, Dig Security, Talon Cyber Security, and more recent 2025-2026 deals like Protect AI, CyberArk, Chronosphere, Koi Security, and Portkey). I then checked Greylock Partners' own portfolio page (greylock.com/portfolio/), which lists Demisto among its portfolio companies. I cross-verified this on Crunchbase, whose Demisto organization profile and funding-rounds page explicitly show Greylock as the lead investor of Demisto's Series C round (with Accel and Salesforce Ventures also listed as investors, and Accel partner Jake Flomenberg as a board member). No other Palo Alto Networks security acquisition on the above list (Twistlock, PureSec, Bridgecrew, Cider Security, Dig Security, Talon Cyber Security, CloudGenix, etc.) shows any Greylock involvement in their respective Crunchbase/press investor lists that I could locate (e.g., Bridgecrew's confirmed investors were Battery Ventures, DNX Ventures, and Operator Partners — no Greylock). Demisto is therefore the best-supported match, corroborated by two independent sources (Greylock's own portfolio listing and Crunchbase's investor/funding data), and I treat this identification as highly confident, though I could not independently pin down the exact date or dollar amount of Greylock's Series C investment (Crunchbase keeps these obfuscated behind a paywall) or the name of the specific Greylock partner who led/board-observed the deal — those two fields are left blank rather than guessed.

Demisto was founded in 2015 (officially launched in July 2015 per contemporaneous TechCrunch coverage) by Slavik Markovich (CEO), Rishi Bhargava, Dan Sarel, and Guy Rinat. Three of the four co-founders (Markovich, Sarel, and Rinat) had previously worked together at Sentrigo, a database-security startup acquired by McAfee around 2011, and the founding team split its operations between Cupertino, California (sales and marketing/HQ) and Tel Aviv, Israel (core engineering). The company built Demisto Enterprise, a Security Orchestration, Automation and Response (SOAR) platform centered on a chat-driven automation bot called DBot: security analysts could interact with DBot in a shared chat interface while it executed configurable 'playbooks' that pulled data from and triggered actions in dozens of connected security products (Palo Alto Networks, Splunk, Carbon Black, and others), addressing what CEO Slavik Markovich described as the security industry's lack of 'cross-product workflow.' The product launched into beta on April 1, 2016 and emerged from stealth publicly on May 25, 2016 with an 18-person team and a $6 million Series A round led by Accel, with individual angel participation from Stuart McClure (then CEO of Cylance), Kevin Mahaffey (co-founder/CTO of Lookout), and Mike Fey (then president of Blue Coat Systems, later McAfee CEO).

Demisto went on to raise Series B and Series C rounds (exact dates and amounts not confirmed in public sources available to me), with Greylock Partners leading the Series C round; by the time of its acquisition the company had raised a total of $69 million. In May 2018, Demisto announced an integration app for the Palo Alto Networks Application Framework, deepening a technology partnership between the two companies well before any acquisition talks became public. On February 19, 2019, Palo Alto Networks announced a definitive agreement to acquire Demisto for approximately $560 million, with the deal expected to close in Palo Alto Networks' fiscal Q3 2019 (its fiscal year runs August-July, so fiscal Q3 spans February-April). At the time of the deal, Demisto had roughly 150 customers, about 25% of them Fortune 500 companies. Nine days after the announcement, on February 28, 2019, Demisto shipped a Mobile Incident Management feature — one of its last product announcements as an independent company. Palo Alto Networks' subsequent SEC Form 10-K described the rationale as expanding 'the functionality of our platform with the addition of Demisto's SOAR product,' available 'as a cloud-based subscription or on-premises appliance.'

Business model

B2B enterprise security software sold via subscription (cloud-based SaaS) or as an on-premises appliance, targeting security operations center (SOC) teams at mid-size to large enterprises.

Subscription/license revenue from enterprise SOAR platform deployments, available as a cloud-based subscription or on-premises appliance.