Nebulock

Nebulock is a cybersecurity company that sells an agentic, "hunt-first" security operations platform. It ingests telemetry across endpoint, identity, cloud, network and SaaS sources, normalizes raw events and resolves them to single entities on a shared timeline, and maintains a continuously updated behavioral context graph (referred to in company material as the TRACE Graph) that acts as a behavioral system of record for a customer environment. A swarm of AI agents runs the threat hunting lifecycle end to end: forming and testing hypotheses, cross-referencing external threat intelligence, documentation, governance data, past hunts and allowlists against the graph, and producing findings with stated reasoning plus durable detection rules.

The platform's stated outcomes are closing detection coverage gaps, detecting credentialed human and AI-agent insider threats (including shadow AI), preventing detection drift through automated rule refinement, baselining normal human and agentic behavior, and accelerating investigations with remediation guidance. Findings and detections are pushed into customers' existing SOC and SOAR workflows. Named product components include Vespyr, an autonomous hunting agent that monitors global intelligence and scopes and executes hunts without a user directive; the Command Center dashboard; Helix, which queries vulnerability management tools on demand rather than pre-ingesting their data (shipping with Qualys, Tenable, Rapid7, Axonius, CrowdStrike and Microsoft Defender); insider risk management, which collapses a person's or AI agent's accounts, identities and hosts into a single "Actor"; and correlation rules that combine cross-domain signals into one detection with an evidence chain. Nebulock also publishes open material, including the open source Agentic Detection Engineering Framework (ADEF) and coreSigma, a macOS detection framework released via its GitHub repository.

Founding story

Founder and CEO Damien Lewke spent over a decade (described as 12 years) in cybersecurity across Northrop Grumman, CrowdStrike (early integrations engineering, from Series C to IPO) and Arctic Wolf, where he held product roles in AI, threat intelligence and detection. One source also references a master's thesis at MIT CSAIL. Lewke concluded that threat hunting remained manual, single-threaded and reactive even at well-resourced organizations, and that reactive alert triage could not keep pace with machine-speed attackers. After pressure-testing the problem with security leaders and practitioners, he founded the company on the thesis that effective hunting requires agentic AI grounded in contextual security analytics.

Business model

Nebulock sells a software platform to enterprise security organizations, marketed through demo requests on its website. The company describes API-driven integrations with existing security tooling (EDR, SIEM, IAM, CrowdStrike, Okta, Splunk) and onboarding measured in minutes. One source describes scaling ARR and growing deal sizes, and a customer quote characterizes the product as "another teammate working without impacting our budget," but no pricing structure is disclosed in the sources.

Sources indicate recurring revenue (ARR) from enterprise customers but do not disclose pricing, packaging or contract terms.

Traction

By June 2026, nine months after emerging from stealth, the company reported customers among Fortune 500 enterprises and organizations in financial services, healthcare and technology, naming Cribl, HealthEdge and Bain Capital. It reported more than 300 million agentic investigations run and over 4,000 high-confidence findings. During the OpenClaw incident it said it observed over 50,000 related events within a week across 40% of its customer base. Earlier material (2025) cited a double-digit production customer base, scaling ARR and monthly growth in deal sizes, and cited customer outcomes such as identifying a malicious insider who downloaded and ran malware despite a best-of-breed security stack. A February 2026 product update lists SOC 2 Type 2.

Latest developments

Following the June 2026 Series A, Nebulock shipped insider risk management, correlation rules and the Command Center; launched Helix, an on-demand query layer over vulnerability management tools, and the open source Agentic Detection Engineering Framework in late July 2026; hired Alex Hurtado as Head of Detection Strategy in July 2026; and published material on the TRACE Graph behavioral system of record in August 2026. Stated uses of the new funding are expanding platform capabilities, deepening cross-telemetry correlation and the behavioral context graph, and hiring in engineering and go-to-market.