Stream Security
Tel Aviv, IL Β· 58 employees on LinkedIn Β· 6 known investors
Find your way into Stream Security
364 people in our graph share verified history with the Stream Security team β schools, employers, funds. One of them is your warm intro.
Stream Security provides a cloud security investigation tool that correlates detection signals with real-time cloud context β including identity activity, network flows, Kubernetes logs, data sensitivity, and inputs from existing tools like EDR β into a single stateful view. It is aimed at security teams conducting investigations across cloud environments.
Also known as Lightlytics Β· Stream.Security
Founders & leadership
Investors Β· 6
Also in the syndicate Β· 1
Company profile
researched Aug 2026Stream Security (formerly Lightlytics) is a Tel Aviv-based cloud security vendor whose platform is built around CloudTwin, described as a deterministic intelligence layer that continuously computes the live state of an organization's environment across cloud, identities, Kubernetes, VMware, network and SaaS. Rather than analyzing collected signals after the fact, the model correlates configuration, security posture and application and identity behavior at ingest speed, so that when a change or event occurs the platform can identify root cause, exposure and blast radius. Capabilities marketed on the platform include change-driven risk detection, identification of toxic combinations and attack paths, least-privilege enforcement based on observed permission usage, exploitability-based vulnerability prioritization, and automated rollback of configuration changes that fall outside allowed posture.
Detection and response functions span cloud audit log and API telemetry collection, a lightweight eBPF sensor for network, API, process and file activity, UEBA, machine learning, rules and canary traps, MITRE ATT&CK mapping, IOC and IP-intelligence enrichment, and AI detection and response (AIDR) for agent-driven threats such as prompt injection and privilege escalation. On top of CloudTwin, the company offers StreamForce, an agent platform for security operations in which agents perform detection triage and investigation, assemble attack storylines from entry point to blast radius, and simulate response actions against the CloudTwin model before execution; customer-hosted custom plugins allow agents to call internal tools and systems. The company positions the combined offering as autonomous production defense covering prevention, detection, investigation and response.
The product connects to a broad set of third-party systems, including AWS, Azure, GCP, OCI, Kubernetes and VMware; identity providers (Okta, Azure Entra ID, PingOne, auth0, Google Workspace); version control (GitHub, GitLab); DBaaS and data platforms (Snowflake, MongoDB Atlas, Databricks); business applications (Salesforce, Microsoft 365); AI services (OpenAI, Anthropic, AWS Bedrock, Azure Foundry, GCP Vertex); firewalls and WAFs (Palo Alto, Fortinet, Check Point, Cloudflare, F5, Imperva, Akamai); DSPM, EDR and vulnerability scanning tools; SIEM, SOAR, ticketing and alerting platforms.
Founding story
The company was founded in 2020 and is led by three co-founders: Or Shoshani (CEO), Stav Sitnikov (CPO) and Liran Roffman (CTO).
Business model
Stream Security sells a SaaS security platform to enterprises, deployed agentlessly against cloud provider telemetry with an optional eBPF sensor for runtime visibility. Go-to-market includes a StreamLine integration program intended to add cloud context to customers' existing detection and response tools, and channel/consulting partnerships.
Traction
Public markers include a $30M Series B in October 2024, a Gartner Cool Vendor designation for the modern SOC in November 2024, inclusion in LinkedIn's 2024 list of Israeli top startups, two 2025 industry awards for cloud detection and response, SOC 2 Type II certification obtained under the Lightlytics name in 2021, membership in the Cloud Native Computing Foundation, and press mentions in Forbes, CRN and SiliconANGLE. A third-party directory lists approximately 64 employees.
Latest developments
In July 2026 the company launched StreamForce, AI agents built on the live model of production environments, and announced the expansion of CloudTwin to SaaS perimeter controls including Cloudflare, Imperva and Akamai. Other recent releases include customer-hosted custom plugins for StreamForce agents (August 2026), API threat detection using the eBPF sensor and cloud log ingestion, eBPF-based real-time response actions from the Investigator interface, and new Kubernetes and container-runtime attack scenarios for the open-source CDRGoat project.
βΈFull profile β market position, technology, go-to-market, geography, history
Market position
The company positions itself in cloud detection and response (CDR) and CloudSecOps, expanding into agentic AI security operations, and is compared against cloud security and detection vendors such as Wiz, Snyk, Lacework, Aqua Security and Torq. It has received third-party recognition including Gartner Cool Vendor for the Modern SOC (2024), the 2025 Cybersecurity Breakthrough award for Cloud Detection and Response Platform of the Year, and a Top InfoSec Innovator award for cloud detection and response in 2025.
Stream Security's stated differentiator is a continuously computed, deterministic live model of the environment that supplies complete context at the moment of detection, instead of periodic scanning, log-warehouse analysis or post-hoc data stitching. It claims detections at log-ingestion speed, impact- and blast-radius-aware response, simulation of remediation actions against the model before execution, and cloud traps deployed to lure and quarantine attackers.
Technology
CloudTwin is an event-driven, real-time model of an environment that computes state rather than sampling it periodically, correlating configuration, posture and activity for workloads, identities, permissions, datastores, AI agents and network paths. Telemetry is gathered agentlessly from cloud-native logs and APIs and from a lightweight eBPF sensor capturing network, API, process and file activity. Detection uses UEBA, machine learning, rules and deployed cloud traps, with enrichment from threat intelligence feeds and MITRE ATT&CK mapping. StreamForce adds an agent harness in which AI agents share the CloudTwin state as a source of truth and simulate remediation actions before executing them. The company describes the underlying model as patent pending.
Go-to-market
Direct enterprise sales via demo requests, supported by a sales leadership hire (Chief Revenue Officer appointed in 2024), technology partnerships and integrations with vendors such as CrowdStrike and Cyera, a services partnership with ClearScale, the StreamLine integration program, and content marketing including a technical blog and the open-source CDRGoat project. The company also cites industry recognition, including a Gartner Cool Vendor listing for the modern SOC and cloud detection and response awards.
Enterprise security operations, cloud security and DevSecOps teams responsible for cloud-native production environments, including security architects and SOC analysts.
Geography
Headquartered in Tel Aviv, Israel, with U.S.-facing investor and customer activity reflected in U.S. venture backing and North American partnerships.
History
The company was founded in 2020 as Lightlytics, a SaaS platform for modeling cloud-native infrastructure to help DevOps teams plan and deploy configuration changes. It raised a $26M Series A led by Energy Impact Partners in March 2022, joined the Cloud Native Computing Foundation the same year, and launched a Chrome extension for cloud change intelligence in May 2023. In November 2023 it rebranded to Stream Security and moved from cloud operations into the CloudSecOps market with a real-time cloud security product. Subsequent milestones include next-generation exposure investigation and AI-assisted remediation features (March 2024), partnerships with Cyera and CrowdStrike (July 2024), the appointment of Patrick Guay as Chief Revenue Officer (May 2024), a $30M Series B (October 2024), the StreamLine integration program and GCP support (January 2025), cloud trap technology (April 2025), guided incident-response runbooks (April 2025), eBPF-based real-time response actions and API threat detection, expansion of CloudTwin to SaaS WAF perimeter controls (July 2026), and the launch of the StreamForce AI agent platform (July 2026).
Compiled by commissioned research from 8 cited public sources β announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed β not independently audited.
Timeline Β· 20
launches, deals, and filingsCustomer-hosted plugins let AI security agents use custom tools running in the customer's own cloud without exposing secrets externally.
AI agents built on the live CloudTwin model of production environments for security operations.
CloudTwin extended to SaaS perimeter controls including Cloudflare, Imperva and Akamai to surface protection gaps using real-time runtime activity.
Full API traffic collection and analysis via the eBPF sensor and cloud-native log ingestion, plus response actions allowing containment from the Investigator UI.
Awarded by Cyber Defense Magazine.
Response capabilities that select a response path based on real-time understanding of threat and business impact.
Traps deployed in cloud environments to lure and quarantine attackers as part of real-time cloud detection and response.
Program to bring cloud context to enterprise detection and response tools; added support for Google Cloud Platform.
Series B led by U.S. Venture Partners with new investor Citi Ventures and existing investors Energy Impact Partners, Cervin Ventures, TLV Partners and Glilot Capital Partners.
$30M source β
Combines Stream Security's cloud-layer behavior and identity correlation with CrowdStrike workload-level threat detection.
Joint offering combining sensitive-data identification with attack path and impact-based threat prioritization.
Stream Security appointed Patrick Guay as Chief Revenue Officer.
Strategic partnership for continuous, real-time cloud monitoring covering compliance, cybersecurity and cost visibility.
Added advanced exposure investigation and AI-powered remediation capabilities.
The company, formerly Lightlytics, launched a real-time cloud security solution and expanded from cloud operations into the CloudSecOps market.
Launched a Chrome extension aimed at reducing context switching between AWS tools for cloud operators.
Then-Lightlytics announced a $26M Series A round led by Energy Impact Partners with Cervin Ventures, TLV Partners and Glilot Capital Partners, to help DevOps teams operate cloud infrastructure.
$26M source β
Lightlytics received SOC 2 Type II compliance certification for its Cloud-Ops SaaS platform.
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
βΈResearch sources Β· 8
primary sources listed
- Stream Securitystream.security Β· web
8 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does Stream Security do?
- Stream Security builds CloudTwin, a real-time model of cloud environments used to detect, investigate and remediate threats.
- Who founded Stream Security?
- Stream Security was founded by Or Shoshani, Stav Sitnikov, Liran Roffman.
- Who are Stream Security's investors?
- Stream Security's investors include Cervin, Energy Impact Partners, Glilot Capital Partners, TLV Partners, US Venture Partners.
- Where is Stream Security headquartered?
- Stream Security is headquartered in Tel Aviv, IL.