Zigguratum

Market position

An early-stage, venture- and SBIR-funded security data platform vendor competing against incumbent SIEM and cyber data lake tooling on onboarding speed and total cost of ownership. Its federal award record shows three prime awards totaling about $5.9 million in lifetime contract value, split roughly 70% National Institutes of Health and 30% DARPA, and a 100% SBIR Phase I to Phase II conversion rate. A third-party profile cites endorsements from cybersecurity advisor Freddy Dezeure and Palantir engineering lead Zoë Nengite [2][3].

The company contrasts a "foundation-first" approach — normalizing and enriching data in a semantic layer before applying AI — with platforms that add chatbots, copilots, or summarizers on top of unnormalized data. It emphasizes vendor-agnostic normalization so a single detection runs across multiple vendors, no rip-and-replace deployment alongside existing SIEM/SOAR tooling, and claimed efficiency gains including 15x greater efficiency, roughly 80% less engineering effort than self-managed pipelines, and no data loss against a stated industry average 3-6% security event drop rate. Its federal abstract cites up to 90% reduction in manual data-onboarding effort and 25x processing efficiency versus legacy tooling [0][1][2][6].

Technology

The architecture has three stages: Courier clusters that collect data from cloud, SaaS, and on-premises sources while emitting real-time telemetry on latency and volume; a semantic layer that maps each vendor's raw data to a single unified model so one detection can run across sources and playbooks survive schema changes; and stream-time detection with enrichment of device, identity, and activity context before forwarding. The ESCAPE research effort adds automated ingestion and harmonization of heterogeneous security logs, an entity-resolution engine that reconciles identities, dynamic addresses, and assets, an enterprise knowledge graph, and transparent, auditable lineage. Third-party profiling describes the platform as built on partnerships with Palantir and Databricks, with capabilities spanning management of thousands of edge devices, real-time security alerting and failure detection, remote asset management, bi-directional intelligence across data sources, and compliant data storage [0][1][2][3][6].

Go-to-market

The website funnels prospects to a gated product demo requiring contact details, and messaging is segmented by buyer role (CISO/CIO versus SOC director/head of SecOps). The company leans on ecosystem and platform partnerships with Palantir and Databricks, including "Built on Databricks" partner status, and pursues federal agency channels through SBIR/STTR contracts with ARPA-H/HHS and DARPA alongside planned managed-service and reseller distribution [0][2][3][6].

Enterprise security buyers in complex, regulated environments, including financial services, pharmaceuticals, and other regulated industries, plus non-profit healthcare providers served at cost. The company addresses both leadership buyers (CISO/CIO) and operators (SOC directors and heads of security operations). Federal-facing materials add government agencies, DoD agencies, healthcare providers, regulated critical-infrastructure operators, and Global 2000 corporations [0][2][3][6].

Geography

Headquartered at 200 W. Martin Luther King Blvd, Suite 1000, Chattanooga, Tennessee 37402, in Tennessee's 3rd congressional district, and incorporated in Delaware. Work under its federal awards is performed in the United States [2][3][4].

History

Federal registration records date the corporation's founding to March 3, 2023, in Delaware, with initial SAM.gov registration on January 9, 2024. The company received its first federal award in 2024 — an ARPA-H/HHS SBIR Phase I feasibility study for ESCAPE-IDNETIFY — and followed with an SBIR Phase II award tagged to DARPA in 2025. SAM registration was renewed in February 2026 with an expiration of February 3, 2027, and the most recent federal award recorded is dated August 1, 2026 [2][3][4].

Risks & controversies

Several headline performance figures on the company website render as "0x" or "0%" placeholders, and one third-party profile notes that company structure, employee count, and location details were absent from its underlying source material. The FedRAMP authorization referenced in the federal project abstract is described as a target rather than an achieved status, and revenue is concentrated in a small number of federal research contracts from two agencies [0][2][3].