Vega Raises $120M To Advance Enterprise Cyber Threat Detection

While security teams have always been centralizing data to detect threats, Vega is betting that the model has finally run its course. In an effort to reconsider how enterprises deal with threat detection, the two-year-old startup is attempting to flip the SIEM paradigm by conducting detection where data currently lives.

The Vega way

For quite some time, security teams and operations have utilized centralized platforms, known as SIEMs. That involves gathering logs and telemetry from an organization’s infrastructure and sending it to a single platform where analysis occurs. However, that method is quickly proving itself to be increasingly problematic, especially in cloud native environments where data is already scattered across services, geographic regions, and storage layers.

As opposed to shoving tons of data down comparatively narrow centralization funnels, Vega’s way is to conduct detection right where the data lives, whether that’s directly inside cloud services, data lakes, or existing storage systems. This approach isn’t just a new architectural design; it’s actually a completely new way of operating. Data centralization inherently brings latency, costs, and complexity. In rapidly changing environments, these are trade-offs that you simply cannot afford, as they directly impact detection speed and expose you to a higher risk of threats.

Series B funding

According to recent reports, Vega is raising $120 million to kick off its Series B round led by Accel, with Cyberstarts, Redpoint, and CRV also participating. This round will nearly double the startup’s valuation to $700 million. In under two years, Vega has raised a total of $185 million. That shows how the market is beginning to reexamine the way organizations deal with detection. Traditional SIEMs are coming under increasing scrutiny and pressure, with many arguing they’re too expensive and difficult to scale for massive amounts of data.

Perhaps more telling is the fact that, with this money, Vega intends to expand its AI native security operations platform, beef up its go-to-market team, and expand globally. This signals not just confidence in the tech but also the belief that the enterprise is very interested in this product.

Founder and clientele

Shay Sandler founded Vega and has previously worked with Israel’s military cybersecurity unit. He was also an early hire at Granulate, which Intel acquired in a $650 million deal. Those credentials help position the product, which is about more than just detection accuracy. It’s about reducing the operational friction typically encountered in large-scale enterprise deployments of security tools. The company has grown to about 100 employees, and its client base includes banks, healthcare companies, and Fortune 500 companies, with several of those operating within heavy cloud environments like Instacart.

The future of threat detection

In conclusion, these days, data is inherently distributed. Kubernetes, cloud services, and APIs all generate telemetry in various locations. Traditional detection models don’t work well in the modern world because they still assume you can aggregate first and analyze later. In reality, it’s the pipeline that introduces delays and potential blind spots.

By analyzing data in place, Vega is aligning detection with how infrastructure actually works today. It also reduces the need for large-scale data migrations, one of the biggest barriers to adopting new security tools in enterprise environments. Ultimately, Vega’s pitch comes down to a simple idea: detection should adapt to the data, not the other way around. Moving forward, we can expect the next crop of products to follow the Vega model, distributed, data-native, and designed to play nice with the environment.