Composable security operations startup Abstract Security Inc. today said it has raised a $25 million Series A extension, capital it will put toward widening in-stream threat detection and pushing its artificial intelligence tooling deeper into the security operations workflow.

The round caps a fast year for the company. Annual recurring revenue climbed 380% over the period. Net revenue retention reached 264%, the customer base tripled and Abstract made 40 hires to support its move into larger enterprises.

Founded in 2023 by veterans of ArcSight Inc., Bank of America Corp., Mandiant Inc. and Palo Alto Networks Inc., Abstract sells an alternative to the security information and event management platforms that have anchored corporate security teams for a decade. Those systems funnel every log into a single store, run detection only after the data lands and charge customers more as volume grows.

Abstract’s pitch is to pull that model apart. Its streaming-first platform separates data sources from destinations and runs detections while data is still moving. On the way out, it tiers and routes information into whatever schema each destination expects, including the Open Cybersecurity Schema Framework, Elastic Common Schema and Splunk’s Common Information Model. The company says the approach lets enterprises cut storage costs and sidestep lock-in to one vendor’s stack while keeping control of their data across multicloud and hybrid environments.

Layered across that pipeline is Astro AI, which Abstract applies to detection, triage, investigation and response. The platform is sold through the Amazon Web Services, Microsoft Azure and Google Cloud marketplaces.

“Legacy SIEM made you pour everything into one platform and charged you more as the volume grew, all to find threats after the data was already sitting in storage,” said Colby DeRodeff, co-founder and chief executive of Abstract Security. “Composable security operations end that. Teams pick their own sources and destinations, run detections while the data is still moving and add AI where it changes the work across triage, investigation and response.”

Investors are betting security operations are due for the kind of architectural reset that follows every major platform shift. J.R. Becko, a partner at Cheyenne Ventures Management, said enterprises “no longer want to be forced into a single data platform just to detect threats” and called Abstract’s design streaming-first, AI-native and composable.

The new money will also fund a larger go-to-market team to keep pace with enterprise demand.

Cheyenne Ventures and Atlantic Vantage Point co-led the extension. Crosslink Capital Inc. and Rally Ventures returned after backing earlier rounds. Munich Re Ventures had led Abstract’s $15 million Series A in October 2024, on top of an $8.5 million seed. The company said the extension was raised at three times its prior valuation. The total raised now stands at close to $50 million.

Image: Abstract Security