Above Security

Above Security was founded in 2025 in Tel Aviv by Aviv Nahum and Amir Boldo, both long-time Israel security builders with Unit 81 and Unit 49 backgrounds. The company positions itself as an AI-native managed insider-threat platform, with a distinctive claim that traditional security tooling misses intent and context unless behavior is interpreted as an evolving timeline rather than isolated alerts. Its product framing describes this explicitly: instead of only surfacing anomalies, the system assembles a full evidentiary story across identity systems, SaaS activity, communication flows, and AI-agent behavior. That framing is strategically relevant because insider risk today mixes humans, contractors, and increasingly autonomous software actors that execute sensitive actions at machine speed.

The core platform is presented as a multi-agent architecture that continuously runs investigation tasks, not only detection. Public materials describe specialized agents that monitor for data exfiltration patterns, unusual job-switch signals, privileged misuse, and risky communication behavior while reducing false positives through contextual correlation. This matters for enterprise security operations, where the current gap is often not signal volume but signal triage under operational pressure. Above argues this gap is widening as AI assistants, copilots, and autonomous agents become part of the access graph. Its approach of combining prevention coaching, continuous behavioral reasoning, and investigation-ready output is designed to compress mean-time-to-understanding across security, legal, and HR teams.

Commercially, insider risk is a broad, high-frequency problem across sectors because breaches from authorized environments account for a large share of enterprise incidents. The company highlights this shift by framing risk as both malicious and unintentional, with accidental mis-configuration and shadow usage becoming as costly as targeted attacks in modern environments. If the platform can sustain production-grade quality and keep alert quality high, demand is durable in large multinational environments, infrastructure operators, and knowledge-intensive organizations where one behavioral failure can drive major operational, legal, and reputational harm. The PR release states the startup was generating revenue only six months after launch and has early enterprise adoption, indicating commercial pull, while specific customer names and deployment outcomes are still limited in public filings.

From a financing and momentum perspective, Above has executed an early major capital raise. Public reporting shows a March 2026 Series A led by Ballistic Ventures with participation from Merlin Ventures, Norwest, Jump Capital, and QPV Ventures, after an earlier seed round. The company was also selected for a major cybersecurity accelerator track, improving cross-border market access. Leadership depth is a core support point: both founders have prior startup and enterprise security execution, and investor and ecosystem signaling describe above-average momentum for a late 2025 launch. Still, this remains an early-stage venture in a category where trust, proof-of-performance, and sales-cycle conversion remain decisive.

Dual-use relevance is credible, though not direct hardware defense. The strategic question is operational continuity in high-consequence contexts: government systems, critical infrastructure operators, and defense-adjacent enterprises are exposed to insider and privilege abuse modes that can disrupt mission outcomes as much as direct breaches. Even when deployed in civilian settings, a high-fidelity insider-risk system that shortens investigation and intervention can be adapted into resilience workflows where consequences include public safety, command continuity, and critical infrastructure uptime. This makes Above strategically relevant to the dual-use thesis: its methods can be reoriented from security compliance toward mission assurance in constrained environments, provided governance and sovereign deployment requirements are met.

Market dynamics are increasingly competitive. Large vendors already cover prevention and monitoring at scale, but many still rely on rules and static policy engines that struggle with dynamic agentic contexts. Above’s potential edge lies in continuous behavioral correlation and explicit AI-investigator automation, if validated by independent performance metrics. Key diligence questions should focus on false-positive control, evidentiary chain quality, legal/compliance defensibility in regulated sectors, and whether the system can integrate safely into defense-grade workflows without over-reliance on broad permissions.

The diligence profile is therefore: strong thesis and compelling problem framing, with meaningful strategic upside through resilience-critical use cases, but still dependent on proving consistent precision and deployment depth across mature enterprise and critical infrastructure environments. For this reason, the company is better framed as a high-potential, early-stage strategic signal rather than a mature operator with broad public proof points.