Cylake

Cylake represents a paradigm shift in how governments and critical-infrastructure operators approach cybersecurity in an era of AI-driven threats and stringent data sovereignty requirements. Founded by Nir Zuk (founder of Palo Alto Networks), Ehud Shamir (co-founder of SentinelOne), and Wilson Xu (former VP of Engineering at Palo Alto Networks), Cylake is building the first AI-native, completely on-premises cybersecurity platform designed for organizations that cannot tolerate data exfiltration to public cloud providers. The strategic insight underlying Cylake is that modern AI-powered security analysis generates enormous operational telemetry—logs, behavioral profiles, threat signals—and conventional cloud-based SIEMs and EDR systems are fundamentally incompatible with sovereign-data-protection mandates. When sensitive telemetry must remain within national borders or behind air-gapped networks, centralized cloud analytics become impossible. Cylake solves this by embedding unified security analytics, AI reasoning, and threat detection directly in customer infrastructure, ensuring all data remains under local control.

The market context is profound and growing urgent. Governments, militaries, and critical-infrastructure operators (energy, water, transport, communications, financial systems) face escalating regulatory pressure to achieve "data localization"—requiring all operational data to remain within specific jurisdictions. The EU's NIS2 directive, Israel's data residency laws, U.S. CISA guidelines for critical infrastructure, and similar mandates across allied nations are pushing organizations away from public cloud security tools toward sovereign, on-premises alternatives. Additionally, as AI becomes both a critical defensive capability and an emerging threat vector, security teams need to control the data used to train and operate their AI models—particularly for government and defense AI systems. Cloud-dependent security solutions create unacceptable risk if the cloud provider is compromised, if geopolitical disputes limit cloud access, or if proprietary algorithms are exposed to third parties. Cylake's approach—analyzing all security events locally, using AI locally, storing all data locally—addresses these anxieties directly.

From a technical perspective, Cylake's platform combines unified data ingestion across infrastructure layers (endpoints, network, cloud resources, applications, identity), local AI-driven analytics (anomaly detection, threat correlation, attack-chain reconstruction using large language models), and agentified response workflows (autonomous investigation, evidence collection, remediation suggestions). The team emphasizes "zero fragmentation"—a single unified view of organizational security posture rather than disconnected point tools (EDR here, SIEM there, DLP elsewhere), which is a major operational benefit even before considering data sovereignty. The on-premises architecture means no dependency on internet connectivity; security analysis and threat detection continue even if external cloud services fail or if the organization operates on disconnected networks. This is particularly valuable for military and intelligence systems that operate in contested or comms-degraded environments.

Competitively, Cylake occupies a position that incumbent cloud-centric vendors (Microsoft, Google, Splunk, CrowdStrike) have largely ceded. The primary competitors are legacy on-premises SIEM vendors (IBM QRadar, ArcSight, Micro Focus) and purpose-built sovereign-infrastructure security companies emerging in other countries (e.g., Russia, China, India-focused alternatives). However, most legacy on-premises vendors have downplayed on-prem investment in favor of cloud, leaving a market gap for a modern, AI-driven, on-prem-first platform. Cylake's founding team pedigree (Palo Alto founder, SentinelOne co-founder, experienced engineers) is a significant competitive advantage; their understanding of what works in security platforms, what customers need, and how to navigate the regulatory and sales cycles of government/defense accounts gives them credibility that a typical startup cannot claim. The risk is that incumbents could rapidly develop on-prem AI capabilities or that budget constraints might limit purchase intent even as regulatory mandates increase.

Strategically, Cylake is critical infrastructure for allied governments and defense organizations that need sovereign, AI-native security without public cloud dependencies. The company is positioned to become the de facto standard for on-premises AI-driven security in NATO, Five Eyes, Israeli, and other allied-partner governments. The dual-use implications are explicit: while Cylake's platform has commercial applications in heavily regulated sectors (finance, healthcare), the primary near-term traction will come from government and defense procurement. Israel's position as a global cybersecurity leader and the founding team's reputation amplify the company's strategic profile. If Cylake successfully deploys to Israeli government and allied partners, the company could become a foundational layer of allied-partner cyber-defense infrastructure. Long-term, the company could be a significant acquisition target for large defense contractors or remain an independent global powerhouse if it can build sufficient scale and defensibility in the sovereign-security category.

Cylake emerged from stealth in March 2026 with a $45 million seed round led by Greylock Partners and supported by other blue-chip investors, indicating strong institutional conviction. The company is currently in design-partner phase with select government and infrastructure customers, with general availability of the platform anticipated in early 2027. This timeline aligns with increasing regulatory pressure and geopolitical factors driving demand for sovereign security solutions. The small founding team (size not publicly disclosed but likely under 20 people at launch) will need to scale rapidly to serve government customers, navigate procurement cycles, and build the ecosystem integrations necessary for adoption. However, the team's experience and the market tailwind suggest strong execution potential.