Cyngular Security

**Product and the concrete problem it solves.** Cyngular Security targets the part of security operations that remains painfully manual after a detection fires: determining what happened, how far an attacker moved, which systems are affected, what evidence supports the conclusion, and what response is safe. Its public materials describe a cloud and hybrid-cloud platform that can uncover threats, investigate them, contain them, and produce a report for leadership and regulators. The current product message calls this an agentic SOC, while earlier materials describe ClouDFIR and the THIRDhub platform for cloud hunting, investigation, response, and deception. The buyer problem is operational rather than merely analytical. More cloud accounts, identities, workloads, SaaS connections, and security tools create an alert volume that grows faster than a human SOC can investigate. Cyngular's proposed answer is to make the investigation workflow itself executable by specialized agents, so analysts receive a resolved case and an auditable explanation instead of another queue item. The product is therefore positioned as a control and decision layer across an existing security environment, not as a replacement for every detection source.

**Core technology and how it actually works.** Cyngular describes six specialized agents operating as a coordinated mesh rather than one general-purpose chatbot. Its site identifies roles including an observer, threat hunter, investigator, deceptor, resolver, and reporter, with the broader platform claim that agents can detect, hunt, investigate, deceive, resolve, and report end to end. The agentless, read-only onboarding model connects to a customer's cloud environment without installing an endpoint agent, and the site says a deployment can be live in under fifteen minutes. The intended workflow is concrete: collect approved cloud and security context; correlate identity, configuration, activity, and threat signals; reconstruct an incident and root cause; use deception or investigation to clarify attacker behavior; recommend or execute a policy-bounded response; and preserve an explanation for the customer. Cyngular's public platform page claims 95% of threats resolved autonomously in under three minutes, but that is a company-reported outcome rather than an independently benchmarked result. The architecture's defensible question is not whether an LLM can summarize an alert, but whether the mesh has reliable tool permissions, evidence provenance, failure thresholds, escalation paths, and repeatable integrations across AWS, Azure, GCP, on-premises systems, and existing SOC tooling.

**Market, customers, and go-to-market.** The primary market is enterprise security operations, incident response, cloud-security teams, and managed security service providers that need more investigative capacity without adding an analyst for every new tenant or alert source. Cyngular's partner page makes the MSSP route explicit: one multi-tenant agentic squad can operate across client environments, with white-label delivery, per-tenant assessments against NIST, HIPAA, PCI-DSS, and SOC 2 frameworks, and an agentless onboarding motion intended to reduce deployment friction. The direct enterprise motion is aimed at CISOs, heads of incident response, and security-operations leaders in environments spanning cloud, on-premises, and hybrid infrastructure. The company website displays anonymous customer evidence from insurance, MSSP, telecom, and a Nasdaq-traded company; those testimonials suggest product engagement and a broad buyer set, but they do not establish customer names, contract values, renewal rates, or revenue. This is a sensible wedge because cloud investigation is a high-consequence pain point and read-only access lowers the initial trust barrier. Expansion depends on proving that investigation quality, containment safety, compliance reporting, and analyst-time savings are materially better than an incumbent SIEM, XDR, SOAR, or managed service.

**Traction, funding, and third-party validation.** Cyngular is not a purely unverified stealth name. Startup Nation Finder identifies it as an active Israeli company founded in 2021, with a Tel Aviv-Yafo headquarters, a reported team of 28 within an 11-50 employee range, and a released product. The same profile records a January 2022 Seed round involving Springtide Ventures, ST Engineering Ventures, and VentureIsrael, followed by a March 2024 undisclosed round led by Tachles VC. Neither the amounts nor a complete cap table are public, so the record uses an undisclosed seed/follow-on description rather than inventing a dollar figure. ST Engineering's 2025 investor-day materials identify Cyngular's CIRA, or Cloud Investigation and Response Automation, as a startup collaboration and show its positioning around autonomous cloud incident readiness and response. The company also states that it holds SOC 2 Type II, and a public company post attributes the certification to EY. Its Israeli service agreement names Cyngular Security Ltd. as an Israeli corporation, providing legal-entity evidence beyond marketing copy. These are useful validation signals, while the absence of audited revenue, named reference accounts, independent efficacy testing, and disclosed financing totals remains material.

**Founders and team background.** The founding team is unusually relevant to the operational problem. Paul Moskovich is identified by the company as co-founder and CEO, with 25 years defending large enterprises across aerospace and defense, finance, and communications as a CISO; the company also states that he served as Deputy Director-General and Chief Executive Director of Israel's National Cyber Directorate at the Prime Minister's Office. Co-founder and CTO Itzik Berrebi is described as a cybersecurity leader with more than a decade across defense, finance, and technology, including work as CISO at an Israeli blockchain company and leadership of incident-response and R&D teams at an aerospace and defense enterprise. Amir Skouri, listed as VP of R&D, is described as a former Unit 8200 and Matzov R&D leader with defensive and offensive cybersecurity experience and aerospace-defense research background. This combination supplies buyer empathy, public-sector cyber context, and hands-on incident-response experience. It also creates diligence questions: the public record does not disclose the current engineering organization beyond selected leaders, the balance between Israel and U.S. operations, or the proportion of product engineering versus services and integration work. A strong executive résumé can open enterprise doors, but only a deep bench and disciplined agent evaluation process can support reliable autonomous response at scale.

**Competitive dynamics.** Cyngular competes across several overlapping budgets. CrowdStrike Falcon and Palo Alto Networks Cortex XSIAM combine telemetry, detection, investigation, and response inside large installed platforms; Microsoft Defender XDR and Sentinel benefit from Microsoft 365 and Azure distribution; Google SecOps and Mandiant bring cloud-scale telemetry and incident-response expertise; and Wiz competes for cloud-security visibility and risk-management ownership. Tines and Torq automate security workflows, while Hunters and other SIEM/XDR vendors compete for the investigation and detection-engineering layer. Cyngular's claimed edge is the end-to-end agent mesh and its focus on completing the case rather than generating another alert. Its agentless, read-only onboarding and MSSP white-label model could also lower adoption friction and create leverage through service providers. These advantages are not yet a durable moat. Large platforms can add AI investigators to data they already control, SOAR vendors can package comparable playbooks, and professional-services firms can supply human investigation. Cyngular must prove that its agents reconstruct incidents with fewer false conclusions, preserve evidence, respect customer authorization boundaries, and reduce total cost across heterogeneous clouds. The critical competitive metric is resolved, trusted incidents per analyst hour, not the number of agents in the interface.

**Defense, security, and resilience dual-use relevance.** Cyngular's core technology has substantive dual-use relevance because cloud incident readiness and response protect commercial enterprises, defense contractors, government agencies, telecommunications providers, hospitals, and critical infrastructure alike. The founders' aerospace-defense and National Cyber Directorate backgrounds make the security adjacency credible, and the Israeli legal entity and Tel Aviv operating base place the company inside an ecosystem with direct exposure to national cyber defense. An agentic investigation layer could help an understaffed national CERT, utility SOC, or defense-industrial security team reconstruct attacks faster, contain compromised identities or workloads, and produce defensible evidence for commanders, regulators, and executives. Its read-only onboarding is relevant where a public-sector buyer wants analysis before granting automated write permissions. The calibration is important: public sources reviewed do not establish a classified deployment, Israeli Ministry of Defense contract, military customer, or government accreditation. Deception and autonomous response also carry elevated safety and governance obligations in mission-critical environments; a mistaken containment action can interrupt a service or destroy evidence. The strategic case is therefore cyber-resilience infrastructure that could transfer into allied and public-sector use, not a claim that Cyngular is already a fielded defense system.

**Growth stage, trajectory, and key diligence risks.** Cyngular is best classified as early-to-mid commercial stage, with the schema's **early** label reflecting limited financial disclosure despite a released product, institutional backers, SOC 2 Type II, and reported enterprise and MSSP usage. Its trajectory is toward an agentic operating layer for security operations: first automate cloud investigation and evidence assembly, then expand into threat hunting, deception, response, compliance reporting, and multi-tenant MSSP delivery. The most important diligence points are: (1) independently validate the 95%-resolved and under-three-minute claims by incident class, severity, and false-resolution rate; (2) establish whether autonomous actions are recommendation-only, customer-approved, or policy-bounded execution, and measure rollback and escalation behavior; (3) obtain named customer references, retention, deployment counts, gross margin, and services intensity; (4) test integration depth across AWS, Azure, GCP, Kubernetes, identity providers, SIEMs, EDRs, and ticketing systems; (5) review model-provider dependence, prompt-injection resistance, data isolation, and evidence integrity; (6) assess whether the 2024 follow-on financing and current U.S. expansion provide enough runway for enterprise sales cycles; and (7) determine whether government, defense-industrial, or critical-infrastructure adoption can meet procurement, residency, export, and high-assurance requirements. The team and product are credible, but the company must convert strong operational positioning into independently verifiable outcomes before its strategic importance can be scored as more than high-potential cyber resilience.