Gutsy

Gutsy is an Israeli cybersecurity startup founded in 2022 and headquartered in Tel Aviv, building a security process intelligence platform that applies process mining methodology to cybersecurity operations. The company was founded by the original creators of Demisto, the security orchestration platform that was acquired by Palo Alto Networks and became Cortex XSOAR, bringing deep domain expertise in security operations center (SOC) workflows and automation. This founding team pedigree is strategically significant, as Demisto's successful exit to Palo Alto Networks (one of the largest cybersecurity acquisitions) demonstrates the founders' proven ability to build enterprise-grade security platforms and navigate market adoption challenges.

The platform ingests data from across the security technology stack—SIEMs, SOARs, ticketing systems, EDR tools, identity platforms, cloud security tools, and other operational systems—to reconstruct and visualize the actual end-to-end processes that security teams follow when handling incidents, vulnerabilities, compliance tasks, and threat investigations. The core technical innovation is the application of process mining algorithms (originally developed for business process management) to the security domain, creating a new category that combines quantitative workflow analysis with cybersecurity operational intelligence. Unlike traditional security analytics that focus on threat detection, volumetrics, or alert management, Gutsy focuses on the operational processes themselves, revealing bottlenecks, procedural deviations, redundant steps, process inefficiencies, and opportunities where automation would have the highest impact.

Gutsy addresses a critical blind spot in cybersecurity operations: organizations typically invest tens of millions in detection and response tools, but lack systematic visibility into whether their security processes are actually efficient, whether incidents are being handled consistently according to documented procedures, whether staffing is appropriately deployed, and where automation ROI would be highest. By providing quantitative measurements of security process effectiveness—metrics like mean time to detect (MTTD) by incident type, procedural variance rates, analyst productivity, tool utilization patterns, and bottleneck identification—Gutsy enables CISOs and security leaders to make evidence-based decisions about staffing allocation, tool consolidation, process redesign, and automation investments. This data-driven approach to SOC optimization is particularly valuable for large enterprises managing complex multi-tool security operations, where process visibility is often obscured by tool silos and manual documentation gaps.

The company has raised seed funding and is building its initial customer base among enterprise and mid-market security organizations. The early positioning as a process intelligence play (distinct from SOAR expansion, SIEM add-ons, or threat analytics) creates category differentiation and addresses a genuine market gap. Success depends on demonstrating clear ROI through process optimization, achieving design partner momentum among security leaders, and scaling across organizations with mature but inefficient security operations. The market tailwind is strong: as security operations face chronic resource constraints and CISOs increasingly seek data-driven justification for staffing and tool investments, process-level visibility becomes a strategic asset.