Legion

Legion is building an AI security-operations companion around a browser extension rather than a conventional integration-heavy SOAR deployment. Its product observes analyst activity in the browser, including the sequence of tools consulted, evidence gathered, and decisions made, then turns those patterns into reusable agentic workflows. The official product framing separates a learning mode, in which Legion captures context from investigations, playbooks, runbooks, and past cases; a companion mode, in which it executes workflows with the analyst supervising; and an autonomous mode, in which the customer can allow trusted workflows to run at scale. This is a specific attempt to encode local SOC expertise instead of assuming that a generic model or fixed playbook transfers cleanly between organizations.

The customer problem is credible and economically important: security teams face high alert volume, fragmented tools, bespoke processes, and shortages of experienced investigators. Legion's browser-native approach is intended to work with SIEMs, threat-intelligence services, email systems, and homegrown applications that may be difficult or expensive to integrate through APIs. That can shorten deployment and preserve the team's existing operating environment, but it also places unusual importance on browser permissions, page-state understanding, reliable action execution, and protection against sensitive data capture. The product is therefore best understood as an AI analyst and workflow layer for enterprise SOCs, not as a replacement for the underlying detection, identity, endpoint, or case-management systems.

Legion emerged publicly in July 2025 with reported seed and Series A funding totaling $38 million: an $8 million seed round led by Picture Capital and Accel followed by a $30 million Series A led by Coatue, with Accel and Picture Capital participating. Calcalist reported 25 employees split between Israel and New York at that time and identified founders Ely Abramovitch, Michael Gladishev, and Eyal Fisher; the company describes the team as including Microsoft Sentinel and Cambridge AI research experience. The official website displays testimonials from security leaders in finance, healthcare, education, and other enterprise settings, while the launch release reported customer claims of materially shorter investigation times. These are useful commercialization signals, but they remain a mix of company-selected testimonials and reported customer statements rather than independently audited retention, revenue, deployment, or accuracy data.

Competition is broad. Legion overlaps with AI SOC specialists such as Dropzone AI and Radiant Security, workflow and automation platforms such as Tines and Torq, and security-platform incumbents such as Microsoft Security Copilot and Palo Alto Networks Cortex. Its proposed edge is the combination of browser-level observation, organization-specific workflow learning, and a graduated autonomy model that does not require customers to encode every process in advance. That edge will only be durable if learned workflows generalize across analysts, survive UI and tool changes, produce measurable quality improvements, and create enough proprietary operational context to offset the copying and bundling power of larger vendors.

The national-security and defense relevance is substantive but primarily defensive. Faster, more consistent alert investigation can support public-sector cyber defense, critical-infrastructure monitoring, incident response, and security operations for organizations with scarce cleared or domain-specialist personnel. The technology is not publicly presented as an offensive capability or military-unique system, and there is no verified public evidence here of defense contracts or government deployments. Strategic diligence should consequently concentrate on secure deployment, data residency and access controls, human override, action reversibility, evaluation against false positives and missed threats, and whether the product can meet government-grade procurement and assurance requirements without losing its low-friction browser advantage.