Pomegra
Northstar Security emerged from stealth on Oct. 28, 2026 with a $7M seed round led by Wing VC to link security data into a real-time graph that AI agents can act on.
Key Takeaways
- Northstar Security raised a $7M seed round led by Wing Venture Capital and launched its platform on Oct. 28, 2026.
- The Security Context Graph connects 70+ tools and exposes "toxic combinations" of risk.
- CEO Amer Deeba previously co-founded Normalyze, acquired by Proofpoint in 2024. Valuation is undisclosed.
Lead
Northstar Security left stealth on Oct. 28, 2026 with a $7M seed round led by Wing Venture Capital. The San Francisco company sells an agentic AI security platform built on what it calls a Security Context Graph. The graph maps relationships among assets, identities, vulnerabilities, applications and business systems in real time. AI agents then use that map to prioritize risks and start remediation.
MVP and Outliers also invested, as did three security executives acting as angels: Gerhard Eschelbeck, a former Google CISO, plus Renaud Deraison and Justin Somaini. Northstar did not disclose a valuation. The platform is available to customers now.
What Does Northstar Security Actually Build?
Northstar builds a graph database of a company's security and IT environment and layers AI analysis and automated remediation on top. It pulls data from more than 70 integrations, including AWS, Google Cloud, Microsoft Defender, Microsoft Entra, Okta, GitHub, Slack, Workday and Zendesk.
The company describes three capabilities: connected security context, context-driven risk intelligence and agentic remediation. In practice, security teams can query the graph in natural language. Agents can then deploy controls, notify users or restrict access, with human approval available where teams want it.
The product targets what Northstar calls "toxic combinations." A typical example is an unmanaged device owned by a privileged user who also has access to a critical corporate system. Each fact looks minor in its own tool. Together they describe an attack path.
Who Is Behind the Company?
CEO and co-founder Amer Deeba held senior roles at Qualys and co-founded Normalyze, the data security startup Proofpoint acquired in 2024. CTO and co-founder Ed Rowe was previously CTO at Farmers Business Network and senior vice president of engineering at AppDynamics. Deeba and Rowe first worked together at Adobe.
That pedigree likely explains a seed round of this size from a firm like Wing. Founders with a prior exit and a data-graph background can raise on thesis alone. Northstar has disclosed one named customer, Randy Barr, CISO at Cequence Security, which uses the agentic workflows for remediation. It has not disclosed customer counts or revenue.
Why Does a Context Graph Matter for AI Agents?
A context graph matters because an AI agent can only act sensibly on security problems if it can see how assets, identities and systems connect. Northstar's pitch is that most security tooling produces findings in isolation, and that agents fed those findings inherit the same blind spots. "Security teams are drowning in data but starving for context," Deeba said in the announcement.
The argument has a practical edge. Alert volume is a familiar complaint among security teams, and adding an agent that triages on partial data could multiply noise rather than cut it. Northstar is betting that a unified graph gives agents the cross-tool view that human analysts currently assemble by hand.
Northstar also opens the graph to outside agents through the Model Context Protocol. Customers can build their own workflows on Anthropic's Claude and other AI tools, which makes the graph a data layer as much as a finished product.
How Crowded Is the Space It Is Entering?
The market is crowded. Exposure management, cloud security posture and identity security vendors have all promoted some form of graph-based correlation, and many are adding AI agents to the same pitch. Northstar's announcement names no competitors and offers no benchmark comparing its graph against theirs.
A $7M seed is modest next to the late-stage rounds common in cybersecurity this year. It buys roughly the time needed to prove two things: that the graph stays accurate across 70+ changing data sources, and that security teams will let agents execute changes without a person approving each one. Trust in automated remediation, not graph construction, is the harder sell.
What Comes Next for Northstar?
Northstar plans to spend the funding on product development, team expansion and go-to-market work. Headcount is undisclosed. The nearest tests are customer growth beyond early adopters and whether enterprises accept the MCP-based approach of letting third-party agents query a central security graph.
A plausible path is a Series A tied to evidence of production deployments with autonomous remediation switched on. A harder path involves larger platform vendors absorbing graph correlation into existing products, which would compress the independent market. Both outcomes depend on measurable gains in risk reduction, which the company has not yet published.
Outlook
Northstar Security enters a busy field with a $7M seed, an experienced founding team and a clear technical claim: context first, agents second. Wing VC's lead gives the round credibility, but the missing valuation, customer count and revenue leave the commercial case unproven. The next 12 months will show whether the Security Context Graph holds up in production and whether security teams hand real remediation authority to software.
