Legion Security
Legion Security sells a browser-native AI SOC analyst platform that learns enterprise analysts' workflows by observing browser activity, then automates investigations and triage without API integrations. It targets enterprise security operations teams in financial services, healthcare, insurance, and education.
- Company typePrivate
- Founded2025
- HeadquartersNew City, United States
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What Legion Security does
Legion Security, Inc. is a private US-incorporated software company that sells a browser-native AI SOC analyst platform to enterprise security operations teams. Its core product is delivered as a browser extension that observes analyst activity across the existing security stack — SIEM, EDR, threat intel, and legacy dashboards — without requiring API integrations or connector development, and uses that behavioral observation to learn organizational workflows, generate agentic automations, and execute investigations through three operational modes: Learning Mode (captures and documents analyst logic), Guided Mode (AI-in-the-loop investigation with human oversight), and Autonomous Mode (end-to-end automated workflow execution). The platform additionally ships an AI Investigator for open-ended investigations and an Evidence Gathering module that captures timestamped screenshots at every step for auditability, all backed by a persistent memory layer that builds compounding organizational knowledge.
The technology runs on Google Cloud infrastructure and is powered by Gemini models, with Legion available on Google Cloud Marketplace so joint customers can procure through existing GCP accounts and apply purchases to committed Google Cloud spend. Certifications include SOC 2 Type II, ISO 27001, ISO 42001 (AI management), and HIPAA, supporting sale into regulated verticals such as financial services, healthcare, insurance, and education.
Legion operates a quote-based enterprise SaaS subscription model sold primarily through direct field sales with demo-driven evaluation and proof-of-value deployments, supplemented by Google Cloud Marketplace co-sell. Named enterprise customers include Virgin Money, IQ-EQ, the University of Tulsa, WELL Health Technologies, an unnamed F500 healthcare organization, a large insurance provider (24,000 investigations automated, MTTR cut from 20 to 2 minutes), and an unnamed financial institution. The company emerged from stealth in July 2025 with a $38 million seed round led by Coatue, Accel, and Picture Capital and reports fourfold revenue growth since emergence, with engineering rooted in Tel Aviv and commercial operations in the United States.
Legion Security firmographics
Firmographics- Name
- Legion Security
- Legal name
- Legion Security, Inc.
- Website
- https://legionsecurity.ai
- Company type
- Private
- Founded year
- 2025
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- Legion Security sells a browser-native AI SOC analyst platform that learns enterprise analysts' workflows by observing browser activity, then automates investigations and triage without API integrations. It targets enterprise security operations teams in financial services, healthcare, insurance, and education.
- Ownership category
- akta.pro rank
Legion Security industry classification
Industry- Product category
- AI Security Operations (SOC) Automation
- NAICS
- Security Systems Services (56162), Security Systems Services (except Locksmiths) (561621)
- SIC
- Services-Computer Integrated Systems Design (7373), Services-Computer Programming Services (7371)
- akta.pro primary industry
- Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)
- akta.pro secondary industry
- Security Analytics & Detection Engineering (HDADAGAE)
Keywords
Where Legion Security is headquartered
LocationHeadquarters
- HQ city
- New City
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Legion Security business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure, Others
Revenue model
- Platform Subscription: Enterprise SaaS subscription model for the AI SOC analyst platform. Sold direct to enterprise security teams via field sales with demo-driven evaluation. Also available through Google Cloud Marketplace enabling customers to apply purchases toward committed Google Cloud spend.
Go-to-market motion3 records
Distribution channels2 records
Marketing channels5 records
Legion Security product offering
Product offeringCore offering
Legion Security provides a browser-native AI SOC analyst platform delivered as a browser extension that observes how enterprise security analysts work, learns their investigation logic, and scales that behavior into automated agentic workflows across existing security tools. The platform operates in three modes—Learning Mode (passive capture), Guided Mode (AI-assisted investigation with human oversight), and Autonomous Mode (full end-to-end execution)—and is sold to enterprise security operations teams on a recurring subscription basis.
Product overview
Legion Security offers a browser-native AI SOC Analyst platform designed to automate and scale security operations. The platform consists of three operational modes: Learning Mode (captures and documents analyst workflows), Guided Mode (AI-assisted investigation with human oversight), and Autonomous Mode (fully automated workflow execution). Additional capabilities include Legion AI Investigator for complex open-ended investigations and Legion Evidence Gathering for automated screenshot capture. The platform requires no API integrations, instead operating directly through the browser to work across existing security tools. It is powered by Google Cloud's Gemini models and is available on Google Cloud Marketplace.
Differentiator
Problem solved
Functional benefit
Products and services
- Legion Security Platform (AI SOC Analyst) Browser-native AI SOC analyst platform delivered via a browser extension that observes how enterprise security analysts work, learns their investigation logic, and scales that behavior into automated agentic workflows across existing security tools (SIEM, EDR, threat intel platforms, homegrown applications, legacy dashboards) without requiring API integrations. Sold as a subscription to enterprise SOC teams and CISOs on a quote-based enterprise basis, also available via Google Cloud Marketplace.
Quantifiable outcome
- Up to 90% reduction in mean time to respond (MTTR)
- +6 more outcomes
Companies that use Legion Security
Customer profileNamed customers7 records
Segments2 records
Ideal customer profiles2 records
Legion Security technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
AI capability8 records
Feature7 records
Legion Security partnerships and signals
Strategic signalPartnerships
Four partnerships are on record, tiered minor and core.
- BeaconminorHosted an invite-only Beacon Executive Dinner at the Eiffel Tower (Wednesday Aug 5th, 6:30pm) alongside Beacon during Black Hat 2026. Executive-level networking dinner for security leaders.
- ENTminorHosted a STRIPSTEAK dinner reception at the Mandalay Bay alongside ENT during Black Hat 2026 (Tuesday Aug 4th, 6pm). Joint networking event for security executives and practitioners.
- Ocean SecurityminorCo-hosted a speakeasy cocktail event alongside Ocean Security during Black Hat 2026 (Monday Aug 3rd, 9pm at Easy's Cocktail Lounge). Joint marketing event to connect with security professionals at the conference.
- Google CloudcoreLegion Security's platform is now available on Google Cloud Marketplace. The platform leverages Google's Gemini Enterprise Agent Platform and Gemini models to provide automated alert triage, investigation, and response capabilities. Legion runs on Google Cloud infrastructure and combines its browser-native architecture with Google Cloud's security, scale, and model quality. The integration extends Google Cloud and Google SecOps ecosystems directly into analyst workflows.
Scale indicators9 records
Recent moves6 records
Expansion highlights6 records
Legion Security competitors and assessment
Company assessmentDirect peers
- Torq: Torq offers an AI-driven SOC automation platform (Hyperautomation and Socrates agents) that automates alert triage, investigation, and response for enterprise SOC teams, directly competing with Legion in the AI SOC analyst category.
- Dropzone AI: Dropzone AI provides an autonomous SOC analyst that investigates alerts end-to-end and converses with analysts in natural language, competing head-to-head with Legion's AI Investigator for Tier 1 alert automation workloads.
- Prophet Security: Prophet Security builds an AI SOC analyst that learns from each customer's environment and automates alert triage and investigation, mirroring Legion's learning-based, organization-specific approach.
- Radiant Security: Radiant Security delivers an AI SOC analyst that autonomously triages, investigates, and responds to alerts across the enterprise security stack, serving the same enterprise SOC buyer as Legion.
- Intezer: Intezer provides an Autonomous SOC platform for alert triage, investigation, and response, including AI-driven decisions on alerts—overlapping directly with Legion's autonomous investigation capabilities.
- Tines: Tines is a no-code automation and SOAR platform used by SOC teams to orchestrate security workflows and integrate tools, providing an adjacent or alternative approach to Legion's browser-native workflow automation.
Broad incumbents
- Microsoft Security Copilot: Microsoft Security Copilot is a broad AI security assistant embedded across the Defender and Sentinel ecosystem that competes with Legion in SOC productivity, alert triage, and AI-assisted investigation.
- CrowdStrike Charlotte AI: CrowdStrike's Charlotte AI delivers generative-AI SOC analyst capabilities across the Falcon platform, overlapping with Legion's autonomous triage and investigation for SOC teams already on CrowdStrike EDR.
- Torq / SentinelOne Purple AI overlap: SentinelOne's Purple AI provides generative-AI analyst capabilities across the Singularity XDR platform, serving the same enterprise SOC buyer with bundled AI-driven triage and investigation features that compete with Legion.
Emerging players
- Tenable ExposureAI / Cyera: Cyera applies AI to security data discovery and exposure management; while focused on data security rather than SOC alerting, it shares Legion's enterprise AI-driven security automation orientation and Fortune 500 buyer.
Market position
Strengths5 records
Weaknesses4 records
Competitive moat6 records
Key risks5 records
Key highlights7 records
Customer concentration
Legion Security social profiles
Digital presenceLegion Security compliance and trust
Trust signalCompliance4 records
Legion Security financial estimates
Financial estimateRevenue estimate
Valuation estimate
Legion Security leadership team
Management profileNumber of profiles
Profiles4 records
Legion Security funding detail
Funding detailFunding overview
Funding rounds2 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Legion Security M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Legion Security
What does Legion Security do?
Legion Security provides a browser-native AI SOC analyst platform delivered as a browser extension that observes how enterprise security analysts work, learns their investigation logic, and scales that behavior into automated agentic workflows across existing security tools. The platform operates in three modes—Learning Mode (passive capture), Guided Mode (AI-assisted investigation with human oversight), and Autonomous Mode (full end-to-end execution)—and is sold to enterprise security operations teams on a recurring subscription basis.
Is Legion Security a public or private company?
Legion Security is a private company. It is classified as venture growth investor backed and is currently operating.
When was Legion Security founded?
Legion Security was founded in 2025. It employs 51 to 100 people.
Where is Legion Security based?
Legion Security is headquartered in New City, United States, in the North America region.
How does Legion Security make money?
One revenue line is on record: platform Subscription.
Who are Legion Security's main competitors?
Direct peers on record are Torq, Dropzone AI, Prophet Security, Radiant Security, Intezer and Tines. Broad incumbents are Microsoft Security Copilot, CrowdStrike Charlotte AI and Torq / SentinelOne Purple AI overlap. Tenable ExposureAI / Cyera is listed as an emerging player.
Does Legion Security have an API?
No public API is recorded for Legion Security.
What industry is Legion Security in?
Legion Security's product category is AI Security Operations (SOC) Automation. Its primary akta.pro industry code is HDADAGAJ, Attack Detection & Response for Cloud/SaaS (SOC for Cloud), with a secondary code of HDADAGAE, Security Analytics & Detection Engineering. Its NAICS code is 56162 and its SIC code is 7373.