LimaCharlie
LimaCharlie is a cloud-native, API-first SecOps platform that delivers endpoint detection, multi-tenant security operations, and agentic AI automation as modular infrastructure for MSSPs, enterprise SOCs, and product builders.
- Company typePrivate
- Founded2018
- HeadquartersCovina, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What LimaCharlie does
LimaCharlie, founded in 2018 by Maxime Lamothe-Brassard (formerly of CrowdStrike, Google X, and Chronicle Security) and Christopher Luft, is a venture-backed private cybersecurity company headquartered in Covina, California with a secondary office in Vancouver, Canada. The company operates a cloud-native, API-first SecOps Cloud Platform that delivers endpoint detection and response, log ingestion, multi-tenancy, telemetry normalization, and detection/response automation as modular, on-demand infrastructure primitives — conceptually modeled on how AWS delivers IT infrastructure. The platform exposes 100% of functionality via REST API and a Python SDK, supports detection-as-code and infrastructure-as-code via YAML and Terraform, and includes a Model Context Protocol (MCP) bridge plus a CLI that allow AI agents to operate directly on security telemetry with the same permissions as human analysts.
The product portfolio centers on the SecOps Cloud Platform, the Grid agentic operations layer (AI operators running in a parallel pipeline without stack migration, supporting BYOK LLM providers including Anthropic Claude Code, OpenAI Codex, and Google Gemini CLI), the Agentic SecOps Workspace announced in January 2026, and Viberails as an observability pipeline offering. LimaCharlie monetizes through a free Community tier (up to 2 endpoints), a self-serve Standard tier at $3.00/endpoint with volume pricing at 5,000+ endpoints, and a custom-priced Builder Program for MSSPs requiring unlimited endpoints. Distribution is product-led with a sales-assisted overlay for enterprise and MSSP tiers, complemented by a Google Cloud Marketplace listing and the Cyberrey distribution partnership for Africa.
The company serves Managed Security Service Providers (MSSPs), enterprise SOCs, founders and product builders, and incident response firms, with named customers spanning Coinbase, Carta, Snapchat, Chainalysis, Black Hills Information Security, Recon Infosec, Soteria, Blumira, and government entities. Total disclosed funding is approximately $16.15 million across a pre-seed (Lytical Ventures, 2021), seed (Susa Ventures, May 2022, $24M post-money valuation), and Series A (Sands Capital, February 2024). The company is SOC 2 Type II certified and aligned with GDPR, CCPA, and PCI DSS.
LimaCharlie firmographics
Firmographics- Name
- LimaCharlie
- Legal name
- LimaCharlie
- Website
- https://limacharlie.io
- Company type
- Private
- Founded year
- 2018
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- LimaCharlie is a cloud-native, API-first SecOps platform that delivers endpoint detection, multi-tenant security operations, and agentic AI automation as modular infrastructure for MSSPs, enterprise SOCs, and product builders.
- Ownership category
- akta.pro rank
Where LimaCharlie is headquartered
LocationHeadquarters
- HQ city
- Covina
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
LimaCharlie business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Infrastructure, Operations, Marketing or Sales
Revenue model
- Endpoint-based Per-unit Pricing: LimaCharlie charges primarily per endpoint monitored. The Standard tier is $3.00/endpoint at list price, with volume discounts available at 5,000 endpoints. Additional costs apply for data ingestion at $0.20/GB above included amounts. The MSSP Builder Program offers unlimited endpoints at discounted negotiated rates. No contracts required — billed month-to-month with pay-per-use.
- Free Tier (Community): A free community tier for individual researchers and learners supports up to 2 endpoints with 1-year storage, EDR, AI agents (BYOK), Python playbooks, and data forwarding. This tier serves as a self-serve entry point and developer acquisition channel.
- AI LLM Provider Pass-through: AI-powered workflows use the customer's own API keys from providers like Anthropic (Claude Code), OpenAI (Codex), Google (Gemini CLI). LimaCharlie does not mark up or resell AI capacity — customers pay model providers directly at cost. LimaCharlie charges only for infrastructure, orchestration, and security context.
- Professional Services / Custom Engagements: Through the MSSP Partner program and direct sales, LimaCharlie provides business and technical advisory, joint marketing, and customer referrals. Private cloud options are available at negotiated prices.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Community (Free): Up to 2 endpoints, free EDR, 1-year storage, AI agents, Python playbooks, data forwarding, community discourse support. |
| Usage-based | Pay-as-you-go | Standard: $3.00/endpoint for teams building security tools, services, and enterprise SOCs. Volume pricing at 5,000+ endpoints. $0.20/GB for data above included amounts. |
| Hybrid | Monthly | Builder Program (MSSP): Unlimited endpoints at discounted custom tiered pricing with technical account manager, Slack, ticketing, and discourse support. |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels8 records
LimaCharlie product offering
Product offeringCore offering
LimaCharlie delivers a cloud-native, API-first SecOps platform that provides EDR, log ingestion, multi-tenant security operations, and detection-and-response automation as modular on-demand primitives. Its Grid product layers AI security operators on top of customers' existing telemetry stacks without requiring migration. The platform is sold to MSSPs, enterprise SOCs, incident response firms, and security product builders on a pay-per-endpoint, freemium, and custom-tiered pricing model.
Product overview
LimaCharlie is an Agentic SecOps Platform comprising a unified cloud-native platform plus modular products. The SecOps Cloud Platform (SCP) serves as the core infrastructure layer providing API-first, multi-tenant security capabilities. Grid by LimaCharlie runs AI operators directly on top of the platform, connecting to existing stacks without migration. The Agentic SecOps Workspace enables AI agents to perceive, decide, and execute autonomously. Viberails handles observability pipeline and data routing. Pricing tiers include Community (free), Standard ($3/endpoint), and Builder Program (custom).
Differentiator
Problem solved
Functional benefit
Brands
- Grid: AI operators product that runs on existing security stacks, providing agentic SecOps capabilities for MSSPs.
- Viberails
- SecOps Cloud Platform (SCP)
- Agentic SecOps Workspace
Products and services
- SecOps Cloud Platform (SCP) API-first, multi-tenant security infrastructure delivering EDR, detection, automation, response, datalake/SIEM, and endpoint agent capabilities as modular cloud primitives for MSSPs, enterprise SOCs, and security product builders.
- Grid by LimaCharlie AI security operator product that connects AI agents directly to a customer's existing telemetry stack via a parallel pipeline, with no migration or rip-and-replace; agents review queues, investigate alerts, and execute responses across every client tenant with full audit trails.
- Agentic SecOps Workspace Workspace that lets AI agents perceive, decide, and execute autonomously in customer environments using the same APIs as human analysts, with full audit trails and observability.
- LimaCharlie CLI Command-line interface exposing 100% of platform capabilities as commands an AI can call, enabling direct connection of models such as Claude Code to LimaCharlie environments via the same permissions model as human analysts.
- Viberails Observability pipeline product for SIEM cost reduction and security data routing, enabling ingestion from any source and forwarding to destinations such as AWS S3, Azure Event Hub, or Kafka.
- Sleeper-Mode EDR Sensors EDR sensors that can be pre-deployed in dormant sleeper mode at low cost and instantly activated, enabling incident responders to offer competitive SLAs and pre-position telemetry across client environments.
- Builder Program (MSSP) Custom tiered pricing program for MSSPs that bundles unlimited endpoints at discounted rates with a technical account manager, Slack, ticketing, and discourse support, plus joint marketing and referrals.
- Cybersecurity Add-ons Marketplace Marketplace of 100+ cybersecurity capabilities and integrations that customers can activate on-demand, including Velociraptor, YARA, Sigma, Zeek, Atomic Red Team, CrowdStrike, SentinelOne, Trend Micro, VirusTotal, SOC Prime, and Soteria, enabling ingestion from any source and output to any destination.
Quantifiable outcome
- $100,000 annual cost savings for an MDR firm (Recon Infosec) after migrating from a custom-engineered security stack to LimaCharlie.
- +4 more outcomes
Companies that use LimaCharlie
Customer profileNamed customers13 records
Segments4 records
Ideal customer profiles4 records
LimaCharlie technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration24 records
AI capability10 records
Feature12 records
LimaCharlie partnerships and signals
Strategic signalPartnerships
Four partnerships are on record, tiered core.
- CyberreycoreStrategic partnership announced May 2025 with Cyberrey, a leading African value-added distributor of cybersecurity solutions. Partnership aims to transform cybersecurity operations across Africa by distributing LimaCharlie's SecOps Cloud Platform through Cyberrey's regional channel network.
- Anthropic (Claude Code)coreNative integration with Anthropic's Claude Code via LimaCharlie's CLI and MCP Bridge. Customers can connect Claude Code directly to their LimaCharlie environment to run AI agents as security operators.
- OpenAI (Codex)coreNative integration with OpenAI Codex as a supported LLM for AI agent workflows within the LimaCharlie platform. Part of the BYOK (bring your own key) model.
- Google (Gemini CLI)coreNative integration with Google Gemini CLI for AI agent workflows within the LimaCharlie platform. Part of the BYOK model supporting multiple LLM providers.
Scale indicators11 records
Recent moves6 records
Expansion highlights6 records
LimaCharlie competitors and assessment
Company assessmentDirect peers
- Tines: Tines is a no-code SOAR/security automation platform competing directly with LimaCharly's D&R automation and playbooks. Both target MSSPs and security teams seeking to automate queue work and incident response without heavy engineering.
- SentinelOne: SentinelOne Singularity Platform offers EDR, XDR, and AI-driven autonomous response—overlapping with LimaCharlie's EDR and Grid autonomous-agent capabilities. LimaCharlie lists SentinelOne as an integrated telemetry source, indicating both overlap and complementarity.
- CrowdStrike: CrowdStrike Falcon is a direct competitor in endpoint detection, SIEM (Falcon LogScale), SOAR, and identity threat detection—the same categories LimaCharlie's SecOps Cloud Platform addresses. LimaCharlie explicitly positions as vendor-neutral, complementing rather than replacing CrowdStrike.
- Cribl: Cribl Stream and Cribl Edge provide observability pipeline and telemetry routing—overlapping with LimaCharlie's Viberails product and 1-year free telemetry storage value proposition. Both target SIEM cost reduction and vendor-neutral data routing.
- Panther Labs: Panther is a cloud-native SIEM built on a detection-as-code model with similar YAML-based detection syntax, similar cost-efficiency pitch, and similar target MSSP/enterprise SOC customer base as LimaCharlie.
- Torq: Torq is a security hyperautomation platform with autonomous SOC workflows—overlapping closely with LimaCharlie's Grid AI operators and Forward Deployed Engineer model. Both target MSSP unit-economics problems.
Broad incumbents
- Microsoft Sentinel: Microsoft Sentinel is a cloud-native SIEM/SOAR natively integrated with Microsoft Defender and Azure. It competes directly on SIEM cost and integration story but ties customers to the Azure ecosystem, whereas LimaCharlie is cloud-agnostic.
- Datadog (Cloud SIEM): Datadog Cloud SIEM extends the broader Datadog observability platform into security analytics and threat detection. Like Cribl, Datadog competes on telemetry routing and SIEM cost—overlapping with Viberails and the LimaCharlie data layer.
- Sumo Logic: Sumo Logic is a cloud-native log management and SIEM platform serving enterprise and MSSP customers—overlapping with LimaCharlie's telemetry pipeline and log analytics capabilities. Now owned by Francisco Partners, Sumo Logic has been repositioning around security use cases.
- Palo Alto Networks (Cortex XSIAM): Cortex XSIAM is Palo Alto's SecOps platform consolidating EDR, SIEM, SOAR, and ASM—overlapping with the full LimaCharlie platform. As a much larger incumbent, Palo Alto competes for the same enterprise wallet but lacks LimaCharlie's MSSP-first, API-first positioning.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks7 records
Key highlights7 records
Customer concentration
LimaCharlie social profiles
Digital presenceLimaCharlie compliance and trust
Trust signalCompliance4 records
LimaCharlie financial estimates
Financial estimateRevenue estimate
Valuation estimate
LimaCharlie leadership team
Management profileNumber of profiles
Profiles7 records
LimaCharlie funding detail
Funding detailFunding overview
Funding rounds4 records
Investors10 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
LimaCharlie M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about LimaCharlie
What does LimaCharlie do?
LimaCharlie delivers a cloud-native, API-first SecOps platform that provides EDR, log ingestion, multi-tenant security operations, and detection-and-response automation as modular on-demand primitives. Its Grid product layers AI security operators on top of customers' existing telemetry stacks without requiring migration. The platform is sold to MSSPs, enterprise SOCs, incident response firms, and security product builders on a pay-per-endpoint, freemium, and custom-tiered pricing model.
Is LimaCharlie a public or private company?
LimaCharlie is a private company. It is classified as venture growth investor backed and is currently operating.
When was LimaCharlie founded?
LimaCharlie was founded in 2018. It employs 11 to 50 people.
Where is LimaCharlie based?
LimaCharlie is headquartered in Covina, United States, in the North America region.
How does LimaCharlie make money?
Four revenue lines are on record. Endpoint-based Per-unit Pricing is the primary driver. The others are free Tier (Community), AI LLM Provider Pass-through and professional Services / Custom Engagements.
Who are LimaCharlie's main competitors?
Direct peers on record are Tines, SentinelOne, CrowdStrike, Cribl, Panther Labs and Torq. Broad incumbents are Microsoft Sentinel, Datadog (Cloud SIEM), Sumo Logic and Palo Alto Networks (Cortex XSIAM).
Does LimaCharlie have an API?
Yes. LimaCharlie's API-first platform provides 100% API-accessible capabilities to security engineers and agentic operators. The platform supports full control via REST API, with Python playbooks for automation. A Model Context Protocol (MCP) bridge provides AI agents with structured access and fine-grained permissions. Developer documentation is at docs.limacharlie.io.