Demisto
Demisto, founded in 2015, built a security operations platform combining intelligent automation with ChatOps collaboration for SOC analysts. Acquired by Palo Alto Networks in 2019, it was rebranded as Cortex XSOAR, serving enterprise and public sector security teams.
- Company typePrivate
- Founded2015
- HeadquartersCupertino, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What Demisto does
Demisto was founded in 2015 in Cupertino and built a security operations platform that combined intelligent automation with a ChatOps collaboration interface to help SOC analysts investigate, triage, and remediate incidents. The original Demisto Enterprise product integrated security orchestration, automation, and incident response into a single workspace, featuring a visual playbook editor, a virtual war room for real-time collaboration, ChatOps/CLI for on-the-fly investigation, and auto-documentation for audit and knowledge sharing. Following its acquisition by Palo Alto Networks in 2019, the platform was rebranded as Cortex XSOAR (Security Orchestration, Automation and Response) and integrated into the broader Cortex security operations portfolio, gaining access to Unit 42 threat intelligence and PANW's enterprise distribution channel.
As Cortex XSOAR, the product now offers 900+ prebuilt integrations and automation content packs distributed through an open marketplace, thousands of security actions for DIY playbook construction, and machine-learning-assisted analyst workflows. Customers operationalize dozens to hundreds of custom playbooks (e.g., the State of North Dakota Information Technology runs 196 playbooks that auto-close over 60% of incidents), producing material switching costs and deep workflow lock-in. Recent product evolution includes the introduction of Cortex AgentiX, an AI agent workforce layer targeting agentic SOC automation.
The business model is enterprise software sold as part of Palo Alto Networks' Cortex platform, targeting large enterprise and public-sector SOC teams. No public pricing is disclosed; go-to-market runs through PANW's direct enterprise sales force and channel partners. As a fully integrated PANW product line, Demisto/Cortex XSOAR no longer has standalone financial reporting, and the company operates as a strategic subsidiary of Palo Alto Networks (NASDAQ: PANW).
Demisto firmographics
Firmographics- Name
- Demisto
- Website
- https://demisto.com
- Company type
- Private
- Founded year
- 2015
- Operating status
- Acquired
- Headcount range
- 101–250 employees
- Short description
- Demisto, founded in 2015, built a security operations platform combining intelligent automation with ChatOps collaboration for SOC analysts. Acquired by Palo Alto Networks in 2019, it was rebranded as Cortex XSOAR, serving enterprise and public sector security teams.
- Ownership category
- akta.pro rank
Demisto industry classification
Industry- Product category
- Security Orchestration, Automation and Response (SOAR) Software
- NAICS
- Computer Systems Design and Related Services (5415), Computer Systems Design Services (541512)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- SIEM Platforms & Log Management (HDADAGAA)
- akta.pro secondary industries
- IT Operations, Event & Incident Management (NOC/SOC-to-ITSM) (BPAEAJAH), Extended Detection & Response (XDR) (HDADAEAB), IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK)
Keywords
Where Demisto is headquartered
LocationHeadquarters
- HQ city
- Cupertino
- HQ country
- United States
- HQ region
- North America
Markets served
Demisto business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure
Demisto product offering
Product offeringCore offering
Demisto Enterprise (now Cortex XSOAR) is a Security Orchestration, Automation and Response (SOAR) platform that combines intelligent automation, case management, and ChatOps-based collaboration for enterprise Security Operations Centers. It delivers 900+ prebuilt integrations, a visual playbook editor, a virtual war room, threat intel mapping, and auto-documentation to automate manual SOC workflows and accelerate incident investigation and remediation.
Differentiator
Problem solved
Functional benefit
Products and services
- Demisto Enterprise (Cortex XSOAR) Security Orchestration, Automation and Response (SOAR) platform that combines intelligent automation, incident case management, threat intel mapping, a visual playbook editor and a ChatOps war room to automate and accelerate SOC incident response for enterprise and public-sector security teams.
- XSOAR Content Marketplace Self-service marketplace of prebuilt integrations, playbooks and automation content packs that customers can browse and deploy to extend the Cortex XSOAR platform across their security product stack.
Companies that use Demisto
Customer profileIdeal customer profiles2 records
Demisto technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Demisto partnerships and signals
Strategic signalRecent moves6 records
Expansion highlights5 records
Demisto competitors and assessment
Company assessmentDirect peers
- D3 Security: Enterprise SOAR platform with smart automation, incident case management, and extensive integrations, frequently listed alongside Cortex XSOAR in SOAR vendor evaluations.
- Splunk SOAR (Phantom): Splunk's security orchestration, automation, and response platform (originally Phantom Cyber) competes head-to-head with Demisto/Cortex XSOAR in the enterprise SOAR market with overlapping playbook, integration, and case-management capabilities.
- Rapid7 InsightConnect: Rapid7's SOAR solution delivers drag-and-drop workflow automation and orchestration across the security stack, targeting the same SOC analyst persona as Demisto/XSOAR.
- Swimlane: Independent SOAR vendor offering low-code automation playbooks and a large integration library for security operations teams, positioned as a direct alternative to Cortex XSOAR in mid-market and enterprise SOCs.
- IBM Security QRadar SOAR (Resilient): IBM's QRadar SOAR (formerly Resilient) is one of the original SOAR platforms targeting large SOCs with incident response orchestration, dynamic playbooks, and threat-intel integration — directly comparable to Demisto/XSOAR.
Broad incumbents
- ServiceNow Security Operations: ServiceNow's Security Incident Response and Vulnerability Response modules provide SOAR-style automation and workflow tightly integrated with ITSM, competing for the same enterprise SOC customer.
- CrowdStrike Falcon Fusion: CrowdStrike's Falcon platform includes workflow and automation (Falcon Fusion) that competes with XSOAR for SOC orchestration budgets within endpoint-centric security stacks.
- Microsoft Sentinel: Microsoft's cloud-native SIEM and SOAR platform bundles orchestration and automation tightly with Defender XDR, competing with XSOAR as part of a broader enterprise security suite rather than a standalone SOAR offering.
- Palo Alto Networks Cortex XSIAM: PANW's extended security intelligence and automation platform bundles XDR, SIEM, and SOAR (including XSOAR capabilities) — an internal sibling to Demisto/XSOAR that competes for the same SOC automation wallet share.
Emerging players
- Tines: Story-driven automation platform used by SOC and security teams to orchestrate workflows, increasingly competing with traditional SOAR vendors like Demisto/XSOAR in mid-market and cloud-first enterprises.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks5 records
Key highlights6 records
Customer concentration
Demisto social profiles
Digital presenceDemisto financial estimates
Financial estimateRevenue estimate
Valuation estimate
Demisto leadership team
Management profileNumber of profiles
Profiles3 records
Demisto funding detail
Funding detailFunding overview
Funding rounds3 records
Investors8 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Demisto M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Demisto
What does Demisto do?
Demisto Enterprise (now Cortex XSOAR) is a Security Orchestration, Automation and Response (SOAR) platform that combines intelligent automation, case management, and ChatOps-based collaboration for enterprise Security Operations Centers. It delivers 900+ prebuilt integrations, a visual playbook editor, a virtual war room, threat intel mapping, and auto-documentation to automate manual SOC workflows and accelerate incident investigation and remediation.
Is Demisto a public or private company?
Demisto is a private company. It is classified as corporate owned and is currently acquired.
When was Demisto founded?
Demisto was founded in 2015. It employs 101 to 250 people.
Where is Demisto based?
Demisto is headquartered in Cupertino, United States, in the North America region.
Who are Demisto's main competitors?
Direct peers on record are D3 Security, Splunk SOAR (Phantom), Rapid7 InsightConnect, Swimlane and IBM Security QRadar SOAR (Resilient). Broad incumbents are ServiceNow Security Operations, CrowdStrike Falcon Fusion, Microsoft Sentinel and Palo Alto Networks Cortex XSIAM. Tines is listed as an emerging player.
Does Demisto have an API?
No public API is recorded for Demisto.
What industry is Demisto in?
Demisto's product category is Security Orchestration, Automation and Response (SOAR) Software. Its primary akta.pro industry code is HDADAGAA, SIEM Platforms & Log Management, with a secondary code of BPAEAJAH, IT Operations, Event & Incident Management (NOC/SOC-to-ITSM). Its NAICS code is 5415 and its SIC code is 7372.