What Booli does

Booli is a private US-based cybersecurity company headquartered in Houston, Texas, that builds an Identity-Centric SIEM platform aimed at enterprise security operations centers, managed security service providers, and lean in-house security teams. The company's core product proposition is that legacy SIEMs correlate events by IP address or host, whereas Booli stitches events to user and machine identities across accounts, applications, and devices, producing alerts enriched with identity, risk, and behavioral context. Founded by self-described cybersecurity veterans and former SOC operators, the company has an 11–50 person team led by CEO and co-founder Robin Smith and CTO and co-founder Robert Harris, alongside a CRO and CPO.

The platform is 100% cloud-native and consists of the core Identity-Centric SIEM plus three modules: Leon AI, an embedded AI assistant (short for LeonAIdas) that handles triage, enrichment, root-cause analysis, and remediation guidance using NLP, RAG, behavioral analytics, and autonomous agents; Federated Security, which queries existing Splunk, Elastic, and Sentinel deployments in place to deliver cross-SIEM correlation without log replication; and Data Resilience, which provides strategic logging plans, compression, tiered retention, and log health monitoring to reduce raw log volume by over 50%. Reported customer outcomes include 70% reductions in alert volume, 83% increases in analyst productivity, and 80% reductions in compliance preparation time, with 80+ tool integrations supported within six months.

Booli monetizes through consumption-based, quote-priced subscriptions that scale with data ingestion, with flexible commercial arrangements for MSSPs including margin-rich resale and recurring referral. Go-to-market combines direct enterprise sales (via [email protected] and demo CTAs) with a partner-led motion across MSSPs, resellers/VARs, consulting and advisory firms, and technology integration partners, featuring a 2-week standard onboarding and MSSP-ready multi-tenant support. The platform supports GDPR, HIPAA, SOX, and CCPA compliance configurations and has been named a 2030 Security Product of the Year; it carries a 4.9 out of 5 average rating from 47 listed reviews.

Name

Booli

Legal name

Booli

Website

https://booli.ai

Company type

Private

Founded year

2022

Operating status

Operating

Headcount range

11–50 employees

Short description

Booli is a Houston-based private cybersecurity vendor that sells a cloud-native, identity-centric SIEM platform with an embedded AI assistant (Leon AI) to enterprise SOCs, MSSPs, and lean security teams, monetized via consumption-based subscriptions and a partner-led channel motion.

Ownership category

akta.pro rank

Product category

Security Information and Event Management (SIEM) Software

NAICS

Software Publishers (5132)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

SIEM Platforms & Log Management (HDADAGAA)

akta.pro secondary industry

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)

Keywords

• Identity SIEM
• Security operations platform
• Threat detection response
• Identity stitching
• Cloud-native SIEM

Headquarters

HQ city

Houston

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SIEM Platform Subscription: Consumption-based pricing model where costs scale with data ingestion needs. Subscription model with flexible commercial options for MSSPs including margin-rich resale or recurring referral arrangements.
2. Usage-Based Consumption: Pay-for-what-you-use model that grows with customer needs. Costs align with data ingestion volume and usage patterns.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels4 records

Core offering

Booli builds and sells a cloud-native Identity-Centric SIEM platform that ties security alerts to user identities via real-time identity stitching rather than legacy IP/host-based correlation. The platform combines AI-driven behavioral analytics, contextual scoring, and automated incident response, and is extended by natively embedded Leon AI (agentic/GenAI analyst assistant), Federated Security (cross-SIEM query-in-place), and Data Resilience (strategic log ingestion with tiered retention). The offering is delivered as a subscription with consumption-based pricing targeting enterprise SOCs and MSSPs.

Product overview

Booli is a cloud-native Identity SIEM platform built around identity-first detection and response. The core platform is Identity-Centric SIEM, which ties alerts to people rather than just events using real-time identity stitching. Four modules extend the platform: Leon AI (a natively embedded AI assistant for triage, enrichment, and automated remediation), Federated Security (for cross-SIEM correlation without log duplication), and Data Resilience (for strategic log ingestion and cost control). The company also offers whitepapers and 24/7 security assistance as supporting services. The architecture is 100% cloud-native, designed for MSSPs and lean security teams, and supports 80+ tool integrations within 6 months.

Differentiator

Problem solved

Functional benefit

Brands

• Leon AI: AI-powered SIEM assistant that serves as a constantly evolving assistant enriching identity-centric detection and response. Short for 'LeonAIdas'.
• Identity-Centric SIEM
• Federated Security
• Data Resilience

Products and services

• Identity-Centric SIEM The world's first Identity SIEM that correlates who was behind every event using real-time identity stitching. Combines AI-driven behavioral analytics, contextual scoring, end-to-end visibility across on-prem, cloud, and hybrid systems, and automated incident response to surface critical threats and reduce alert fatigue. Targets enterprise SOCs, MSSPs, and lean security teams replacing legacy SIEMs like Splunk, Arctic Wolf, Elastic, and Microsoft Sentinel.
• Leon AI (LeonAIdas) Booli's natively embedded AI assistant (short for 'LeonAIdas') that assists analysts and threat hunters via a persistent chat interface during investigations. Represents the conglomeration of public and private agentic and GenAI (RAG) solutions, automating triage, enrichment, root cause analysis, and remediation through deployed agents that feed learnings back into detection.
• Federated Security Unified threat visibility across multi-cloud and hybrid environments without duplicating logs or storage. Enables cross-SIEM correlation with Splunk, Elastic, and Sentinel, query-in-place architecture, and tool-agnostic integration that maintains existing SIEM investments while unifying identity detection.
• Data Resilience Strategic logging solution that ingests the right logs with the right detail at the right time. Features a logging blueprint, high-value enrichment, compression and retention with tiered data strategies, and log health and drift alerts to ensure performance, precision, and cost control.
• 24/7 Security Assistance Always-on protection service to detect, prioritize, and respond to threats in real-time, ensuring assets are safeguarded around the clock with a guaranteed 24-hour response to support requests. Supports Booli's enterprise SOC and MSSP deployments.

Quantifiable outcome

• 70% reduction in alert volume and alert fatigue
• +6 more outcomes

Named customers1 record

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability7 records

Feature6 records

Partnerships

Five partnerships are on record, tiered core.

• MSSPs & Security ProviderscoreChannel Partner/ Reseller/ DistributorMSSP partners deliver 24/7 detection, triage, and response with identity-stitching built in. Booli offers multi-tenant support, custom runbooks, and flexible integrations for MSSP delivery. 2-week standard onboarding with MSSP-ready features.
• Resellers & DistributorscoreChannel Partner/ Reseller/ DistributorChannel partners resell the world's first Identity SIEM built for modern identity-driven security operations. Booli provides margin-rich resale or recurring referral commercial models.
• Consulting & Advisory FirmscoreImplementation/ SI/ Consulting PartnerConsulting partners embed Booli into strategic security assessments, tool rationalization, and compliance projects. Features include sales and technical enablement, tools, training, and pre-sales support.
• Technology Integration PartnerscoreTechnology or IntegrationTechnology partners integrate Booli's contextual threat correlation and fast ingestion pipelines into their products. Works with existing SIEMs and data lakes including Splunk, Elastic, and Sentinel without vendor lock-in.
• Splunk, Elastic, Microsoft SentinelcoreTechnology or IntegrationBooli integrates with existing SIEM platforms to provide federated security capabilities - enabling customers to maintain existing investments while gaining identity-first correlation.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Exabeam: Exabeam is a security analytics platform built around user/entity behavior analytics (UEBA) and identity-driven detection — directly comparable to Booli's identity-stitching approach. Closest direct competitor on identity-centric detection philosophy.
• Devo Technology: Devo is a cloud-native SIEM/log analytics platform targeting enterprise SOCs with high-volume data ingestion. Direct competitor in the modern cloud SIEM category, comparable on architecture, target segment, and consumption-based pricing.
• Sumo Logic: Sumo Logic is a cloud-native log analytics and SIEM platform with strong MSSP partnerships and consumption pricing. Direct competitor on architecture (cloud-native), pricing model (consumption), and target customer profile.
• Arctic Wolf: Arctic Wolf is an MSSP-led security operations platform combining managed detection and response with its own SIEM-like data platform. Named explicitly in Booli's competitive materials as a legacy IP/host-correlation vendor being replaced by identity-first approaches.
• Securonix: Securonix is a cloud-native SIEM built around user/entity behavior analytics and identity threat detection, with MSSP-ready multi-tenant capabilities. Highly comparable to Booli on product philosophy, target customer (enterprise SOCs and MSSPs), and use cases.

Broad incumbents

• Elastic Security: Elastic's SIEM offering (built on Elasticsearch) is widely deployed in enterprise SOCs and is explicitly listed as an integration target for Booli's federated security. Direct competitor in the cloud-native SIEM space.
• Splunk: Splunk is the dominant legacy SIEM platform (now owned by Cisco) that uses IP/host-based correlation — the exact approach Booli positions against. It is the incumbent Booli most often displaces and is explicitly named in Booli's marketing materials.
• Microsoft Sentinel: Microsoft's cloud-native SIEM, built into the Azure ecosystem and tightly bundled with Microsoft security and identity products. It is a primary competing SIEM that Booli's federated architecture integrates with, and competes against for enterprise SOC budgets.

Emerging players

• Hunters.ai: Hunters is an AI-driven SOC platform that ingests SIEM data and applies behavioral analytics and detection engineering. Comparable as an emerging identity-and-AI-focused detection layer that often sits alongside or replaces legacy SIEMs — directly aligned with Booli's positioning.
• Tines: Tines is a security automation and SOAR platform that integrates with SIEMs including Splunk, Sentinel, and Elastic — directly overlapping with Booli's automated response and SOAR playbook integration story. Adjacent competitor in the modern SOC stack.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/booliai

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Booli