AI Governance & Security Vendor Wiki

7 min read

Sevii

Primary category: ai-soc-analysts.

One-liner — Sevii is an early-stage US startup whose AI agents (“Cyber Warriors”) take detections from your existing EDR/XDR and SIEM, investigate and hunt, and then carry out the remediation, such as isolating hosts and disabling identities. It sells this as “autonomous defense and remediation” (ADR): an action layer on top of the SOC rather than a triage assistant.

What it does — Sevii connects by API (agentless, nothing installed on endpoints) to 365+ security tools. Named integrations include CrowdStrike Falcon, Splunk, Microsoft, Google SecOps, Tenable, Fortinet, ServiceNow and Jira. Agents then:

  • triage and investigate incoming detections;
  • run escalated, hypothesis and 7-day retrospective threat hunts;
  • remediate within policies the customer defines (“AI governance policies”), with human-in-the-loop optional and every action documented for audit.

Its headline metric is “mean time to act”. It claims remediation in under 15 minutes, “often under six” (vendor claim). Modules split by domain: enterprise and SIEM/data lake (“Spike”), identity (“Oz”), cloud (“Ace”), AI security (“Aegis”) and “preemptive” hunting. Cyber Swarm Defense (April 2026) spins up more agents when alert volume spikes. Case notes can be mirrored back into CrowdStrike NG-SIEM and ServiceNow. Sevii’s own site calls AI SOC “the starting point”, so it is squarely in the category the respondent placed it in.

Naming / provenance — Came out of stealth 2025-09-05. The co-founders are Curt Aubley (CEO; previously led US cyber detection and response at Deloitte, ran technology alliances and solution architecture at CrowdStrike, was VP/CTO in Intel’s Data Center Group, and spent about 12 years as a cybersecurity CTO at Lockheed Martin), Stephen Collins (CTO), Caleb Cross (CDO) and Arnie Shimo (CSO). The founding year is unconfirmed: the company was funded and pre-launch in April 2025. HQ is unconfirmed. Aggregators disagree (Charlotte, NC vs Mooresville, NC) and the company site does not state it. Not to be confused with unrelated companies with similar names (e.g. Sev1Tech, Sevatec).

Ownership & viability — independent, early-stage venture.

  • Pre-seed led by Overline with 10VC and SaaS Ventures, announced around 2025-04-24. Amount undisclosed.
  • BMW i Ventures invested in a round described in a post dated February 2026, joining Overline, TenVC and Tandem Launch. Amount and stage undisclosed; an aggregator calls it a seed.
  • Programmes. Selected for the 2026 CrowdStrike / AWS / NVIDIA Cybersecurity Startup Accelerator, per a Carahsoft (public-sector reseller) listing and the company site.
  • Viability. Seed-stage. Runway and headcount are unknown, and there are no named customers.
  • Acquisition-risk note. Its tight CrowdStrike alignment (marketplace listing, accelerator, CEO’s CrowdStrike background) makes CrowdStrike or another XDR/SIEM owner a plausible acquirer. That pattern, platforms absorbing AI-SOC startups, is described on the ai-soc-analysts page. For customers, the risk is that an acquisition ends support for non-acquirer integrations.

Positioning & differentiators — ai-native-disruptor: a 2025-vintage startup selling autonomous agents in place of tier-1/tier-2 analyst work.

  • Remediation-first, not investigation-first. dropzone-ai, prophet-security and radiant-security lead with autonomous investigation and a verdict for a human. Sevii leads with taking the action. That gains speed, and it raises the cost of an agent error.
  • On-prem, air-gapped option. Sevii offers a self-contained appliance with NVIDIA GPUs that needs no cloud connection, for classified and regulated environments. Most AI-SOC peers are SaaS-only. d3-security is the other self-hostable option on this list.
  • Per-asset pricing, no token charges (vendor-stated). This contrasts with usage- or alert-volume-priced peers, which makes cost predictable during an alert storm.
  • Versus platform-native agents (crowdstrike Charlotte AI, palo-alto-networks Cortex AgentiX): Sevii claims cross-vendor reach (EDR + identity + cloud + SIEM). If your estate is mostly Falcon, Charlotte AI may already cover much of the same ground.

Who should choose them / anti-fit — Fits a security team with a mature, well-tuned EDR/XDR and SIEM stack, CrowdStrike especially, and written response playbooks. It suits teams willing to let software contain threats automatically within tight policy guardrails, and that want 24/7 machine-speed containment without a night shift. The one survey respondent (in production) shows a hedge-fund-type buyer has adopted it. Anti-fit:

  • A firm whose change-control or operational-risk culture will not allow automated containment of production identities or trading endpoints. Use an investigation-only AI SOC analyst instead.
  • A firm that wants a vendor with a long track record and named FS references.
  • A firm without a reliable detection layer. Sevii acts on detections; it does not replace EDR or SIEM.

Known weaknesses / gotchas —

  • Autonomous remediation needs careful policy. A wrongly isolated trading workstation or a disabled service account during market hours is an operational incident. Insist on a scoped allow-list of actions, approval gates for high-impact assets, a dry-run mode, and full action logs. Test rollback.
  • Vendor metrics only. “$107M+ saved”, “2M+ remediations” and the “Level 6” autonomy label are self-reported. No named customers or independent evaluations were found.
  • Thin company disclosure. Funding amounts, HQ and headcount are not public.
  • Integration depth varies by tool. “365+ integrations” will not all support write actions. Ask which tools Sevii can remediate in, not just read from.

Deployment & data handling — Commercial deployments run as SaaS on AWS, and Sevii pulls detection and context data from your tools by API into its environment. The on-prem appliance keeps processing local, without internet or cloud connectivity. The CEO describes the system as “entirely under the customer’s operational control.” Sevii holds API credentials with write permissions into EDR, identity and cloud consoles. Those are high-value credentials: ask how they are stored, scoped and rotated. Model provider, data retention, and whether customer data trains models are unverified.

Integrations & partnerships — Named: CrowdStrike Falcon / NG-SIEM, Splunk, Microsoft, Google SecOps (Chronicle), Tenable, Fortinet, ServiceNow, Jira. Distribution through AWS Marketplace and CrowdStrike Marketplace (announced as slated in 2025-09; current listing not checked), plus Carahsoft for the public sector. MCP support unverified.

Compliance & FS traction — SOC 2 Type II (vendor site). No FS customers named, so FS traction is unverified beyond the survey respondent. Every agent action is documented, which supports incident-response evidence for SEC cyber-disclosure and exam purposes. Ask for an export format.

Commercial — Fixed price per protected asset, with no AI token or usage charges (vendor). Price bands not public.

Survey note — 2026-10 CTO survey write-in: 1 respondent, in production, under Q47 AI SOC.

Open questions

  • HQ location and founding date (aggregators conflict: Charlotte vs Mooresville, NC).
  • Funding amounts for the pre-seed and the 2026 BMW i Ventures round.
  • Which integrations support write/remediation actions vs read-only.
  • Model providers used, data retention, training-use terms; credential storage for connected tools.
  • Named customers, especially in financial services; independent evaluations.
  • Current AWS / CrowdStrike Marketplace listing status.

Sources

History

  • [2026-10-24] Page created via wiki-create and researched the same day. Triggered by a single in-production write-in under Q47 AI SOC in the 2026-10 CTO survey. Primary ai-soc-analysts. Differentiated as remediation-first (autonomous action) vs investigation-first peers.

Graph View

Backlinks