CyberKord
AI platform automating IT and cybersecurity operations with a digital twin for incident resolution.
Website: https://www.cyberkord.com/
Cover Block
From the public record
| Field | Value |
|---|---|
| Name | CyberKord |
| Tagline | AI platform automating IT and cybersecurity operations with a digital twin for incident resolution [Tech.eu, November 2026] |
| Headquarters | Milan, Italy [Tech.eu, November 2026] |
| Founded | 2026 [Tech.eu, November 2026] |
| Stage | Pre-seed [Tech.eu, November 2026] |
| Business Model | SaaS |
| Industry | Security |
| Technology | AI / Machine Learning |
| Geography | Western Europe |
| Growth Profile | Venture Scale |
| Founding Team | Alessandro Maggio, Dragos Tanasa, Cosimo Michelagnoli [Tech.eu, November 2026] |
| Funding Label | Pre-seed |
| Total Disclosed | $2,900,000 [Tech.eu, November 2026] |
Links
From the public record
- Website: https://www.cyberkord.com/
The Short Version
PUBLIC CyberKord is a Milan-based startup building an AI platform to automate IT and cybersecurity operations, and it merits attention now because it has already framed a specific product wedge, a digital twin of enterprise IT infrastructure, around a fresh pre-seed syndicate led by 360 Capital [Tech.eu, November 2026] [Startupbusiness.it, November 2026]. Founded in 2026 by Alessandro Maggio, Dragos Tanasa, and Cosimo Michelagnoli, the company is early, but the founding story is unusually focused for this stage: the public materials and launch coverage point to a narrow ambition of moving from alert handling toward incident investigation and remediation, rather than stopping at detection alone [Tech.eu, November 2026] [Vestbee, November 2026] [LinkedIn, retrieved 2026].
The product claim is that CyberKord acts as an intelligence layer over a customer’s existing stack, correlates signals across systems, then simulates proposed actions before applying them in production, with the simulation-first step serving as the main differentiator in public coverage [CyberKord] [Tech.eu, November 2026] [Startupbusiness.it, November 2026]. That positioning is directionally interesting because automated security operations remains a credible but difficult category, and CyberKord is trying to reduce the operational risk of automation by testing fixes against a digital representation of systems and dependencies before execution [Tech.eu, November 2026] [Vestbee, November 2026].
On team quality, the public record is still thin, which is normal at pre-seed, but the founder set is at least consistently identified across independent sources, and Alessandro Maggio is listed as founder and CEO, with CB Insights also attributing prior work history at Lilly and Ferrari [LinkedIn, Unknown] [CB Insights] [Tech.eu, November 2026]. Funding is clearer than operating traction: CyberKord disclosed a €2.7 million pre-seed in November 2026, reported as roughly $2.9 eu, November 2026] [Startupbusiness.it, November 2026].
Over the next 12 to 18 months, the central questions are whether the company can convert planned pilots with large European companies in manufacturing, technology, healthcare, and telecommunications into named deployments, and whether it can show that simulation-led remediation produces measurable operational gains without creating new control risks [Tech.eu, November 2026] [The SaaS News, November 2026] [CyberKord]. At this stage, the opportunity looks real, but the evidence base is still weighted toward product vision and funding news rather than customer proof, so investors should watch for referenceable pilots, clearer buyer ownership, and any independent validation of results.
Single-source, plausible -- Core funding and founding facts are corroborated by Tech.eu and Startupbusiness.it, while several product details rely on company materials or single-source coverage.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Pre-Seed |
| Business Model | SaaS |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Geography | Western Europe |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (3+) |
| Funding | Pre-seed, total disclosed about $2.9 million [Tech.eu, November 2026] |
The Company in Brief
PUBLIC
CyberKord entered the public record in 2026 as a Milan-based company focused on automating IT and cybersecurity operations through an AI software platform [CyberKord] [Tech.eu, November 2026]. The plain-language description is consistent across the limited source base: the company presents itself as an intelligence layer connected to existing systems, while external coverage adds the digital-twin framing as the distinctive mechanism for testing remediation before production changes are made [CyberKord] [Tech.eu, November 2026].
The founding team publicly associated with the company is Alessandro Maggio, Dragos Tanasa, and Cosimo Michelagnoli [Tech.eu, November 2026] [LinkedIn, retrieved 2026]. On timeline, the first clear milestone in the available record is the November 2026 pre-seed announcement, when Tech.eu reported a €2.7 million round led by 360 Capital with participation from Plus Partners, Addendum Capital, and Vento [Tech.eu, November 2026]. The company website also confirms the operating name CyberKord and presents the initial product position around automated alert response with simulation and logging before action [CyberKord].
Legal entity details beyond the website reference to CyberKord S.r.l. in its privacy policy are not established in the cited materials here [CyberKord]. That leaves the current public picture fairly early and narrow: a newly founded Milan security software startup, three named co-founders, one disclosed pre-seed financing event, and a product thesis centered on safer automation of incident response inside existing enterprise environments [CyberKord] [Tech.eu, November 2026] [LinkedIn, retrieved 2026].
Single-source, plausible -- Confirmed primarily by the company website, privacy policy, and Tech.eu, with partial corroboration from LinkedIn on the founding team.
What They Have Built
Mixed sourcing
CyberKord is positioning the product around a narrow but consequential promise: not simply surfacing alerts, but taking an incident from detection through investigation to a proposed or executed fix inside the customer’s existing environment [CyberKord] [Vestbee, November 2026]. The public description is consistent across company and press materials on two points. First, the platform is presented as an intelligence layer that connects to the current technology stack and correlates signals across systems, rather than replacing those systems outright [CyberKord]. Second, external coverage says the product is meant to reduce manual work in IT and security operations by identifying, investigating, and resolving issues with less human intervention [Tech.eu, November 2026] [Vestbee, November 2026].
The more differentiated claim is the digital twin. Tech.eu and other coverage describe CyberKord’s wedge as a digital representation of a company’s IT infrastructure that can be used to test remediation before changes are pushed into production, which is a more specific operating model than generic security automation [Tech.eu, November 2026] [startupitalia.eu]. On the company side, CyberKord says it answers alerts "at machine speed" and that every action is simulated first and logged, while a LinkedIn description from an ecosystem observer similarly characterizes the workflow as starting from an alert, ticket, or Slack or Teams message, identifying the cause, simulating the fix, and then applying it with the tools already in place [CyberKord] [LinkedIn, retrieved 2026]. Taken together, the public evidence supports a thesis that CyberKord is building an automation and orchestration layer with a safety mechanism, but the sources do not yet establish proof of production performance, breadth of integrations, or a verified customer deployment base [Tech.eu, November 2026] [Vestbee, November 2026].
Single-source, plausible -- Product positioning is corroborated across company materials and independent coverage, but several capability claims remain company-described and no verified public demo or deployment evidence was identified.
Market Size and Demand
PUBLIC
The market matters now because CyberKord is trying to sell into two budgets that are already large and still moving upward, enterprise cybersecurity and IT operations automation, but its specific wedge sits in the overlap rather than in a clean standalone category [Tech.eu, November 2026] [Vestbee, November 2026].
Public evidence does not support a direct TAM, SAM, or SOM for CyberKord itself, so the cleanest way to frame the opportunity is through analogous markets rather than pretend category precision. The company is described as automating detection, investigation, and remediation across IT and security workflows, with a digital twin used to test actions before production changes are made [Tech.eu, November 2026] [Startupbusiness.it, November 2026] [CyberKord]. That places it adjacent to security operations platforms, incident response and SOAR tooling, AIOps, and broader IT operations management, with budget ownership likely split across security, infrastructure, and platform teams depending on deployment scope [Tech.eu, November 2026] [Vestbee, November 2026].
The immediate demand signal in the public record is not a quantified market study but the problem definition repeated across sources: too many alerts, too much manual triage, and too much operational risk in pushing fixes directly into production systems [CyberKord] [Vestbee, November 2026]. CyberKord's thesis, according to company materials and fundraising coverage, is that buyers want more automation but remain cautious about autonomous action unless it is observable, simulated, and constrained by existing systems of record [CyberKord] [Tech.eu, November 2026]. That is a credible tailwind for any vendor promising faster response without asking enterprises to rip out their current stack [CyberKord] [Data Research Analysis].
The adjacent markets matter because CyberKord is unlikely to be purchased as a brand new line item at first. The product is presented as an intelligence layer that connects to existing tools, reads from current sources, and correlates signals across systems rather than replacing core infrastructure outright [CyberKord] [Data Research Analysis]. In practice, that suggests the nearer-term budget conversation may come from security orchestration, incident management, observability, and IT service workflows, especially in large enterprises where change management and auditability are material buying criteria [Tech.eu, November 2026] [Riccardo Murgia - NTT DATA | LinkedIn, retrieved 2026].
Regulation and macro conditions should help the pitch, even if the public sources stop short of naming statutes. European enterprises are operating under steadily tighter expectations around resilience, accountability, and documentation in both cyber and IT operations, which favors products that can log actions and reduce human latency in incident handling [CyberKord] [Vestbee, November 2026]. At the same time, cost pressure on technical teams tends to support automation narratives, but the same environment also raises the proof bar: vendors need to show that automated remediation is safer, not merely faster [Tech.eu, November 2026] [Startupbusiness.it, November 2026].
| Market lens | Relevance to CyberKord | Public support |
|---|---|---|
| Security operations automation | Core fit, since the platform is described as identifying, investigating, and resolving cybersecurity issues with less manual intervention | [Vestbee, November 2026] [Tech.eu, November 2026] |
| IT operations automation | Core fit, since the company also frames the product around IT incident handling and cross-system remediation | [Tech.eu, November 2026] [CyberKord] |
| Digital twin for infrastructure operations | Differentiation angle, because remediation is tested before production changes are made | [Tech.eu, November 2026] [Startupbusiness.it, November 2026] |
| Incident management and service workflows | Substitute or entry budget, because alerts, tickets, Slack, and Teams are described as workflow triggers | [Riccardo Murgia - NTT DATA |
The table makes the central point: this is a cross-budget product looking for an initial beachhead, not a neatly bounded software category. That can expand addressable spend if the product works, but it usually lengthens category education and makes early positioning discipline more important.
Single-source, plausible -- Based mainly on named-publisher funding coverage and company materials; no direct third-party TAM/SAM/SOM report was identified for CyberKord's exact category.
Who Else Is Fighting for This
MIXED CyberKord is positioning itself less as another alerting tool and more as an orchestration layer for incident investigation and remediation, with the differentiator resting on a digital twin of enterprise IT infrastructure rather than on a standalone detection engine [Tech.eu, November 2026] [CyberKord].
The nearest competitive frame is therefore segment-based, not company-by-company, because the public source set does not name direct rivals. Incumbents in security operations and IT operations still matter here as the default alternative: large enterprises already run established monitoring, ticketing, endpoint, and SIEM stacks, and CyberKord itself says its product connects to existing tools rather than replacing them wholesale [CyberKord] [Tech.eu, November 2026]. That implies competition first against the status quo of stitched-together workflows and internal operator playbooks, second against broader automation platforms that sit on top of existing systems, and third against adjacent substitutes such as managed security or managed IT response models, which solve the labor problem through services rather than software [CyberKord] [Vestbee, November 2026].
The edge that appears clearest in public material is conceptual rather than commercial. Multiple sources converge on the same wedge: CyberKord combines cross-system signal correlation with a digital representation of infrastructure, and uses that model to simulate remediation before applying changes in production [Tech.eu, November 2026] [Startupbusiness.it, November 2026] [CyberKord]. If that architecture works in practice, the value proposition is not just faster response but safer automation, which is a more durable claim in enterprise environments where false steps in remediation can create downtime or compliance issues. The durability of that edge is still uncertain, though, because the current evidence is product-description heavy and does not yet show named customers, reference deployments, or proprietary data advantages that would make the positioning hard to replicate [Tech.eu, November 2026] [The SaaS News, November 2026].
The exposure is equally clear. CyberKord does not appear to own a proprietary distribution channel, an installed endpoint footprint, or a disclosed customer base, which leaves it dependent on persuading buyers to trust a young vendor with increasingly autonomous operational actions [Tech.eu, November 2026] [Vestbee, November 2026]. That is a high bar in security and IT operations. The category can reward better workflows, but it often rewards incumbency, integrations, and proof of reliability even more. The absence of named competitors in the source set does not make the field empty, it simply means the company is entering a broad control plane layer where enterprises may compare it against whatever stack they already run, plus service providers that offer human-led incident handling.
Over the next 18 months, the most plausible competitive scenario is that buyer evaluation narrows around one question: whether simulation-backed remediation is materially safer than manual or rules-based automation in live environments. CyberKord is the most plausible winner if it can turn the digital-twin claim into referenceable pilot outcomes in the sectors already cited, manufacturing, technology, healthcare, and telecommunications [Tech.eu, November 2026] [The SaaS News, November 2026]. The loser if that proof does not arrive is likely to be the standalone automation narrative itself, because without visible deployment evidence the product risks being treated as an interesting layer on top of existing tools rather than a control point budget holders need to standardize on [CyberKord] [Vestbee, November 2026].
Single-source, plausible -- Section rests on corroborated public reporting for CyberKord's positioning and funding, but direct named competitors are absent from the source set and competitive mapping is therefore analytical rather than company-specific.
Opportunity
PUBLIC
The prize here is large if CyberKord can turn early interest in automated incident response into a trusted control layer for enterprise IT and security operations, because the budget pools it touches are both large and persistent, and the company is positioning itself at the decision point between alert, diagnosis, and remediation rather than at the edge of the stack [Tech.eu, November 2026] [Vestbee, November 2026].
The headline opportunity is not simply selling another security tool. It is becoming the operating layer enterprises use to investigate and resolve incidents across fragmented infrastructure, with the digital twin acting as the trust mechanism that makes automation acceptable in production environments [Tech.eu, November 2026] [Startupbusiness.it, November 2026] [CyberKord]. That outcome is still early and unproven, but it is reachable rather than purely aspirational for one reason: the company is framing the product around simulated remediation before execution, which addresses a real adoption barrier in both security operations and IT operations, namely that teams hesitate to let software take action without confidence in side effects [CyberKord] [Vestbee, November 2026]. The fact pattern is thin on deployments, but the initial target of large European companies in manufacturing, technology, healthcare, and telecommunications suggests CyberKord is aiming at complex environments where cross-system automation can carry high economic value if it works reliably [Tech.eu, November 2026] [The SaaS News, November 2026].
There are a few credible paths from that starting point to outsized scale.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| Digital twin becomes the trust wedge | CyberKord wins initial pilots by proving that remediation can be simulated and logged before execution, then expands from alert handling into broader IT and security workflows | Early pilot conversions in large European enterprises, especially in regulated or operationally complex sectors [Tech.eu, November 2026] | The product is already described around simulation, verification, and reduced manual intervention, which aligns with the buying objection most automation vendors face [CyberKord] [Vestbee, November 2026] |
| Cross-stack control layer for enterprise operations | The company becomes a system-of-action sitting above existing tools, connecting signals across the stack rather than replacing incumbent vendors | Successful integrations with customers' existing technology stacks and visible operational gains from correlation across systems [CyberKord] [Tech.eu, November 2026] | CyberKord describes itself as an intelligence layer that connects to existing systems, which is a more adoptable entry point than rip-and-replace infrastructure [CyberKord] [Startupbusiness.it, November 2026] |
| European AI-native security platform | CyberKord uses its Milan base and investor backing to become a regional champion for AI-led IT and cybersecurity operations, especially where enterprises prefer European vendors and local engagement | Execution on pilots and team build-out funded by the pre-seed round led by 360 Capital [Tech.eu, November 2026] [Vestbee, November 2026] | The company has already assembled a known European syndicate and publicly stated plans to fund platform development and initial pilots with large European companies [Tech.eu, November 2026] [Startupbusiness.it, November 2026] |
The compounding logic is straightforward, even if there is not yet public evidence that it has started at scale. If CyberKord can ingest alerts, tickets, and collaboration messages, then correlate signals across the existing stack and simulate fixes before execution, each new deployment should improve the playbook library and increase customer trust in automation over time [Riccardo Murgia - NTT DATA | LinkedIn, retrieved 2026] [CyberKord] [Tech.eu, November 2026]. That matters because trust is the gating factor in this category. Logged, verifiable actions and pre-execution simulation create an audit trail that can make expansion from one workflow to many more plausible inside the same account, especially in large enterprises where the cost of manual incident handling is structurally high [CyberKord] [Riccardo Murgia - NTT DATA | LinkedIn, retrieved 2026]. The distribution advantage, if it emerges, is that a vendor embedded as the intelligence layer above multiple existing systems can become harder to displace than a point solution attached to only one workflow [CyberKord] [Startupbusiness.it, November 2026].
The size of the win cannot be pinned to a public revenue base yet, so any valuation framing has to stay conditional. Still, if scenario one or two plays out and CyberKord becomes an adopted automation layer across enterprise security and IT operations, the company would be competing for part of a category where strategic value tends to accrue to platforms that sit close to workflow execution rather than pure monitoring. The only public financing data point today is the November 2026 pre-seed of €2.7 million, reported as about $2.9 million, led by 360 Capital with participation from Plus Partners, Addendum Capital, and Vento [Tech.eu, November 2026]. That is seed-stage evidence, not scale evidence. But if the product proves capable of safe automated remediation across large enterprises, the upside could support a venture-scale outcome measured in the high hundreds of millions or more in enterprise value (scenario, not a forecast), because the company is aiming at recurring software budgets across multiple operational domains rather than a narrow single-use product [Tech.eu, November 2026] [Vestbee, November 2026] [CyberKord].
Single-source, plausible -- This section relies on one independently reported funding event and multiple partially corroborated product descriptions from Tech.eu, Vestbee, Startupbusiness.it, The SaaS News, and the company website; no public customer, revenue, or deployment metrics were confirmed.
Sources
From the public record
[Tech.eu, November 2026] CyberKord raises €2.7M to automate IT and cybersecurity operations with AI | https://tech.eu/2026/11/03/cyberkord-raises-eur27m-to-automate-it-and-cybersecurity-operations-with-ai/
[Startupbusiness.it, November 2026] CyberKord secures €2.7 million for AI applied to IT and cybersecurity | https://www.startupbusiness.it/en/cyberkord-27-milioni-di-euro-per-ia-applicata-a-it-e-cybersecurity/211394/
[Vestbee, November 2026] CyberKord lands €2.7M to automate IT and cybersecurity operations with AI | https://www.vestbee.com/insights/articles/cyber-kord-lands-2-7-m
[LinkedIn, retrieved 2026] Guido Galletti - iliad | LinkedIn | https://www.linkedin.com/in/guido-galletti-1a9765b0/
[CyberKord] Cybersecurity, business aware. | https://www.cyberkord.com/
[LinkedIn] Alessandro Maggio - Dublin, County Dublin, Ireland | Professional Profile | LinkedIn | https://www.linkedin.com/in/maggioalessandro/
[The SaaS News, November 2026] CyberKord raises €2.7M Pre-seed | https://www.thesaasnews.com/news/cyberkord-raises-2-7m-pre-seed/
[LinkedIn, retrieved 2026] Riccardo Murgia - NTT DATA | LinkedIn | https://www.linkedin.com/in/riccardomurgia/
Articles about CyberKord
- CyberKord's Digital Twin Is Simulating Cybersecurity Fixes Before They Go Live — The Milan startup raised €2.7 million from 360 Capital to automate incident resolution, starting with pilots in manufacturing and healthcare.