Daylight
AI-native managed detection and response (MDR) platform for cyberattack detection and containment.
Website: https://daylight.ai/
Cover Block
PUBLIC
| Field | Value |
|---|---|
| Name | Daylight |
| Tagline | AI-native managed detection and response (MDR) platform for cyberattack detection and containment [Calcalist Tech, November 2025] |
| Headquarters | Tel Aviv-Yafo, Israel [Crunchbase] |
| Founded | 2025 [Calcalist Tech, November 2026] |
| Stage | Series B [Goldman Sachs Alternatives, November 2026] |
| Business Model | SaaS |
| Industry | Security |
| Technology | AI / Machine Learning |
| Geography | Middle East / North Africa |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2), Hagai Shapira and Eldad Rudich [Goldman Sachs Alternatives, November 2026] |
| Funding Label | $100M+ |
| Total Disclosed Funding | ~$120,000,000 [Goldman Sachs Alternatives, November 2026] |
Links
Public sources
- Website: https://daylight.ai/
Executive Summary
Public sources Daylight is an AI-native managed detection and response company that pairs AI agents with human analysts to detect, investigate, and contain cyberattacks, and it merits attention because it has moved from founding to a $120 million disclosed funding total in roughly two years while positioning itself in a security category that enterprises are actively retooling for AI-era workflows [Calcalist Tech, November 2025] [Goldman Sachs Alternatives, November 2026] [SecurityWeek, November 2026]. Founded in 2025 by Hagai Shapira and Eldad Rudich, the company emerged from an Israeli cyber lineage that investors tend to recognize quickly: both founders previously worked at Torq, and Goldman Sachs Alternatives said they first met in Israel’s Unit 8200 [Goldman Sachs Alternatives, November 2026] [Business Insider, November 2025].
The product thesis is straightforward but commercially relevant: Daylight sells MDR as a managed service, but wraps that service around agentic workflows, a security data lake, and an investigation interface called Aura, which reported coverage says lets customers query their environments in natural language while Daylight’s team steps in on higher-risk cases [SecurityWeek, November 2026] [SiliconANGLE, November 2026] [Crunchbase]. That positioning matters because the differentiation appears to rest less on a standalone model claim and more on operationalizing AI inside the security operations workflow, with flexible delivery spanning fully managed and co-managed use cases according to SecurityWeek [SecurityWeek, November 2026].
The team fits the product ambition. Shapira was described as an early product leader at Torq, while Rudich was Torq’s first employee and later its vice president of research and development, giving Daylight a founding bench with direct exposure to enterprise security operations and workflow automation rather than a purely research-led profile [Goldman Sachs Alternatives, November 2026].
On capitalization, the public record is unusually full for a young company: Axios reported a $7 million seed in July 2025 led by Bain Capital Ventures, Business Insider and Calcalist Tech reported a $33 million Series A in November 2025 led by Craft Ventures, and Goldman Sachs Alternatives announced an $80 million Series B in November 2026, bringing disclosed funding to $120 million [Axios, July 2025] [Business Insider, November 2025] [Calcalist Tech, November 2025] [Goldman Sachs Alternatives, November 2026]. The model is SaaS with managed security services layered into the offering, and reported customer names including LastPass, Miro, dLocal, Lovable, and Rogo suggest the company has at least some ability to land recognizable enterprise and growth-stage accounts, though public sources do not yet provide contract economics or retention data [Calcalist Tech, November 2026] [gptonline.ai].
Over the next 12 to 18 months, the central question is whether Daylight can convert fast product expansion and headline customer wins into repeatable enterprise scale, especially as it expands beyond Israel into the U.S., Europe, and additional regions with an 80-person team as of November 2026 [Calcalist Tech, November 2026] [MLQ.ai]. The public evidence supports a serious early signal, but the underwriting case still turns on metrics the company has not disclosed broadly, particularly deployment depth, renewal behavior, and the extent to which its agentic workflow translates into durable operating advantage rather than strong initial interest [SiliconANGLE, November 2026] [SecurityWeek, November 2026].
Lightly corroborated -- Built from named publisher reporting and company profile sources, with several product details and customer references relying on single-source or company-adjacent corroboration.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Series B |
| Business Model | SaaS |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Geography | Middle East / North Africa |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding | $100M+ total disclosed, approximately $120,000,000 |
How the Company Got Here
Public sources
Daylight presents as a very new security company rather than a rebranded incumbent, and the public record is still thin in the places investors usually want depth. Crunchbase lists Daylight Security as a cybersecurity company founded in 2025, headquartered in Tel Aviv-Yafo, Israel, with Hagai Shapira and Eldad Rudich as co-founders [Crunchbase]. The company website describes Daylight as an AI-native managed detection and response platform focused on cyberattack detection and containment [daylight.ai].
The early chronology is clearer than the corporate detail. Crunchbase identifies the company as venture-backed software infrastructure in security, and its profile attributes managed detection and response, threat hunting, phishing protection, data loss prevention, managed SIEM, and security data lake services to the business [Crunchbase]. The website adds that Daylight sells managed security services and positions its platform around AI agents working with human analysts, which is consistent with the category framing visible across the company’s public materials [daylight.ai].
On legal entity specifics, the available company-profile sources used for this section do not establish a formal registered entity name beyond the operating brand reflected on Crunchbase and the website [Crunchbase] [daylight.ai]. That leaves the public picture straightforward but still early: an Israel-headquartered security startup founded in 2025, built around AI-assisted security operations, with a category footprint that is already broader than basic MDR in its own product taxonomy [Crunchbase] [daylight.ai].
Company-stated, unverified -- This section relies on Crunchbase and the company website, with company-profile and company-authored materials carrying the core factual load.
Product and Technology
MIXED Product surface and operating model
Daylight is presented as an AI-native managed detection and response platform built to detect, investigate, and contain cyberattacks with AI agents working alongside human security analysts [Calcalist Tech, November 2025]. Public product descriptions are reasonably consistent on that core point, even when the surrounding language varies by source. Press coverage and profile data describe a service set that includes MDR, threat hunting, phishing protection, data loss prevention, managed SIEM, and a security data lake, while SecurityWeek reports that customers can buy the service in fully managed, co-managed, or forward-deployed-engineer supported formats [Crunchbase] [SecurityWeek, November 2026].
The more specific workflow claims suggest Daylight is trying to sell outcomes rather than a monitoring console. SecurityWeek reports that the platform continuously builds, runs, and customizes agents around a customer’s workflows, risks, and priorities, while cybercompanyprofiles.com says the MDR service covers detection through response, with human experts stepping in for complex or higher-risk cases [SecurityWeek, November 2026] [cybercompanyprofiles.com]. That is a credible architecture for a modern MDR offering, but the evidence remains mostly descriptive rather than demonstrated in public benchmarks or third-party technical validations.
MIXED Data layer, interfaces, and integrations
The most concrete product detail in public reporting is the Aura interface. SiliconANGLE and SecurityWeek both report that customers can use Aura to investigate their environments in natural language, search a centralized security data lake, and manage security operations, which implies Daylight is positioning its interface as an analyst workflow layer rather than only a back-end managed service [SiliconANGLE, November 2026] [SecurityWeek, November 2026]. A separate profile says the data lake keeps the most recent 90 days searchable and moves older telemetry to archival storage that can be rehydrated on demand, with support for plain-English queries and KQL, though that detail appears in a single secondary source and should be treated more cautiously [cybercompanyprofiles.com].
Daylight has also publicly attached itself to the emerging MCP ecosystem. Company-linked materials and secondary coverage say an MCP server announced in June 2026 allows AI assistants such as Claude, Cursor, and VS Code Copilot to pull investigation context through Daylight APIs, and Descope states that MCP client registration, RBAC inheritance, and token lifecycle management for Daylight’s MCP server are powered by its identity stack [cybercompanyprofiles.com] [Descope]. Markets Insider separately reported that Daylight expanded MDR capabilities into Claude Enterprise in February 2026, which supports the broader thesis that the company is building around agent-mediated security operations rather than a conventional alert triage product [Markets Insider, February 2026].
Lightly corroborated -- Core platform positioning is corroborated by Calcalist Tech, SecurityWeek, and SiliconANGLE, but several feature-level details rely on company materials or single-source secondary profiles.
Where the Demand Sits
PUBLIC
The market matters now because enterprises are trying to absorb a rising volume of security work without scaling security operations headcount at the same pace, and Daylight is positioned squarely against that constraint rather than against a narrow point problem [SiliconANGLE, November 2026] [Calcalist Tech, November 2025].
The public record here is thinner on formal market sizing than on product and fundraising, so the cleanest approach is to treat Daylight as participating in an analogous set of public markets: managed detection and response, broader security operations, and AI-enabled security tooling. None of the captured sources provides a named third-party TAM, SAM, or SOM for Daylight specifically, and no public source in this record quantifies its target slice with enough precision to reproduce a bottoms-up model. What the evidence does show is category intent: Daylight is described as an AI-native managed detection and response platform that helps companies detect, investigate, and contain cyberattacks using AI agents alongside human analysts, which places it in the operating path between SIEM spend, managed security services spend, and newer AI security budgets [Calcalist Tech, November 2025] [SecurityWeek, November 2026].
Demand appears to be coming from both workload pressure and architectural change. Daylight's own category framing, as reported by independent outlets, centers on using AI agents to take on increasingly complex security work, while still escalating complex or high-risk cases to human experts [SiliconANGLE, November 2026] [Jewish News, November 2026] [cybercompanyprofiles.com]. That matters because MDR historically sold on staffing relief and response speed; the newer pitch adds investigation automation, natural-language access to telemetry, and service flexibility across fully managed and co-managed models [SecurityWeek, November 2026] [SiliconANGLE, November 2026]. In practice, that widens the addressable buyer set beyond teams replacing an incumbent MDR vendor to include organizations that are rethinking SIEM economics, analyst productivity, and internal SOC design [SecurityWeek, November 2026] [Crunchbase].
The adjacent markets are visible in Daylight's product surface. Public descriptions tie the company not only to MDR, but also to threat hunting, phishing protection, data loss prevention, managed SIEM, and a security data lake positioned as an alternative or complement to SIEM tooling [Crunchbase] [daylight.ai] [cybercompanyprofiles.com]. That suggests Daylight is selling into a bundle of budgets that many enterprises still source separately: telemetry storage and search, managed response, analyst tooling, and specialized protections for phishing or data leakage. The inclusion of an MCP server that exposes investigation context to enterprise AI assistants such as Claude, Cursor, and VS Code Copilot also links Daylight to the early market for AI application governance and AI-native security operations interfaces, though public evidence here is still product-level rather than revenue-level [cybercompanyprofiles.com] [Descope] [Markets Insider, February 2026].
Macro and regulatory forces are supportive, even if the source set does not tie Daylight to any single compliance regime. The broad pressure is straightforward: enterprises face a higher threat surface as employees and developers adopt AI tools, while boards still expect measurable containment and response outcomes [Markets Insider, February 2026] [Goldman Sachs Alternatives, November 2026]. At the same time, customers are being pushed toward better telemetry retention, faster incident investigation, and clearer access control around AI-connected systems, all of which align with Daylight's emphasis on centralized security data, natural-language investigation, and role-based controls around its MCP server [cybercompanyprofiles.com] [Descope]. That does not prove a category winner, but it does support the view that budget lines around MDR and adjacent security operations are being refreshed rather than frozen.
| Market lens | What the sources support | Why it matters for Daylight |
|---|---|---|
| Core category | AI-native managed detection and response platform [Calcalist Tech, November 2025] [Jewish News, November 2026] | Places the company inside an established enterprise security budget, not a net-new experimental line item. |
| Adjacent budget 1 | Managed SIEM and security data lake [daylight.ai] [Crunchbase] [cybercompanyprofiles.com] | Expands the pitch from outsourced monitoring to telemetry management and investigation workflows. |
| Adjacent budget 2 | Threat hunting, phishing protection, and DLP services [daylight.ai] [Crunchbase] | Suggests cross-sell potential if customers prefer a consolidated managed security stack. |
| Emerging adjacency | AI assistant and MCP-based investigation workflows [Markets Insider, February 2026] [cybercompanyprofiles.com] [Descope] | Creates exposure to enterprise spending on AI governance and AI-enabled analyst productivity. |
The table points to a market that is broader than classic MDR alone. The commercial implication is that Daylight may not need a single large TAM narrative to matter; if buyers are already revisiting SIEM, managed response, and AI-security workflows together, a multi-surface vendor can expand contract scope within an existing security budget envelope.
Lightly corroborated -- This section relies on independent reporting from Calcalist Tech, SecurityWeek, SiliconANGLE, Jewish News, Goldman Sachs Alternatives, and Markets Insider for category positioning and demand drivers, but it does not have a named third-party market-sizing report for TAM, SAM, or SOM in the captured source set.
Competitive Landscape
Competitive Landscape
MIXED Daylight is positioning itself between traditional managed security providers and software-first security operations vendors, with the bet that AI agents plus human analysts can deliver SOC outcomes faster than labor-heavy MDR and with less customer burden than tool-centric platforms [Calcalist Tech, November 2025] [SecurityWeek, November 2026].
The competitive map is easier to describe by category than by a clean list of direct peers, because the available public sources do not name Daylight's competitors directly. At one end sit incumbent MDR and managed security providers, which compete on service depth, analyst coverage, and enterprise trust, but often carry a heavier human-delivery model than Daylight's public pitch of agent-assisted operations [Jewish News, November 2026] [SecurityWeek, November 2026]. At the other end sit software-led security operations and SIEM vendors, which give customers tooling and telemetry control, but generally require more in-house security capacity unless paired with managed services. Daylight's own product language reflects that middle ground: MDR, threat hunting, phishing protection, data loss prevention, managed SIEM, and a security data lake, all wrapped into a managed service model that can be fully managed, co-managed, or supported by forward-deployed engineers [Crunchbase] [SecurityWeek, November 2026] [daylight.ai].
The clearest edge visible today is team quality and category fit rather than a demonstrated moat in distribution. Hagai Shapira previously held a product leadership role at Torq, and Eldad Rudich was Torq's first employee and later vice president of R&D, which suggests the founders know enterprise security workflows and automation pain points at close range [Goldman Sachs Alternatives, November 2026]. That matters in a category where customers buy operational reliability before they buy architectural elegance. The investor roster also helps with credibility, with Craft Ventures, Bain Capital Ventures, Goldman Sachs Alternatives, Okta Ventures, and several well-known Israeli cyber founders appearing across disclosed rounds, but capital and brand are usually perishable advantages unless they convert into repeatable enterprise distribution or product data loops [Business Insider, November 2025] [Goldman Sachs Alternatives, November 2026].
The exposure is just as clear. Public evidence shows named customers and a broadening product surface, but it does not yet show a channel Daylight owns, a regulatory barrier competitors cannot cross, or a proprietary data asset that would obviously compound beyond standard operating telemetry [Calcalist Tech, November 2026] [SecurityWeek, November 2026]. The company is also entering a part of cybersecurity where buyers can substitute across categories: a large enterprise can choose an incumbent MDR provider, expand an existing SIEM deployment with managed services, or push more work to internal teams using security automation platforms. Daylight's inclusion of managed SIEM and a security data lake may widen its addressable surface, but it also places the company closer to entrenched platforms with longer procurement histories and broader ecosystems [daylight.ai] [Crunchbase].
The most plausible 18-month scenario is a sorting of the market around who proves outcome quality at scale. Daylight is a potential winner if enterprise buyers continue shifting budget toward hybrid service-plus-software offerings that reduce alert handling and investigation time without forcing net-new SOC headcount, because its public narrative is already aligned with that demand [SiliconANGLE, November 2026] [SecurityWeek, November 2026]. A plausible loser if large buyers prefer consolidation is the standalone emerging MDR vendor that cannot extend into adjacent workflow, data, or platform layers. Daylight has at least signaled an attempt to avoid that trap through Aura, the security data lake, and MCP integrations, although the durability of that expansion remains unproven in public sources [SiliconANGLE, November 2026] [daylight.ai] [Descope].
Lightly corroborated -- Competitive positioning is drawn from public company materials and third-party coverage, but the available source set does not name direct competitors or provide independent market-share comparisons.
Opportunity
Upside Case
PUBLIC The prize here is not a better alert triage tool, it is a chance to become a system of record for AI-assisted security operations at a moment when enterprises are rethinking whether the traditional SOC stack should still be assembled product by product.
The headline opportunity is straightforward. If Daylight can turn managed detection and response into a software-led operating layer, rather than a labor-heavy service line, it could become a category-defining security operations platform for enterprises that want outcomes without staffing a larger in-house SOC [Calcalist Tech, November 2025] [SecurityWeek, November 2026]. That outcome looks reachable, not merely aspirational, because the public record already shows three ingredients that usually appear early in durable security winners: founders with relevant operating history at Torq, a product that spans detection, investigation, response, and data infrastructure, and enough early demand to support $120 million in disclosed funding within roughly two years of founding [Goldman Sachs Alternatives, November 2026] [SecurityWeek, November 2026] [Crunchbase, retrieved 2026].
The immediate question is which path gets it there. The scenarios below are not forecasts. They are bounded upside cases built from the company’s disclosed product surface, customer references, and financing history.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| Fortune 500 SOC replacement layer | Daylight starts as MDR, then expands into managed SIEM and its Security Data Lake, displacing parts of legacy security operations tooling inside large accounts | The disclosed Security Data Lake, Managed SIEM positioning, and Aura interface give customers a path from service adoption to platform consolidation [Crunchbase, retrieved 2026] [SecurityWeek, November 2026] [SiliconANGLE, November 2026] | Named customers reportedly include Miro, LastPass, dLocal, Lovable, and Rogo, alongside Fortune 500 enterprises, which suggests Daylight is already selling into organizations that can expand spend if the product proves reliable [Calcalist Tech, November 2026] |
| Agentic security control plane | Daylight becomes the operating layer through which analysts and AI assistants investigate environments, run workflows, and access context across telemetry sources | The June 2026 MCP server launch and Aura’s natural-language investigation model could make Daylight the interface, not just the service provider [SecurityWeek, November 2026] [cybercompanyprofiles.com, retrieved 2026] [Descope, retrieved 2026] | The company has publicly positioned AI agents at the center of its operating model, and reported use with enterprise customers including Miro gives some evidence that this is already beyond prototype stage [Calcalist Tech, November 2025] [gptonline.ai, retrieved 2026] |
| Cross-border managed security platform | Daylight uses fresh capital to move from an Israel-centered buildout into a broader enterprise footprint across the U.S., Europe, and parts of the Middle East and Africa | Series B proceeds were reportedly earmarked for U.S. expansion and entry into Europe, the Middle East, and Africa [Calcalist Tech, November 2026] [MLQ.ai, retrieved 2026] | The company had 80 employees by November 2026 and a backer group that includes Goldman Sachs Alternatives, Craft Ventures, Bain Capital, and Okta Ventures, which can help with enterprise access and recruiting density even if they do not guarantee distribution [Goldman Sachs Alternatives, November 2026] [Calcalist Tech, November 2026] |
What compounding would look like is visible in the product architecture. A managed service that also owns the data lake, investigation interface, and agent layer can learn from every analyst workflow and every customer environment, then package that learning into faster investigations, broader automations, and a stickier product surface over time [SecurityWeek, November 2026] [cybercompanyprofiles.com, retrieved 2026]. If customers begin with MDR, then add threat hunting, phishing protection, DLP, managed SIEM, or the data lake, Daylight’s role inside the security stack becomes harder to dislodge because it sits closer to both response workflows and historical telemetry [Crunchbase, retrieved 2026] [daylight.ai, retrieved 2026].
There is also a distribution compounding effect if the MCP server gains real adoption. Once enterprise security teams or their internal AI assistants use Daylight as the gateway for investigation context, the company is no longer selling only outsourced detection and response, it is selling workflow gravity [cybercompanyprofiles.com, retrieved 2026] [Descope, retrieved 2026]. That matters because control points in security often accrue spend in adjacent categories faster than point tools do, particularly when the buyer already trusts the vendor in incident conditions [SecurityWeek, November 2026].
The size of the win is hard to pin down from public data because no market sizing figure is confirmed in the source set. Still, a concrete ceiling case can be framed from public comparables in adjacent enterprise security categories: if Daylight became a scaled, multi-product security operations platform with meaningful Fortune 500 penetration, the relevant outcome is not a niche services multiple but the valuation band typically reserved for strategic security infrastructure assets, potentially into the multi-billion-dollar range (scenario, not a forecast). The evidence that supports even discussing that class of outcome is early but real: rapid successive financings, enterprise customer references, and a product stack that extends beyond MDR into data, workflow, and agent orchestration [Axios, July 2025] [Business Insider, November 2025] [Goldman Sachs Alternatives, November 2026] [SecurityWeek, November 2026]. The burden from here is execution, especially proving that the platform layer, not just the service wrapper, is what customers are buying.
Lightly corroborated -- Built primarily from named press coverage, company materials, and database profiles. Several product-surface details rely on company or profile sources rather than independent technical validation.
Sources
Public sources
[Calcalist Tech, November 2025] Cyber startup Daylight raises $33 million just three months after founding | https://www.calcalistech.com/ctechnews/article/bjgfwuwk11e
[Goldman Sachs Alternatives, November 2026] As AI Threats Surge, Daylight Raises $80M Led by Goldman Sachs Alternatives | https://am.gs.com/en-gb/advisors/news/press-release/2026/daylight-series-b-investment-goldman-sachs-alternatives
[SecurityWeek, November 2026] Daylight Lands $80 Million for AI-Powered Security Operations | https://www.securityweek.com/daylight-lands-80-million-for-ai-powered-security-operations/
[Business Insider, November 2025] Israeli Cybersecurity Startup Got a $33 Million Term Sheet From Craft | https://www.businessinsider.com/cybersecurity-startup-got-a-33-million-term-sheet-from-craft-2025-11
[Axios, July 2025] Exclusive: Daylight raises $7M seed led by Bain Capital Ventures | https://www.axios.com/pro/enterprise-software-deals/2025/07/22/daylight-security-7m-seed-bain-capital-ventures
[Crunchbase] Daylight Security - Crunchbase Company Profile & Funding | https://www.crunchbase.com/organization/daylight-security
[daylight.ai] Managed Security Services | Daylight | https://daylight.ai/
[SiliconANGLE, November 2026] AI-driven managed security startup Daylight raises $80M on 40-fold revenue growth | https://siliconangle.com/2026/11/10/ai-driven-managed-security-startup-daylight-raises-80m-on-40-fold-revenue-growth/
[Calcalist Tech, November 2026] Israeli cyber startup Daylight raises $80 million Series B | https://www.calcalistech.com/ctechnews/article/x8vrvo7dt
[MLQ.ai, retrieved 2026] Daylight raises $80M to scale AI-powered managed detection and response platform | https://www.mlq.ai/news/daylight-raises-80m-to-scale-ai-powered-managed-detection-and-response-platform/
[Jewish News, November 2026] Goldman Sachs leads 80m funding round for Israeli-founded cyber firm Daylight | https://www.jewishnews.co.uk/goldman-sachs-leads-80m-funding-round-for-israeli-founded-cyber-firm-daylight/
[Markets Insider, February 2026] Daylight Expands MDR Capabilities Into Claude Enterprise as AI Security Risks Become Enterprise Priority | https://markets.businessinsider.com/news/currencies/daylight-expands-mdr-capabilities-into-claude-enterprise-as-ai-security-risks-become-enterprise-priority-1036198135
[cybercompanyprofiles.com, retrieved 2026] Daylight Security company profile | https://cybercompanyprofiles.com/company/daylight-security/
[Descope, retrieved 2026] Securing the Daylight Security MCP Server with Descope | https://www.descope.com/blog/post/daylight-mcp-server
[gptonline.ai, retrieved 2026] Daylight Security company profile | https://gptonline.ai/daylight-security/
[PrivCo, retrieved 2026] Daylight, Security Inc. Company Profile: Financials, Valuation, and Growth | https://www.privco.com/company/daylight-security
Articles about Daylight
- Daylight's AI Agents Now Monitor Security for LastPass and Miro — The Israeli-founded startup, with $120 million in total funding, is pairing AI agents with human experts to manage detection and response for Fortune 500 companies.