Calcalist’s Meir Orbach reported Monday evening Israel time that CrowdStrike is in advanced negotiations to acquire Orion Security for roughly $500 million. Nothing is signed yet (Calcalist). CrowdStrike hasn’t announced anything, and neither company has confirmed the talks.
What Orion is. Founded in 2024 and based in Tel Aviv, Orion sells DLP without the policy rulebook. Specialized AI agents watch data move and score each event on content sensitivity, data lineage, user identity, intent and purpose. The aim is to block exfiltration before it happens rather than alert after a regex fires. Coverage spans endpoints, cloud, web, SaaS, email and MCP traffic (SecurityWeek). CEO Nitay Milner came from Epsagon, which Cisco bought. CTO Jonathan Kreiner ran application security at WalkMe. Headcount is about 20, split between Israel and New York (Calcalist).
The money. Orion raised a $6M seed in March 2025, then a $32M Series A in February 2026 led by Norwest, with IBM, PICO Venture Partners and Lama Partners participating. Total raised: $38M (Calcalist; SecurityWeek). At ~$500M, that’s about 13x capital raised, or roughly $25M per employee. Revenue: Undisclosed. Series A valuation: Undisclosed. This is a team-and-engine price, not a revenue multiple.
Why CrowdStrike would want it. In 2024 CrowdStrike bought Flow Security (Calcalist put it at $200–220M) to find and classify data across cloud and on-prem. That covers knowing where sensitive data lives. It doesn’t cover the harder part, deciding in real time whether a specific movement is a leak. That decision is where classic DLP drowns SOCs in false positives. Orion’s pitch is to make the decision from context instead of hand-written rules. The Falcon sensor is already on the endpoint, which is where most of that context gets collected. Put Orion’s reasoning on top of the sensor’s telemetry and you have a DLP product that doesn’t need a six-month policy project to switch on.
It also fits the run. CrowdStrike has kept buying in Israel: Bionic (~$350M, 2023), Flow (2024), Adaptive Shield (~$300M, Nov 2024) and Seraphic (~$400M, signed Jan 2026), all at Calcalist’s estimates (Calcalist). At ~$500M, Orion would be the biggest of the Israeli tuck-ins.
What we’d do if we ran security this week.
If you’re an Orion customer, pull the contract and read the change-of-control and data-processing terms now. Ask in writing whether a non-Falcon deployment stays supported and for how long.
If you’re on a legacy DLP suite, measure your weekly false-positive queue and the analyst hours behind it. That number is the business case every agentic-DLP vendor will put in front of you next quarter, CrowdStrike included.
And test the hard case either way: an AI agent or MCP tool pulling records out through an approved SaaS connector. Rule-based DLP mostly sees that as allowed traffic. Ask any vendor, Orion included, to show you a block on that path, not a slide.
The read. It’s a report, not a signing. Still, if it closes, the endpoint-plus-data bundle gets real, and every standalone DLP vendor gets a harder renewal conversation.