The list. Dropzone AI made the 2026–2027 Fortune Cyber 60 in the early-stage group. It also made last year’s list. Fortune’s profile puts it in Seattle with 76 employees and founder-CEO Edward Wu, founded in 2023. Fortune reports $57 million in funding and lists Decibel, IQT, Carta, Theory Ventures and Pioneer Square Labs. Public rounds add up close to that: a $3.4 million seed in 2023 (per PitchBook), a $16.85 million Series A in 2024, and a $37 million Series B in July 2025 led by Theory, with Madrona, Decibel, Pioneer Square Labs and IQT. Valuation and revenue are Undisclosed. Lightspeed, which helps run the Cyber 60, is not listed as an investor.
The problem, in plain words. A security operations center, or SOC, gets more alerts than people can check. Most are harmless. A few are real. A tier-1 analyst’s day is opening each one, pulling logs from the endpoint, identity and email tools, and deciding: close it or escalate it. Wu spent eight years at ExtraHop, a network detection vendor, watching tools generate alerts nobody had time to resolve. Dropzone’s AI SOC Analyst does that triage. It gathers the evidence, forms a theory about whether the alert is bad, checks the theory, and writes up a report with its reasoning attached.
Why it is winning: no hidden humans. Wu’s line to CRN is blunt. Peel back the curtain at many AI SOC and AI MDR startups and you find software plus people. Dropzone says it uses no human labor to deliver the product; a small internal team only spot-checks quality. That sounds like a purity test. It is really a channel strategy. Managed security providers, or MSSPs, sell human expertise. They don’t want a vendor slipping another layer of humans into their margin. A software-only analyst lets them add clients without adding headcount. Dropzone leans in: its head of channel was named a 2026 CRN Channel Chief, and partners like CBTS run it inside their own MDR services.
The numbers it shares are company claims, not audits. Dropzone says 2025 ARR grew 11x, net revenue retention topped 370%, and it is now in production across more than 400 environments, including two Fortune 50 customers. On November 2, its AI SOC Analyst reached FedRAMP High (Class D) through Second Front’s Game Warden platform, building on a March partnership with Leidos. Each agency still has to authorize its own use. But federal buyers can now start from an existing package instead of from zero.
The one technical thing. Context Memory. Every SOC has knowledge that never shows up in the logs. This server is a build box. That contractor works from Paris. Emily is approved to run certutil.exe. Dropzone stores those facts about people, systems and apps, and pulls them in during each investigation. When an analyst overrules a verdict and explains why, the agent turns that note into a new fact. Teams can also load old runbooks and tickets from Confluence, Jira or ServiceNow. Dropzone’s own docs are candid about the limits: matching is by meaning, not exact text, so it can surface the wrong fact, and stale entries hurt. The rule it gives customers is facts, not logic. That design choice is the real product. The model is rented. The memory of your environment is what you can’t switch away from easily.
The CyberMerge view. AI SOC is crowded, and the platforms are coming. CrowdStrike, Palo Alto Networks, Google and Microsoft all ship agentic triage inside their own consoles. A standalone triage agent survives only if it is neutral across those stacks and sticky inside each customer. Dropzone has a plausible answer to both: it reads from whatever tools you already run, and the context it learns is yours, built up over time. The risk is that a big MDR provider decides to build the same thing in-house, or a platform bundles “good enough” triage for free.
Bottom line. Dropzone is not winning on model quality. It is winning on honesty about who does the work, and on a memory layer that gets better each time an analyst disagrees with it. In a market full of demos, that is a very sellable kind of boring.