The list. Frontier Security made the 2026–2027 Fortune Cyber 60 in the early-stage group, in the same year it was founded. Fortune’s profile lists it in Menlo Park, Calif., with 25 employees. The CEO is Yaron Singer, a former Harvard computer science professor who founded Robust Intelligence, an AI security company Cisco bought. He has also been a VP at Splunk and Cisco Security, per his LinkedIn. That résumé is a big reason a months-old company is on this list.
The problem, in plain words. A detection rule is a piece of logic that fires an alert when something bad shows up in your logs. SOC teams write them by hand: research the technique, write the rule, test it, tune it, repeat. Frontier’s site cites Picus Security’s Blue Report 2026: attacks were logged 58% of the time but alerted on only 14%. In other words, the evidence was often sitting there and no rule caught it. Frontier also points to CVE volume rising 246% in a year, per NVD data. More bugs, faster exploits, same hand-built rules.
What Frontier sells. Frontier calls it detection posture management. Think of cloud posture tools that tell you which settings are wrong, but for your detection rules. Its platform reads the rules you already run, finds the gaps, and proposes fixes. It runs on its own models, which it brands Defensive Superintelligence, or DSI. The name is marketing. The method is what matters.
The unique part: “proves the fix.” Frontier says DSI combines mathematical reasoning and formal verification with security-specific training. Formal verification means checking logic with math rather than with a few test cases. It’s how chip makers and aircraft software teams show code does what it claims. Applied to detections, the promise is: here is a new rule, and here is evidence it catches the behavior and doesn’t break what already works, before you approve it. Most AI detection tools write more rules and leave testing to you. Attack simulation tools run fake attacks and show what fired. Frontier is aiming at a third thing: show the rule is right before it ships.
The skeptic’s questions. Proof is only as good as its assumptions. A rule can be correct on paper and still miss because a log source dropped, a field got renamed, or the attacker did something nobody modeled. So ask what exactly is being proven, and against what model of your data. Also watch false positives. A rule that catches everything is easy to prove and useless at 3 a.m. Frontier hasn’t published customer names or benchmark results that we could find.
The financial view. Fortune lists Frontier’s funding as $55 million, with investors Lightspeed Venture Partners, Greycroft and Harpoon. Round structure, valuation and revenue are Undisclosed. One thing readers should weigh: Lightspeed runs the Cyber 60 selection process with AWS and Fortune, and Lightspeed is a Frontier investor. Lightspeed says it validated self-reported data and Fortune reviewed the final list. That doesn’t make the pick wrong. It does mean the listing is a weaker signal of traction than a named customer would be. Fifty-five million dollars in year one is a bet on the team and on research, ahead of revenue proof.
Why it could win. Every SOC is about to be flooded with AI-written detections. Someone has to say which ones are any good. If Frontier can be the checker rather than another writer, it sits above every SIEM and every AI SOC tool instead of competing with them.
For practitioners. Pick five rules you rely on most. Can you prove, not hope, that each still fires on today’s logs?
If a vendor handed you a mathematically “proven” detection, what evidence would you need to see before you put it in production?