The round. Northstar Security came out of stealth on Oct. 28 with a $7 million seed round led by Wing Venture Capital. MVP Ventures and Outliers Venture Capital joined. So did three individual investors worth noticing: Gerhard Eschelbeck, a former Google CISO; Justin Somaini; and Renaud Deraison. Valuation: Undisclosed. Revenue: Undisclosed.
Deraison is the tell. He wrote the Nessus vulnerability scanner, releasing the first version at 17, and co-founded Tenable in 2002, per his Tenable profile. One of the people most responsible for turning “find the vulnerabilities” into a product category is now backing a company whose pitch is that finding isn’t the problem anymore.
What Northstar does. It doesn’t scan. It plugs into the tools you already own, more than 70 integrations including AWS, Google Cloud, Microsoft Defender, Microsoft Entra, Okta, GitHub, Workday and Zendesk. It pulls their data into what it calls a Security Context Graph. Think of it as a map of how your assets, identities, vulnerabilities, apps and business systems connect to each other.
The goal is to spot “toxic combinations.” One issue alone looks minor. Several together are an open door. Northstar’s own example is a laptop with no endpoint protection. Working out whether it matters can mean checking six different tools. The graph shows it belongs to a privileged user who can reach payroll. Then an AI agent can start the fix: push the endpoint agent, notify the owner, or restrict access, with a human signing off where needed.
The graph is also open through Model Context Protocol, or MCP, the common way AI assistants plug into outside tools. So a team can point Claude or its own agents at it and build workflows on top.
Why the thesis is right. The security stack is full of finders. Vulnerability scanners, cloud posture tools, identity tools and endpoint tools each produce their own list. What almost nobody has is the join: which of those findings sit on a path to something the business actually cares about. Fixing is where the hours go. Northstar’s own launch says an analyst can spend hours piecing together one answer while the laptop stays exposed.
The founders have seen the problem from the finder side. CEO Amer Deeba held senior roles at Qualys, another scanner company, and co-founded Normalyze, a data-security startup Proofpoint bought in 2024. CTO Ed Rowe was CTO of Farmers Business Network and ran engineering at AppDynamics. That’s a scanner veteran and a data-infrastructure engineer. For a graph company, that’s the right pairing.
Why it’s hard. The big platforms see the same opening. Tenable now calls itself “the exposure management company” and says it serves more than 40,000 customers. A $7 million startup has to win on neutrality. It connects to everyone because it doesn’t sell a scanner that competes with anyone. That’s a real edge right up until a platform decides the graph is a free feature.
There’s a trust gap, too. Letting an AI agent change access for a privileged user is a big step. Northstar’s launch keeps repeating “with human oversight where appropriate.” Buyers should ask exactly where that line sits, and who can move it.
The Tenable tie-in. Tenable reports third-quarter results after the market closes today, Oct. 28, with a call at 4:30 p.m. ET. Listen for one thing. Does management talk about how many exposures its platform surfaces, or how many it helps customers close? Over time the market will pay for the second number. Northstar is a $7 million bet that it should already.
What a buyer should do. Before you buy another finder, measure your fix rate. How many critical findings did you close last quarter, and how long did each one take? Then run any pilot against one question: can this tool show you which ten issues sit on a path to payroll, production or customer data, and close one of them, with approval, in under an hour? If it can’t, it’s another dashboard.
The bottom line. The scanner era taught security teams to count problems. The next one pays the vendors who can connect them and close them.