Legion Security develops browser-native AI security workers for security operations, starting with the SOC. Its core platform, Legion, learns from real analyst behavior in the browser, captures investigation logic across tools, and turns that knowledge into reusable agentic workflows tailored to each organization’s operating model.
The company is positioned around phased, human-controlled autonomy rather than black-box automation. Legion Security starts by observing how teams investigate, then supports analysts during execution, and can ultimately run approved workflows autonomously once trust is established. The result is an AI SOC analyst designed to scale institutional knowledge, reduce repetitive work, and improve investigation speed without forcing customers to rebuild their environments around integrations or generic playbooks.
Offerings, Capabilities, and Integrations
Legion Security’s offering centers on learning directly from how analysts work inside existing browser-based security tools. Its platform captures investigation steps, decision paths, and use-case patterns, then applies that context to workflow execution, reasoning, and investigation support. The product is designed to operate through a lightweight browser extension, which shortens deployment time and avoids the integration-heavy approach common in traditional SOC automation.
Across the platform, Legion Security emphasizes explainability, operator control, and evidence-backed automation. Teams can decide what is recorded, what the system learns from, which tools and actions it may use, and where human approval remains required. Legion Security is built to work across existing security tools, including cloud, SaaS, on-premises, legacy, and homegrown environments that analysts already use through the browser.
Products and Services
- Legion: Browser-native AI SOC analyst platform that learns from analyst investigations, captures team logic, and scales that knowledge into organization-specific investigation workflows without requiring APIs or heavy integrations.
- Learning Mode: Observes and records how analysts investigate, switch between tools, and make decisions, then maps those workflows into discoverable team knowledge and reusable process logic.
- Guided Mode: Executes investigations through the analyst’s browser with human oversight, helping teams tune workflow execution step by step while keeping people in control.
- Autonomous Mode: Runs approved investigation workflows autonomously within customer-defined guardrails, with oversight reserved for higher-risk or critical decisions.
- Legion AI Investigator: Goal-oriented AI agent for reasoning-heavy and open-ended investigations, designed to take over when deterministic workflows reach points that require judgment and adaptive next steps.
- Legion Evidence Gathering: Automated evidence capture capability that records screenshots and step-by-step visual proof from live security tools during investigations to support review, handoffs, and auditability.
Target Customers
Legion Security targets security operations teams that need to increase investigation throughput without replacing their existing stack. Its strongest fit is with enterprise SOCs, security operations leaders, threat investigation teams, and security engineering groups that work across many browser-based consoles, SaaS security tools, cloud services, and internal systems.
The platform also aligns with regulated and control-conscious organizations that require transparency, audit trails, and phased autonomy before allowing AI to act more independently. Based on its market messaging and customer examples, Legion Security is suited to large enterprises, financial services and healthcare organizations, higher education environments, and managed security service providers looking to reduce alert fatigue and scale experienced analyst judgment.
Cloud Integrations and Marketplace
- AWS Marketplace: Legion Security has a verified AWS Marketplace presence for Legion, offered as a SaaS solution and purchased through contract-based marketplace terms.
Key People
- Ely Abramovitch: Founder & CEO
- Eyal Fisher: Founder & CTO
- Michael Gladishev: Founder & VP R&D
- Ryan Rowcliffe: Field CTO
- Marcia Dempster: Head of Channel Sales
- Liam Barnes: Head of Marketing
- Dereana Murcia: Head of Field & Channel Marketing
- Avner Shaked: Head of Design
Key Facts
- Headquarters: New York City, New York, United States
- Employees: 11-50
- Annual Revenue: Undisclosed
- Parent Company: None
- Subsidiaries: None
- Publicly Listed: Privately held
