LimaCharlie is an API-first, cloud-native cybersecurity company focused on security operations. Its SecOps Cloud Platform gives security teams modular building blocks for telemetry collection, detection engineering, response, automation, and multi-tenant operations rather than forcing them into a rigid, prepackaged stack.
LimaCharlie’s current positioning centers on an Agentic SecOps Workspace where AI operators work directly inside the same governed environment used by human analysts. The company is built for teams that want transparent, extensible security infrastructure they can inspect, customize, and operate through APIs, whether they are modernizing an internal SOC, delivering managed security services, or building security products on top of shared infrastructure.
Offerings, Capabilities, and Integrations
LimaCharlie combines endpoint and external telemetry ingestion, normalized data handling, detection and response logic, automation, historical search, and centralized multi-tenant administration in one cloud-native environment. Its architecture is designed for granular control, infrastructure-as-code style operations, and auditable workflows that can be executed by people or AI agents.
The platform is built to integrate broadly with existing security and IT environments. LimaCharlie supports adapters for ingesting third-party and cloud data, outputs for routing data to SIEM, storage, messaging, and streaming destinations, and an add-on and extension model for expanding functionality. It also supports bring-your-own-LLM workflows and native integrations with providers such as Claude Code, OpenAI Codex, and Google Gemini CLI.
Products and Services
- SecOps Cloud Platform: LimaCharlie’s core cloud-native platform for assembling and operating modular security capabilities including telemetry, detection, response, automation, and multi-tenant administration.
- Agentic SecOps Workspace: An AI-centric operational layer that lets governed AI agents investigate, act, and manage security workflows directly inside LimaCharlie’s environment.
- Grid: A beta agentic AI layer that runs alongside an existing security stack, connecting to current telemetry sources and APIs without requiring a rip-and-replace migration.
- LimaCharlie EDR: Endpoint detection and response capabilities with real-time telemetry, customizable detections, response actions, and support across major operating systems and deployment models.
- LimaCharlie Search: An advanced search experience for querying telemetry across one or multiple organizations, supporting investigations, threat hunting, and conversion of queries into detections.
- Model Context Protocol (MCP) server: A server that gives AI agents structured, permission-aware access to LimaCharlie functions such as telemetry queries, endpoint investigation, remediation, configuration management, and threat intelligence lookups.
- Add-ons Marketplace: A marketplace for discovering, enabling, and sharing add-ons that extend the platform with integrations, rulesets, APIs, and other capabilities.
- Detection & Response: A rule-driven detection and automation capability that supports custom logic and automated response actions across endpoint and ingested telemetry.
- Replay: A service for running Detection & Response rules against historical telemetry to support retrospective hunting, rule validation, and testing.
- Telemetry Storage: A storage and search capability that retains a rolling year of telemetry for investigation, compliance, and retrospective analysis.
- Adapters: Ingestion connectors for bringing cloud, SaaS, security tool, and generic log data into LimaCharlie from sources such as AWS, Google Cloud, Microsoft services, identity platforms, and syslog.
- Outputs: Forwarding capabilities for sending events, detections, and related data to external destinations including SIEMs, storage platforms, messaging tools, and streaming services.
- Community Rules: Managed and community-sourced detection content that can be adopted and customized within LimaCharlie environments.
Target Customers
LimaCharlie primarily targets managed security service providers, MDR teams, and other multi-tenant security operators that need to standardize operations across diverse customer environments while preserving flexibility over tools, workflows, and costs.
It also serves enterprise SOC and security engineering teams that want more control over telemetry, detections, automation, and cloud-scale operations. A further core audience is cybersecurity product builders and startups that need reusable security infrastructure to accelerate development, launch new offerings, and scale without building the entire backend themselves.
Cloud Integrations and Marketplace
- Google Cloud Marketplace: LimaCharlie lists its SecOps Cloud Platform on Google Cloud Marketplace and also supports Google Cloud integrations such as Google Cloud Storage, Pub/Sub, BigQuery, and Google Cloud log ingestion workflows.
- Amazon Web Services (AWS): LimaCharlie supports AWS integrations through adapters for services such as CloudTrail, GuardDuty, S3, and SQS, along with output options for Amazon S3 and AWS-oriented Cloud CLI support.
- Microsoft Azure: LimaCharlie supports Azure integrations including Azure Event Hub and Azure Storage Blob outputs, plus ingestion workflows for Azure Monitor, Microsoft Entra ID, and Microsoft Defender data.
Key People
- Maxime Lamothe-Brassard: Founder / CEO
- Christopher Luft: Co-founder / CCO
- Amrik Randhawa: Chief Operating Officer
- Dmitri Zimine: VP of Engineering
- Charlton Swearingen: Chief Marketing Officer
- Hector Gamez: VP of Finance
- Steve Brant: Technical CS Lead
Key Facts
- Headquarters: Covina, California, United States
- Employees: Approximately 30
- Annual Revenue: Undisclosed
- Parent Company: None
- Subsidiaries: None
- Publicly Listed: No (privately held)
