Stellar Cyber is a cybersecurity company focused on AI-native security operations. Its platform is purpose-built for MSSPs and lean enterprise security teams that need to unify detection, investigation, triage, and response without adding more operational complexity. The company positions its offering around a human-augmented model that combines automation, open integrations, and analyst oversight.
Stellar Cyber brings together SIEM, NDR, ITDR, UEBA, threat intelligence, and Open XDR capabilities in a single operating environment. It is designed for hybrid, multi-cloud, on-premises, and OT use cases, with an emphasis on preserving existing tool investments while improving visibility, case correlation, and response efficiency.
Offerings, Capabilities, and Integrations
Stellar Cyber emphasizes an open, API-driven SecOps approach rather than a closed, rip-and-replace architecture. Its platform ingests telemetry from existing endpoint, identity, firewall, cloud, SaaS, and network controls, normalizes that data, and correlates activity into unified, MITRE-aligned cases that analysts can investigate and act on from one console.
The company supports multi-tier, multi-tenant, and multi-site operating models for both enterprises and service providers. Its broader capabilities include AI-assisted investigation, case management, automated threat hunting, automated response, and integrations across ticketing, collaboration, orchestration, threat intelligence, and security tooling ecosystems.
Products and Services
- Human-Augmented Autonomous SOC Platform: Stellar Cyber’s overarching SecOps platform that uses agentic AI and analyst-in-the-loop workflows to automate detection, triage, investigation, and response from a unified console.
- Multi-Layer AI™: The company’s AI framework that combines multiple AI techniques across detection, correlation, investigation, and response to reduce noise and accelerate analyst decision-making.
- AI-Driven SIEM: Stellar Cyber’s AI-native next-gen SIEM capability for log collection, analytics, correlation, and response, built for lean security teams and MSSP operations.
- Open XDR: An open XDR capability and architecture that unifies data from existing security tools, correlates alerts into cases, and supports response without requiring a rip-and-replace of the current stack.
- Identity Threat Detection & Response (ITDR): Built-in identity security that correlates signals from Active Directory, Microsoft Entra ID, Okta, and other identity sources with endpoint, network, and cloud telemetry.
- UEBA: User and entity behavior analytics that applies behavioral analysis and anomaly detection to identify suspicious activity, privilege misuse, and lateral movement.
- Threat Intelligence Platform (TIP): A built-in threat intelligence layer that aggregates multiple threat feeds, enriches ingested data, and supports custom feed ingestion through standards such as STIX/TAXII.
- Network Detection & Response (NDR): AI-driven NDR for detecting, investigating, and responding to threats across IT and OT network environments using packet and network telemetry.
- MITRE ATT&CK Coverage Analyzer: A web-based analyzer that maps detection coverage to the MITRE ATT&CK framework and helps teams assess, report, and optimize detection posture.
- AI-Driven Case Management: Case-centric investigation workflows that use machine learning correlation and automated investigation to streamline remediation and analyst collaboration.
- Automated Threat Hunting: Threat hunting capability with pre-built and customizable playbooks that continuously search for suspicious behavior across the attack surface.
- Universal EDR: An open EDR integration capability that optimizes and normalizes telemetry from third-party EDR tools so customers can use any EDR within Stellar Cyber’s SecOps workflows.
- AI Investigator: A natural-language investigation capability that lets analysts ask plain-English questions and retrieve contextual threat findings without query-language expertise.
Target Customers
Stellar Cyber primarily targets MSSPs that need multi-tier, multi-tenant security operations to deliver SOC-as-a-Service, MDR-as-a-Service, and related managed security offerings efficiently across many customers. Its architecture is built to support tenant-aware workflows, centralized operations, and scalable onboarding.
It also targets lean enterprise security teams that want to consolidate fragmented tools into a single SecOps workflow across cloud, on-premises, and OT environments. The strongest fit is organizations that want broader visibility across identities, endpoints, networks, and SaaS systems while keeping existing security investments and automating more work without adding headcount.
Cloud Integrations and Marketplace
- AWS Marketplace: Stellar Cyber has a verified AWS Marketplace presence for its security operations offerings, giving customers an AWS-native procurement path for its Open XDR- and SIEM-based solutions.
- Oracle Cloud Marketplace: Stellar Cyber is available in Oracle Cloud Marketplace and also promotes OCI-specific integrations and detections for services such as Cloud Guard, Data Safe, Identity, Firewall, WAF, and VCN Flow.
- Microsoft Azure: Stellar Cyber supports deployment in Microsoft Azure and provides Azure-related integrations and connectors, including support for Microsoft Entra ID and Azure network security workflows.
- Google Cloud Platform: Stellar Cyber supports deployment on Google Cloud Platform and offers Google Cloud-related connectors to support multi-cloud monitoring and security operations.
Key People
- Changming Liu: Chief Executive Officer & Co-Founder
- Aimei Wei: Chief Technical Officer (CTO) & Founder
- David P. McKeough: Chief Revenue Officer (CRO)
- Albert Zhichun Li: Senior Vice President of Engineering
- Mayuresh Ektare: Senior Vice President Product Management
- Steve Garrison: Senior Vice President of Marketing
- Tony Chou: Senior Vice President of Customer Success
- Snehal Contractor: Senior Vice President Global Sales Engineering
- Paul Levasseur: SVP Customer & Partner Enablement
- Andrew Homer: Vice President Strategic Alliances
Key Facts
- Headquarters: San Jose, California, United States
- Employees: 145-160
- Annual Revenue: US$25M-US$35M
- Parent Company: None
- Subsidiaries: None
- Publicly Listed: Private
Analyst Recognitions
- Gartner: Challenger in the 2025 Gartner Magic Quadrant for Network Detection and Response. Representative Vendor in the 2025 Gartner Hype Cycle for Security Operations under Extended Detection and Response (XDR). Representative Vendor in the Gartner Hype Cycle for Midsize Enterprises, 2025 under Extended Detection and Response (XDR). Representative Vendor in the 2024 Gartner Market Guide for Extended Detection and Response. Representative Vendor in the 2024 Gartner Market Guide for Network Detection and Response.
