I analyzed @exaforceAI . in stealth mode before they announced their $75M Series A funding last week. As an analyst who's seen a lot of “agentic SOC” pitches, I thought they had some differentiated things (perhaps what convinced their investors on a BIG round). A few thoughts. See a distilled flow image of how their stack is architected. Everything starts with data: cloud logs, IAM, code context, and threat intel stream into an open warehouse. The following 3 steps are intruging: 1) Semantic model It normalizes every field from CrowdStrike, Okta, AWS, etc. This includes converting raw JSON into typed security objects (users, roles, repos, resources) into a graph an analyst can actually reason over. This is key as correlation that used to take regex effort is now a one-hop graph query. 2) Behavioural model This model leverages normalized data, allowing them to create baselines for every identity and asset, and flag anomalies before detection rules fire off an alert in your SIEM/Data Lake/XDR. This already helps cuts alert noise at the source. Many solutions stop here, but 3) Knowledge LLM This third-layer reads both the semantic graph and behavioural deltas to add long-form reasoning and dynamic playbooks on top, as needed. Analysts can ask plain-English questions and get context-rich answers with a co-pilot. Only some remediation is auto-approved today as human-in-the loop is still key. I like this bcos autonomous agents are useless without a purpose-built knowledge layer. The common thread is that each layer enriches the next. The warehouse fuels semantics → semantics sharpen behaviour → behaviour grounds the LLM → the LLM directs Exabots. These "bots" are task-oriented agents that triage, investigate, and respond to the stack above as required. Custom semantic + behavioral layers provide deterministic outputs at cloud scale, overcoming the usual direct log‑to‑LLM pipelines (or SOARs in some cases) TLDR; The team has seen big results in their speed to detect and lower cost in some of their early pilots. I’m betting that this "data: semantics+behaviour+knowledge LLM” pipeline is what we need to drive future SOC outcomes. (This is what CISOs should ask companies next week, showcasing their shiny new AI agents.) *** Congrats, Ankur Singla, Ariful Huq, Dhruv Gupta and team, on the launch and the raise ** Follow along, I'll have more on this topic later in the Fall.