Cybereason

Why an attack can go unnoticed for months

When people imagine a cyber breach, they imagine a single moment: someone gets in, steals something and gets out. In reality it looks completely different. An attacker who gets into an organization starts a long process: a phishing message opened on one computer, a stolen password, a login to a second computer, raised privileges, a slow scan of the internal network, and only at the end, data sent outside.

The problem is that each step on its own looks completely routine. An employee logging in to another computer happens hundreds of times a day. A file that is opened, a permission that is granted, a query on a network folder: each of these is perfectly legitimate in a hundred cases out of a hundred and one.

So a system that raises an alert for every suspicious event produces thousands of alerts a day and an overall picture of nothing. An analyst who receives them cannot tell which three out of two thousand belong to the same story. This is the real reason attacks go undetected for months: not too few alerts, but too many.

Malop: linking the steps into one story

The idea that set the product apart was not to detect each event better on its own, but to link events together. The system collects data from many computers in the organization at the same time and looks for connections between them: the same file, the same account, the same sequence of actions moving from machine to machine.

The result is called a Malop, short for Malicious Operation. Instead of a scattered list of alerts, the analyst gets a single view of the whole attack: where it started, which computers it spread to, what was done on each one, and in what order.

The practical difference is time. An investigation that starts from a single alert requires the analyst to rebuild the chain themselves, hours or days of work, while the attacker keeps going. An investigation that starts from a chain that is already assembled starts from the question of what to do. The product belongs to a category called endpoint detection and response, which in recent years has expanded into a broader approach called XDR.

From signatures to behavior: what changed in detection

The older generation of antivirus software worked with signatures: every known malicious file has a fingerprint, and the software compares every file on the computer against a catalog of fingerprints. The method is fast, cheap and very accurate, as long as it is dealing with something that has been seen before.

Its weakness is structural and cannot be fixed: new malware is not in the catalog until someone discovers it and adds it, and in the meantime it is free to act. Worse, a large share of modern attacks use no malicious file at all, but legitimate tools that already exist on the system, and against those there is nothing to compare.

Behavioral detection asks a different question: is this sequence of actions reasonable for this user and this computer? This makes it possible to detect something that has never been seen before, but the price is clear: false alarms, and a need for constant tuning. The difference between the two approaches is not only in the technology but also in what the organization is willing to absorb operationally, which is why in practice most organizations run both side by side.

SoftBank, a $3 billion valuation and layoffs

Japan's SoftBank first invested in the company in 2015 and over the years became the central player around it. In total, Cybereason raised more than $850 million. In its 2021 round, in which it received $275 million, it was valued at about $3 billion.

The tie to SoftBank also opened a market: the company expanded its business in Japan, where it became one of the largest vendors in its field. That asset was mentioned explicitly in the acquisition announcement years later.

In 2022 the trend reversed. In June about 100 employees were laid off, and in October another 200, who made up 17% of the workforce. Just before the October cuts, the company employed about 1,100 people and operated in more than 50 countries. In April 2023 SoftBank invested another $100 million and became the largest shareholder, and at the same time the CEO was replaced: Lior Div, one of the company's founders, made way for Eric Gan, a SoftBank executive who had followed the investment from the start, while Div himself moved into an adviser role.

2024–2025: a canceled merger, a new CEO, a sale

In November 2024 a merger with the American company Trustwave was announced, which was supposed to close in early 2025. It was canceled in March 2025 amid a public dispute between CEO Eric Gan and the major investors over the terms of a further funding round, and Gan resigned.

On 10 March 2025 the company announced a $120 million funding round led by SoftBank, its Vision Fund 2 and Liberty Strategic Capital, and the appointment of Manish Narula as CEO.

The last chapter closed on 25 November 2025, when the American security company LevelBlue completed its acquisition of Cybereason. As part of the deal, SoftBank, Vision Fund 2 and Liberty Strategic Capital became investors in LevelBlue, and Steven Mnuchin, the former US Treasury Secretary, joined the acquirer's board. The acquirer's description highlights three assets: the XDR platform, threat intelligence capabilities, and an incident response and forensic investigation team.

What remains of the company in the 2026 market

The field Cybereason worked in has become very competitive. Several of the large Israeli and American companies now offer a capability that is essentially similar, and the difference between them is measured less by the algorithm and more by the amount of data collected and the quality of day-to-day operations.

That is exactly what led to the wave of mergers and acquisitions in the market. An organization that buys a detection tool quickly finds that it also needs a team to run it around the clock, so demand is moving from a "product" to a "managed service." LevelBlue positions itself exactly there, and Cybereason's technology is one component of that offering.

At the same time, it is worth remembering what the company proved along the way: that a group of veterans of Israeli military technology units can build a world-scale security product and raise hundreds of millions of dollars from international investors. The fact that raising that much money does not by itself guarantee the final outcome is a completely separate lesson, and no less important than the first. Two of the company's founders, Lior Div and Yonatan Striem-Amit, founded 7AI in 2024, which develops AI agents for detection, investigation and response in security operations centers.