Nebulock Raises $25M Series A to Expand AI-Native Cybersecurity Platform

Nebulock raised a $25M Series A led by FirstMark, with participation from Bain Capital Ventures, Decibel, Zetta Venture Partners, and Step Function Ventures. The Boston-based company builds an AI-native contextual security platform for proactive, hunt-first security operations across endpoint, identity, cloud, network, and SaaS environments.

Founder and CEO Damien Lewke is the only current executive verified from the strongest source set used in this run. Nebulock reports more than 300M agentic investigations completed, more than 4,000 high-confidence findings generated, and customer traction that includes Cribl, HealthEdge, and Bain Capital.

The new capital will support platform expansion, deeper cross-telemetry correlation, a stronger behavioral context graph, and growth across engineering and go-to-market teams. No valuation was publicly disclosed in the reviewed funding materials, which matters because the useful signal here is less about price and more about why investors are backing proactive security operations now.

What Happened

Cybersecurity has always been a race between signal and noise. Every new tool promises more visibility, every dashboard promises another layer of protection, and security teams still spend too much of their week sorting through alerts, stitching together disconnected telemetry, and trying to decide whether something unusual is actually dangerous.

Nebulock is betting that approach does not scale. The company announced a $25M Series A to expand its AI-native contextual security platform, which it describes as hunt-first security operations built to investigate behavior across endpoint, identity, cloud, network, and SaaS environments before threats turn into incidents.

The round was led by FirstMark, with continued backing from Bain Capital Ventures, Decibel, Zetta Venture Partners, and Step Function Ventures. The company says the proceeds will help widen platform capabilities, deepen cross-telemetry correlation, strengthen its behavioral context graph, and scale engineering and go-to-market work.

Why This Matters

Enterprise security is changing because attackers are changing. Modern attacks increasingly involve valid credentials, subtle behavioral anomalies, and activity that can look normal until enough context is assembled across systems that were never designed to explain themselves together.

That creates a brutal operating problem for security teams that rely on traditional alert-driven workflows. Nebulock's positioning is aimed at that gap: contextual security analytics, behavioral reasoning, and agentic threat hunting instead of waiting for alerts to decide where investigation begins.

Investors keep backing this category because the pain is practical, not theoretical. Security teams do not need another product that creates a prettier queue of alerts; they need systems that collapse context, reduce investigative drag, and help analysts understand which behaviors actually matter.

Evidence of Market Traction

Funding alone rarely tells the full story, but customer evidence makes the round more interesting. Nebulock reports that its platform has completed more than 300M agentic investigations and generated more than 4,000 high-confidence findings across customer environments.

The company also points to customers including Cribl, HealthEdge, and Bain Capital. Those names help explain why this announcement reads less like another AI cybersecurity pitch and more like a market test for whether autonomous investigation can become part of the enterprise security stack.

Nebulock has described examples that include exposed credentials in command-line arguments, malicious browser extension activity, insider source-code exfiltration, and long-running unauthorized access inside customer environments. Those examples reinforce the company's argument that behavioral analysis and cross-domain context can surface problems that isolated tools may miss.

Market Context

AI is reshaping both sides of cybersecurity. Attackers are getting faster and more automated, while defenders are trying to decide where AI actually improves detection, investigation, and response rather than simply adding another layer of workflow theater.

That is why the phrase AI-native matters only if it translates into operational advantage. In Nebulock's case, the company is tying AI to contextual security analytics, behavioral graphs, and agentic workflows that are meant to help teams hunt across fragmented enterprise telemetry.

This is also where venture interest is moving. The market is less impressed by companies that attach AI language to old workflows and more interested in infrastructure that solves the problems AI adoption creates for security, identity, cloud, SaaS, and enterprise operations teams.

What This Signals

The cybersecurity market has moved past the question of whether AI belongs in security operations. The sharper question is where AI creates measurable advantages without overwhelming teams that are already buried in tools, dashboards, and incident queues.

Nebulock's Series A suggests investors see proactive investigation, behavioral context, and autonomous analysis as core ingredients in the next security operations cycle. The company's use of proceeds lines up with that thesis: more platform depth, stronger correlation, and more capacity to meet enterprise demand.

For founders, the lesson is simple enough to hurt. Capital still follows evidence: clear product positioning, a specific operational pain, measurable traction, and a story that makes customers understand why now, not just why someday.