Northstar Security Raises $7M Seed for Agentic Security

Alex Macdonald and Chris Brichford are back building alongside Amer Deeba and Ed Rowe. Northstar Security's account of its founding team traces that reunion through Adobe and Farmers Business Network, putting a familiar group of enterprise-software builders inside a new cybersecurity assignment: help an AI agent understand the organization it is about to change.

In an announcement datelined San Francisco, Northstar emerged from stealth on October 28, 2026, with $7M in seed funding. Wing Venture Capital led the round, with MVP, Outliers and individual investors Gerhard Eschelbeck, Renaud Deraison and Justin Somaini participating. The company says the financing will support product development, team expansion and go-to-market efforts.

Northstar connects security and IT records in a Security Context Graph, then uses those relationships to support investigation and remediation. The commercial proposition reaches into a practical enterprise problem: a finding becomes useful when somebody can establish who owns the affected system, what depends on it and how a fix should reach it.

A founding team returns to the enterprise handoff

Deeba is Northstar's CEO and co-founder; Rowe is CTO and co-founder. The two first worked together at Adobe in the late 1990s, according to the company's launch announcement. Macdonald and Brichford are identified on the current team page as founding engineers, a distinction worth preserving when describing how this group came together.

Deeba previously co-founded Normalyze, which Proofpoint acquired, and held senior roles at Qualys. Rowe previously served as CTO of Farmers Business Network and SVP of Engineering at AppDynamics. Those backgrounds place enterprise data and operating environments close to the company's origin, although a résumé alone cannot tell a prospective customer how a particular deployment will behave.

Northstar's own founding story describes frustration with fragmented security data and the effort required to turn it into current understanding. Bringing the engineering team back together is a concrete choice about where to spend the next stretch of their careers. They are building around the information that must travel between an alert and an authorized response.

That helps explain the financing's scope. Product engineering has to make the connections useful, hiring has to sustain the work, and a commercial team has to show an enterprise why the connected picture belongs in its operating routine. Those are closely related assignments for a product that asks several existing systems to contribute to one decision.

What a security graph adds to a remediation decision

Northstar's published use cases describe connecting endpoint inventories, security controls, identities, vulnerability findings and enterprise records. The page labels its scenarios illustrative. Its endpoint-hygiene workflow includes identifying missing or unhealthy security agents, assigning priority using contextual information, triggering approved actions and checking whether remediation occurred.

A missing endpoint agent is a technical fact. Ownership, access and business criticality change the decision around it: whom to contact, which system needs attention and what interruption a response could create. Northstar's pitch is to assemble those relationships so an analyst or agent can work from a connected view.

The company's examples also cover dormant or excessive access, assets spread across different inventories and vulnerabilities whose importance depends on exposure. These are product descriptions rather than independently measured outcomes. They show the kinds of questions Northstar wants a customer to ask, while leaving deployment coverage and effectiveness to be established in that customer's environment.

The useful operating implication is that confirmation belongs inside the workflow. Sending a ticket or asking an owner to act leaves an outstanding dependency; observing the resulting change supplies a different kind of information. Northstar describes tracking work through resolution, which would make the condition after an action part of the next security decision.

For buyers, that connects the product discussion to the people already responsible for access, devices and applications. An organization evaluating the system could follow an actual finding through ownership and approval, then inspect the resulting state. The graph earns its relevance through those relationships and the work they make possible.

The context may serve somebody else's AI agent

Northstar also makes its Security Context Graph available through Model Context Protocol, according to its website and launch announcement. The company positions that interface as a way for customers to give external AI agents structured security context. An enterprise can therefore consider the context service alongside the workflows supplied by Northstar itself.

This creates an interesting product relationship. The customer deciding which agent to use may still need a reliable account of assets, identities and ownership for that agent to consult. In this model, context becomes something another application consumes, making the quality of the underlying relationships important beyond Northstar's own user interface.

Human oversight remains part of the company's description of remediation. Its use-case page refers to approved actions and revoking access when authorized. Read together, those details put permissions and decision ownership into the product's operating environment, rather than making autonomous action a blanket promise that every finding should be resolved without review.

That distinction gives a demonstration a useful direction. A security leader could inspect what an outside agent receives, how an approval enters the workflow and what the system records after a change. These are evaluation questions implied by the architecture, not claims that Northstar has already demonstrated every answer in a production deployment.

Wing backs the work of making connected context useful

Wing Venture Capital describes AI security and enterprise AI enablement among its areas of interest. Leading Northstar's seed round places that investment interest behind a company trying to connect existing enterprise information with the agents expected to use it. The round includes both institutional capital and individuals with cybersecurity experience.

The announcement supplies no valuation, revenue figure or independently audited remediation result. Northstar says the platform is available, and its careers page invites builders interested in AI, context and autonomous workflows. The $7M is the announced seed financing; the available sources do not establish lifetime capital raised or explicitly specify the dollar denomination.

The next commercial conversations can get quite concrete. A device owner, an identity administrator and a security analyst each hold part of the answer to an exposed machine, and an agent needs enough of that shared understanding to participate usefully. Deeba, Rowe and their returning engineering colleagues are building for the moment those people agree on a response and need the software to carry it through.