Northstar Security Emerges with $7M to Tackle ‘Toxic’ Risk Combinations via AI Agents
Security startup Northstar Security has officially exited stealth mode, announcing a $7 million seed funding round led by Wing Venture Capital. The company aims to address a persistent challenge for enterprise security teams: the inability to visualize how disparate security issues, identities, and assets interact to create significant, often overlooked, business risks. With participation from notable industry veterans including Gerhard Eschelbeck, Renaud Deraison, and Justin Somaini, Northstar is positioning its platform as a solution for organizations struggling to synthesize massive volumes of security telemetry.
Mapping the Security Context Graph
At the heart of the Northstar platform is what the company describes as a “Security Context Graph.” This architecture continuously ingests data from a wide array of existing IT and security infrastructure—including identity providers, cloud environments, and endpoint protection suites—to maintain a real-time, interconnected map of an organization’s digital footprint. By integrating with over 70 enterprise tools, such as Okta, GitHub, Microsoft Entra, AWS, and Google Cloud, the platform bridges the visibility gap between siloed security domains.
The primary value proposition of this graph is the identification of “toxic combinations.” According to Northstar, individual security alerts often fail to convey the true magnitude of a risk. A vulnerability on a workstation might appear manageable in isolation, but when that workstation is unmanaged and assigned to a user with excessive administrative privileges to a critical payroll database, it represents a high-priority exposure. Northstar’s platform is designed to detect these multi-vector attack paths that traditional, siloed security tools frequently miss.
Agentic Remediation and Workflow Integration
Beyond visibility, Northstar leverages AI agents to assist in remediation. Security analysts can query the graph using natural language, allowing them to rapidly investigate complex scenarios. Once a toxic combination is identified, the platform’s agents can initiate corrective actions, such as enforcing policy changes, notifying users, or restricting access rights. These actions are designed to operate under human supervision, ensuring that automated responses remain aligned with organizational governance policies.
Furthermore, the company is embracing interoperability through the Model Context Protocol (MCP). This allows customers to grant external AI agents access to the platform’s context graph, enabling organizations to build custom, automated security workflows tailored to their specific operational requirements. This approach reflects a broader industry trend toward agentic security operations, where AI is increasingly tasked with both detection and response.
Strategic Growth and Leadership
Northstar is led by CEO and co-founder Amer Deeba, whose background includes senior executive roles at Qualys and the co-founding of Normalyze, which was subsequently acquired by Proofpoint. CTO Ed Rowe brings significant engineering leadership experience, having previously served as an SVP at AppDynamics. The newly acquired capital is earmarked for platform development, talent acquisition, and scaling the company’s go-to-market operations. As organizations continue to grapple with the complexity of hybrid and multi-cloud environments, Northstar’s focus on contextualized, agent-driven risk management aims to provide a necessary layer of clarity for overstretched security teams.
