Abstract has secured a $25 million Series A extension co-led by Cheyenne Ventures and AVP, with ongoing support from Crosslink Capital and Rally Ventures. The investment raises the company’s total funding to nearly $50 million following a year of strong momentum that included 380% annual recurring revenue growth, 264% net revenue retention, and a threefold increase in its customer base.
The investment reflects growing conviction that security operations are shifting away from monolithic SIEM platforms toward composable architectures that give enterprises greater flexibility over data, AI, and cost. Abstract’s streaming-first platform enables organizations to modernize security operations without being locked into a single vendor ecosystem.
Security teams have spent a decade feeding every log into one platform and watching the bill climb as the data grew. The model leaves detection happening after everything is already in storage, ties a team to one vendor’s roadmap, and turns visibility into a cost problem. Abstract was built to break that pattern.
Composable security operations separate data sources from destinations, run detections while data is still in motion, and weave explainable AI across the workflow so analysts work faster, dig deeper, and trust the results. Enterprises keep control of their architecture, their costs, and their data, without trading away performance. With Abstract, an organization can:
- Decouple sources from destinations, so data is not locked to one vendor’s stack
- Run detections in stream, so threats surface before data reaches storage
- Tier and route data on the way out, in the schema each destination expects, including OCSF, ECS, and CIM, to cut storage cost
- Apply Astro AI across detection, triage, investigation, and response
- Scale across multi-cloud and hybrid environments
Over the past year, Abstract:
- Grew ARR 380% year over year
- Reached 264% net revenue retention
- Grew the customer base 3x
- Made 40 strategic hires to support enterprise expansion
“Legacy SIEM made you pour everything into one platform and charged you more as the volume grew, all to find threats after the data was already sitting in storage. Composable security operations end that. Teams pick their own sources and destinations, run detections while the data is still moving, and add AI where it changes the work across triage, investigation, and response,” said Colby DeRodeff, CEO and co-founder of Abstract. “Customers are proving the model. ARR is up 380% in a year as enterprises move off legacy platforms, and this round is about meeting that demand.”
The funding will go toward widening in-stream detection coverage, extending Astro AI across the SOC workflow, and growing the go-to-market team to keep pace with enterprise demand.
“Every major platform transition creates a new systems architecture, and security operations is entering one of those moments. Enterprises no longer want to be forced into a single data platform just to detect threats. Abstract has built the architecture for that next generation. Streaming-first, AI-native, and composable. When we combined that vision with the team’s execution and customer traction, increasing our investment was an easy decision.” said J.R. Becko, Partner, Cheyenne Ventures.
“We back founders with the depth and conviction to build something category-defining, and Abstract has both,” said Manish Agarwal, General Partner, AVP. “Security teams are putting AI at the center of how they operate, and AI is only as good as the data underneath it. The teams that come out ahead will be the ones that own their data, route it on their terms, and detect in real time rather than after the fact. Abstract is building the platform to get them there.”
