Exaforce, the San Jose-based startup behind an Agentic SOC platform, underwent rigorous scrutiny during a 20-question interview led by ScanNetSecurity editor-in-chief Ueno Noboru. The company, founded in 2023 by six former executives from F5, Volterra and Juniper, has raised $200 million and employs over 140 people. Its CEO is Ankur Singla.
Shang Li, Director of Technology Operations for APJ at Exaforce, explained that the platform was designed from the ground up rather than layering AI onto existing SIEM or SOAR tools. The architecture consists of three layers: raw event and context collection via APIs, a real-time knowledge graph that models users, devices, repositories and permissions as connected objects, and an LLM agent layer capable of triage, investigation and automated response.
Li stated that after six months of operation the system can confidently classify more than 90 percent of alerts as false positives while surfacing the evidence and reasoning behind each decision. Analysts can accelerate learning by adding short notes when closing alerts, allowing the agents to improve over time. Response actions such as session termination in Google Workspace or Okta and device isolation can be executed autonomously or via human approval buttons delivered through Slack and Teams.
The interview addressed concerns about prompt injection, with Exaforce deploying separate governance and evidence-verification agents. All reasoning steps and collected artifacts are stored for later audit, although the underlying prompts themselves remain proprietary. On liability, Li acknowledged that, like autonomous driving, ultimate responsibility rests with the customer organization.
Data for Japanese customers is stored in Tokyo on AWS using Amazon Bedrock models, with strict tenant separation. Pricing in Japan is based on employee count rather than data volume. Exaforce also offers a global MDR service that operates 24/7 using a follow-the-sun model while still giving customers direct access to their own data and alerts.
Ueno raised questions about skill development for junior analysts and the risk of over-reliance on automation. Li noted that query writing becomes less critical, while the ability to identify key investigative points remains essential and experience-based. The company plans to expand autonomous containment capabilities in the coming year while continuing to support both broad and narrowly scoped deployments.
