Legion raises $30M Series A to train AI on how security teams actually work | CTech

Cybersecurity startup Legion Security has raised $30 million in a Series A funding round led by Coatue, with participation from Accel and Picture Capital, as well as senior angel investors from Wiz, Google, and CrowdStrike. The round follows an earlier $8 million Seed raise last year led by Picture Capital and Accel, bringing the company’s total funding to $38 million since its founding.

Legion is developing a browser extension AI SOC (Security Operations Center) companion that turns in-house expertise into scalable automation. The extension tracks how analysts investigate threats, learns their workflows and decision-making patterns, and converts that knowledge into automated processes that can be executed at scale and on demand.

Legion was founded in 2024 by security veterans Ely Abramovitch (CEO), Michael Gladishev (VP R&D), and Eyal Fisher (CTO). Abramovitch and Gladishev previously held senior roles on Microsoft Sentinel's team, while Fisher brings a research background in artificial intelligence from the University of Cambridge.

Legion currently employs 25 people split between Israel and New York.

CEO Abramovitch , a former jazz musician, told Calcalist he left music to return to academia and the tech world. “I played and studied jazz in the U.S., but I realized that lifestyle wasn’t for me. It was hard to do anything but rehearse. I came back to Israel, studied math, and entered high-tech,” he said. “We’ve developed a unique approach to solving the alert fatigue that burdens modern security teams. Our extension observes how analysts interact with tools like Chrome, Edge, or Island, and learns how they make decisions. Then we replicate that decision-making automatically, at scale.”

The challenge Legion addresses is well-known: for more than two decades, SOC teams have struggled with overwhelming alert volumes and persistent staffing shortages, typically lacking between 26% and 45% of needed personnel.

Legion’s learning approach captures every step of the analyst’s workflow, from triaging simple alerts to conducting complex investigations. The data is converted into automated models that run continuously and accurately. With the organization’s approval, the system can also take action autonomously, working around the clock as an AI-powered force multiplier for the security team.