Demisto, a Security Orchestration, Automation and Response (SOAR) startup, raises $43M Series C led by Greylock Partners
Demisto announced today that it has raised $43 million as the company tries to simplify the management of security even as the complexity of threats and tools multiplies.
Context & Ripple Effects
Demisto's $43M Series C, led by Greylock Partners, lands in a security market where the number of tools defenders run has outpaced their ability to coordinate them — the pitch is an orchestration layer that automates incident response across that sprawl. The round brought Demisto's total raised to $69M and put Greylock behind one of the most-watched names in the then-emerging SOAR category.
The bet paid off fast: within months, Palo Alto Networks moved to buy Demisto for roughly $560M (an acquisition roughly eight times its total funding), and rival orchestrator Siemplify answered with its own $30M Series C months later — evidence the category had gone from niche to strategic.
First-order effects
- Demisto gains the capital to scale its automated incident-response platform at the moment enterprises are drowning in disconnected security tools, with Greylock doubling down on security operations as a thesis.
- Every enterprise buyer evaluating SOAR now has a well-funded independent option, raising the bar for incumbents whose consoles don't talk to each other.
Second-order effects
- Platform vendors face a build-vs-buy decision on orchestration — Palo Alto Networks chose buy, paying ~$560M rather than stitching automation into its own stack organically.
- Independent peers like Siemplify must raise faster and differentiate against a consolidated giant, while adjacent data-layer players such as Devo (whose $60M Series D came a year and a half later) benefit from the same appetite for security-operations infrastructure.
Third-order effects
- Standalone SOAR proves to be an acquisition-target class: once the big platform vendors internalize orchestration, independents either get absorbed or retreat to specialized niches — the pattern Siemplify's later raise was racing against.
- Greylock's playbook repeats: the firm backed Demisto early, cashed out via platform consolidation, and kept funding the next remediation layer, as with its investment in AI-based cloud-security fixer Dazz (raised at a reported ~$400M valuation).
The trend: Security operations is consolidating around automation and orchestration layers, with platform vendors acquiring rather than building and investors recycling proceeds into each successive remediation tier.