New York-based cybersecurity startup Surf has emerged from stealth with $57 mn in funding, led by Accel. The company is using agentic AI to reshape enterprise security operations, with a platform built to identify and remediate vulnerabilities before they turn into larger problems.
Surf AI is an agentic cybersecurity startup that launched out of stealth on March 17, 2026, with a focus on automating security operations using artificial intelligence.
The funding round also included Cyberstarts and Boldstart Ventures, a sign investors see room for agentic AI to take a larger role in cybersecurity. Surf said the capital will go toward product development, go-to-market expansion, and team growth as it scales the business.
Based in New York, the company aims to help enterprise security teams bridge the gap between identifying risk and taking action, particularly as AI-driven threats increase.
Surf is entering a market where security teams are already stretched thin by fragmented data, sprawling infrastructure, and too many disconnected tools.
Founded in 2024 by Israeli cybersecurity veterans, including chief executive officer Yair Grindlinger, the company says its goal is to help organisations shift from reacting to attacks toward stopping them earlier.
That idea is tied to security hygiene, a concept that has been around for years, though harder to execute now. Hybrid systems and multi-cloud environments have made periodic manual reviews far less useful.
Surf’s pitch is that continuous monitoring and automated remediation are no longer optional, especially when attackers are also using AI to move faster and at greater scale.
At the centre of the platform is a system designed to build a broad understanding of an organisation’s digital environment. It pulls signals from identity providers, HR systems, cloud infrastructure, and IT tools, then uses that data to build a dynamic context graph mapping assets, ownership, permissions, and dependencies across the business.
That context is what gives Surf’s AI agents room to act with more precision. If a user account starts behaving suspiciously, for example, the platform checks the employee’s status and reviews critical dependencies before taking action.
That matters because poorly designed automation can easily break business operations while trying to fix security issues.
By preserving context through the remediation process, Surf says it helps security teams work faster without losing control.
Grindlinger said the platform is built to find and close those gaps, especially the ones teams already understood yet could not address with existing resources.
The system is built to remove repetitive handoffs and manual rework, letting teams keep up continuous pressure on exposure gaps that were often already known, though left unresolved because time and staffing ran short.
The company is already working with several global organisations and Fortune 500 firms, which gives it early commercial traction as it pushes into a crowded security market.
Surf says its system ties business context directly to security data and drives remediation while keeping human teams in control at every step. That balance, more than the AI label on its own, is likely what large enterprises will care about most.
