Reach Security Lands $50M to Scale Autonomous Remediation

Agentic AI , Artificial Intelligence & Machine Learning , Governance & Risk Management

A startup led by an ex-Palo Alto Networks employee raised $50 million to boost cyber defense through autonomous governance and optimization of existing security controls.

See Also: Webinar | Verifying AI Agent Activity Against Your Data Policies

The Top Tier Capital Partners-led Series B funding will allow San Francisco-based Reach Security to map multi-CVE exploit chains and identify choke points where compensating controls can neutralize entire attack paths, said co-founder and CEO Garrett Hamilton. He said Reach Security can autonomously remediate misconfigurations and drift across firewalls, identity platforms and endpoints.

"Doing things manually in silos as operators defensively is not going to work anymore," Hamilton said during a press roundtable. "And Reach is here to solve that problem, and we are solving that for some of the largest companies in the world."

Reach Security, founded in 2021, employs 91 people and has raised more than $80 million, having last received a $10 million strategic investment from Microsoft's Venture Fund in July 2025. The company has been led since its inception by Hamilton, who previously spent more than six years at Palo Alto Networks, culminating in a role as director of product management.

Preventing Exploitation Through Existing Controls

Reach uses a hybrid AI architecture, with LLMs acting as sensors for perception and contextualization, while all reasoning, decision-making, and control actions are strictly deterministic and bounded. Reach is moving from a UI-centric engagement to API/MCP-first integrations with customers' frontier models, SIEMs, exposure management tools, and homegrown systems, with success measured by token usage.

"One of the big decisions we made six months ago was to shift from measuring Reach's utility by user logins and clicking through our UI to leveraging our MCP server and APIs," Hamilton said. "So, we are now measuring the effectiveness of Reach or the utilization of Reach based on how other automated or autonomous systems are interacting with Reach to answer hard questions."

Reach has doubled its customer base, increased average deal price, and grown its Fortune 500 and Fortune 2,000 footprint across finance, healthcare, and manufacturing. The company wants to shift the economics by autonomously governing and optimizing existing control stacks to break attack chains, and is targeting large enterprises with technology sprawl and multiple adversary ingress paths, he said.

"How can we use existing controls inside the company's environment to mitigate risks, to introduce compensating controls for vulnerabilities that can't be patched or are going to be patched weeks later?" Hamilton said. "Or how do we catch the change that someone made to multifactor authentication for testing? How do we catch that within minutes after the changes are made versus days or weeks?"

Reach focuses on preventing exploitation through existing controls rather than merely identifying vulnerabilities or accelerating red teaming and malware analysis. Customers are moving to their own models to generate executive dashboards tailored to internal needs as vendor-provided static dashboards become obsolete. Reach enables this by exposing data and reasoning via API, he said.

"As a defender, you can't try something, find out it doesn't work, and then move on to the thing because at that point you've been breached," Reach Security co-founder and CTO Colt Blackmore said during a press roundtable. "You need these reliable underpinning technologies to make the correct decision the first time, make it quickly, and then move on to the ."

Neutralizing Large Classes of Vulnerabilities

Reach operates as a SaaS platform connecting to identity sources like SailPoint and Okta, attack surface tools like Armis and Axonius, and control systems. The company's agents decompose CISA advisories and vulnerabilities into exploitation chains, identify where existing controls can break those chains, and propose precise, minimal changes. It seeks to neutralize large classes of vulnerabilities simultaneously.

"We create these things called antidotes, which are the counter to toxic combinations," Hamilton said. "If we make this one change to your network or to your endpoint, we can disrupt tens of thousands, hundreds of thousands of vulnerabilities from being exploited across hosts, or protect tens of thousands of hosts with that one change."

Reach can pinpoint when a policy applied to a host is set to "alert" instead of "block" and recommend adding a CNI flag or switching to block mode to stop exploitation, he said. When facing an attack linking multiple low or medium-severity CVEs into a single chain, Reach can eliminate the entire exploit by blocking one choke point, simplifying the defender's workload and reducing alert fatigue, Hamilton said.

"To actually exploit a vulnerability, an attacker has to go through anywhere from five to 50 stages of exploitation to weaponize the vulnerability," Blackmore said. "It's a long process. It involves a lot of different kinds of techniques and technologies. Every single one of those is an opportunity for your firewall or your endpoint agent."

Reach ingests read-only data across all environments without requiring elevated access or changes to organizational policies, he said, providing objective analysis of tool overlap. The company provides data-driven recommendations to help security leaders make informed tool consolidation and contractual decisions such as decommissioning redundant tools or optimizing existing configurations, Hamilton said.

"We're not just outputting a score from one to 10 to say how exposed you are," Blackmore said. "We're showing our work along the way, and then people can use that to back up the decisions. Because at the end of the day, if we can't explain what we're doing, then there's no reason for our customers to have confidence in what we're saying."