ArcSight veteran Colby DeRodeff raises $25 million for Abstract's composable SIEM

Why it matters

Abstract's round puts fresh capital behind a modular alternative to monolithic SIEMs. Its reported retention is strong, but undisclosed revenue and customer totals leave the scale of adoption unclear.

Colby DeRodeff, an ArcSight veteran who later co-founded threat intelligence vendor Anomali, has raised $25 million for Abstract, his three-year-old attempt to rebuild security operations around streaming data rather than a single destination for every log.

The San Francisco-based cybersecurity vendor disclosed the financing in a July 23 announcement distributed through PR Newswire. Cheyenne Ventures and AVP co-led the round, joined by Olive Hill Ventures, Crosslink Capital and Rally Ventures. Abstract said the investment brought its total funding to nearly $50 million and tripled its previous valuation, though Abstract did not give the valuation in dollars.

DeRodeff started Abstract in 2023 with CTO Aaron Shelmire and COO Chris Camacho. The founding group combines experience from the two sides of the security market Abstract is trying to connect: Shelmire built detection systems and conducted threat research at CERT/CC, Secureworks, Anomali and Palo Alto Networks, while Camacho led security programs at Bank of America and the World Bank before joining Flashpoint.

A second pass at SIEM

For DeRodeff, Abstract is a chance to revisit architecture decisions he watched harden into the first generation of security information and event management software. ArcSight helped establish the SIEM category by centralizing logs so analysts could search for suspicious activity across an organization. HP later acquired ArcSight.

After leaving Google in February 2023, DeRodeff told the Cal Poly Center for Innovation and Entrepreneurship that newer security vendors were repeating mistakes made around 2005 and 2006. Abstract joined the center's incubator while developing its first product with enterprise design partners.

Abstract's pitch is that centralization has become an expensive constraint. Traditional SIEM deployments frequently send large volumes of telemetry into one vendor's storage and analytics stack, tying detection coverage to the destination that receives the data. Abstract separates collection, detection, retention and analyst workflows. It can evaluate events while they are moving through the pipeline, route selected data to different destinations and translate it into schemas such as OCSF, ECS and CIM.

That design is meant to let a security team keep an existing analytics destination while moving some processing and detection upstream. The concession matters because enterprises often run platforms such as Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike, Palo Alto Cortex XSIAM or Elastic Security, and replacing a SIEM outright can become a long migration project.

Abstract describes the technical bet as running detections while data is still in motion. The new capital will fund broader in-stream detection coverage, further development of Abstract's Astro AI tools and an expanded go-to-market operation, according to the July announcement.

The growth figures need a denominator

Abstract reported 380% year-over-year ARR growth, 264% net revenue retention and a tripling of its customer base. Abstract also said it made 40 strategic hires during the year. Those figures suggest customers are expanding their spending quickly, particularly the 264% retention rate, which would mean the same customer group generated 2.64 times as much recurring revenue after churn and contraction.

Abstract has not disclosed absolute ARR, customer count, current headcount or pricing. A high percentage increase can come from a small starting point, and the lack of a revenue base makes the 380% figure impossible to size. The valuation claim carries the same limitation: tripling an undisclosed prior valuation gives no usable estimate of what investors paid in this round.

In its February 19 launch release, Abstract separately reported a 280% increase in new customers. The July release describes the ARR, retention, customer-base and hiring figures as occurring over the past year, but does not disclose the exact revenue base or current customer count.

Abstract's publicly announced financing adds up to $48.5 million. Crosslink, Rally and Liquid 2 led an $8.5 million seed round announced on March 26, 2024. Munich Re Ventures led a $15 million Series A announced on October 28, 2024, with Crosslink and Rally following on.

Security data is becoming the control point

Abstract is raising into a security market increasingly organized around who controls telemetry before it reaches the SIEM. Data routing vendor Cribl moved further into detection engineering with its July acquisition of CardinalOps. Databricks introduced Lakewatch, an open, agentic SIEM built on its lakehouse architecture, and agreed in June to acquire Panther, an AI-assisted security operations platform.

Those moves validate DeRodeff's view that storage, detection and investigation can be separated. They also increase the pressure on Abstract. Cribl already has a large position in vendor-neutral telemetry routing, while Databricks can sell security workloads into enterprises that already store operational data on its platform. Major security vendors including Microsoft, Google, CrowdStrike and Palo Alto Networks are building AI features into their own SIEM and security operations products.

Abstract's opening is the transition period. Enterprises rarely replace a core security platform in one move, and Abstract can enter as a routing or streaming-detection layer without requiring an immediate rip-and-replace project. That gives DeRodeff and his co-founders a practical route into large accounts while they build toward a broader security operations platform.

The $25 million round gives Abstract time to prove that the architecture can become a durable software business. The next test is measurable scale: a larger disclosed customer base, enough recurring revenue to contextualize the growth rate and evidence that enterprises treat Abstract as a control layer rather than another tool attached to an already crowded security stack.