Conifers is the company behind Resilient Cyber Defense.

Conifers is a cybersecurity company that builds CognitiveSOC™, the agentic AI SOC platform powering Resilient Cyber Defense. The platform investigates and acts on threats at machine speed, on the security tools an organization already owns, for enterprise SOCs and the MSSPs and MDRs who protect them. Conifers operates from Dallas, Texas and Tel Aviv, Israel.

Conifers at a glance.

Why was Conifers founded?

Security operations were never built for machine-speed attacks. Alerts arrive faster than people can read them, and the answer was never another dashboard or another hire.

For two decades the SOC has tried to keep up by stacking more tooling on top of human triage. Analysts inherit the gap. Queues never empty, and context sits scattered across a dozen consoles while something important waits behind the noise. Adding headcount only moves the bottleneck.

The ground has also moved. Advanced offensive capability is broadly accessible now and operates at machine speed, and intent is no longer a reliable gate on risk. Defense has to be ready for capable action, and it has to adapt as fast as environments and capabilities change.

Conifers was founded to close that gap. Rather than automating isolated steps, we built agentic AI that reasons through an entire investigation the way a seasoned analyst does, grounded in each environment and accountable for every conclusion. The work that used to wait now finishes in minutes, and the people on the team get to do the work only people can do.

What is CognitiveSOC?

CognitiveSOC is the Conifers platform. It runs the five cyber defense functions as one connected, adaptive system, grounded in each organization’s institutional intelligence, a continuously evolving model of the environment, risk, and operations. Every action stays inside human-defined authority, so security leaders can manage risk and limit impact at machine speed.

Agentic function 01

Threat intelligence

Signal from across your stack and the wider threat landscape is taken in continuously, so every investigation starts already aware of what matters right now.

Agentic function 02

Threat hunting

Hypotheses are pursued proactively across your environment, surfacing the quiet activity that never trips a single rule on its own.

Agentic function 03

Detection engineering

What the platform learns becomes durable detection logic, so coverage compounds instead of decaying as your environment changes.

Agentic function 04

Investigation

Each alert is investigated end to end, reaching a verdict the way a senior analyst would, in minutes, with every conclusion traceable to evidence, queries, and decision paths.

Agentic function 05

Remediation

Findings, evidence, and recommended actions are delivered into your systems of record and acted on within the guardrails you set.

Connected

The five functions share institutional intelligence and feed each other, which is what makes the platform improve with every case it handles. Telemetry management runs across all five as the common evidence layer.

How is CognitiveSOC different?

The differentiators are accuracy, consistency, and scale. Every result can be inspected, every action stays inside authority you define, and the whole platform runs on the stack you already operate.

Traceability

Each conclusion ships with the evidence and reasoning behind it, including the hypotheses tested and the actual queries run, so your team can review and defend every call.

Accuracy

Conclusions are checked against the ground truth of your environment. Accuracy stays above 99% across roughly 500,000 investigations, with an average investigation time of about 4 minutes.

Governed autonomy

Scope and guardrails are yours to define. Autonomy expands after performance is validated, from human-in-the-loop to human-on-the-loop, and consequential actions stay under human oversight.

Runs on your stack

A semantic layer connects CognitiveSOC to your SIEM, SOAR, XDR, and cloud platforms with no data movement. Data stays in its original location, and teams onboard in 2 to 4 hours.

In one production evaluation across a 60,000-person organization, CognitiveSOC uncovered six active compromises missed by existing tools and analysts, and cut the median time from detection through investigation, containment, and validation to under ten minutes. Investigation time falls by 87%.

Validated by analysts and independent auditors.

Named the company to beat in AI SOC agents.

Who uses Conifers?

Enterprise security teams

For SOCs that face enterprise scale and scrutiny, CognitiveSOC adds investigative capacity without adding headcount, and keeps every action governable and auditable.

MSSPs and MDR providers

For service providers, CognitiveSOC runs dozens of tenants from one place, each grounded in its own environment, so you grow margins and protect renewals.

Who backs Conifers?

Conifers is backed by firms with deep roots in cybersecurity, early-stage company building and the intersection of national security and technology.

Cybersecurity venture

SYN Ventures

A cybersecurity-focused venture firm backing the founders building the next generation of security platforms.

Early-stage partner

PICUS Capital

An early-stage investor partnering with technical founders from the earliest days of company building.

National security and growth

Washington Harbour Partners

An investment firm backing companies at the intersection of national security, technology and growth.

Who is behind Conifers?

Conifers was co-founded by Tom Findling (CEO), Alon Yotvat (CPO, Data Science), and Mark Kurman (CTO), security and AI operators who built and ran products at companies including IntSights, Rapid7, and Forescout. A board and advisors who have shaped the cybersecurity industry work alongside them.

About Conifers, answered.

What does Conifers do?

Conifers builds CognitiveSOC, the agentic AI SOC platform that powers Resilient Cyber Defense. It runs the five cyber defense functions, threat intelligence, threat hunting, detection engineering, investigation, and remediation, as one connected system on top of the security tools an organization already owns. Enterprise SOCs and the MSSPs and MDRs who serve them use it to investigate and act at machine speed without ripping out their stack.

What is CognitiveSOC?

CognitiveSOC is the Conifers platform. Coordinated AI agents share context across the five cyber defense functions and reason through an entire investigation the way a senior analyst would, grounded in each organization’s institutional intelligence. Every verdict arrives in minutes and is traceable to evidence, queries, and decision paths.

What is Resilient Cyber Defense?

Resilient Cyber Defense is the outcome Conifers delivers. It means detecting fast, containing fast, and limiting impact while an attack unfolds, then adapting so it can’t recur. It does not mean backup and disaster recovery. CognitiveSOC is the agentic platform that powers it.

Where is Conifers based?

Conifers operates from Dallas, Texas in the United States and Tel Aviv, Israel, bringing together security operations expertise and AI engineering across both locations.

Who leads Conifers?

Conifers is led by co-founders Tom Findling (CEO), Alon Yotvat (CPO, Data Science), and Mark Kurman (CTO), with a leadership team drawn from companies including Rapid7, IntSights, Forescout, and Salt Security.

Who uses Conifers?

Conifers serves two audiences: enterprise security teams that need more investigative capacity without more headcount, and MSSPs and MDR providers that run security operations for many customers at once. The platform is built for the scale, governance and multi-tenancy each of them requires.

Who are Conifers’ investors?

Conifers is backed by SYN Ventures, PICUS Capital and Washington Harbour Partners, investors with deep experience in cybersecurity, early-stage company building and the intersection of national security and technology.

How long does it take to deploy Conifers?

Onboarding takes 2 to 4 hours to value, and teams are operational the same day. CognitiveSOC connects to an existing stack through 90+ integrations, with no rip and replace and no data movement.

See CognitiveSOC investigate a real alert.

Watch an investigation run end to end, on top of the stack you already operate. Bring your toughest use case.