Crogl

Crogl runs autonomous end to end threat investigations for enterprise security operations. Founded in 2023 by CEO Monzy Merza with CTO David Dorsey and Bradford Lovering, it raised $30 million across a $5 million seed led by Tola Capital and a $25 million Series A led by Menlo Ventures, and launched out of private beta in March 2025 already deployed at Fortune 100 enterprises and government organisations.

The design position is stated bluntly: no playbooks, no schema normalisation, no manual triage, no prompt and no human trigger. An alert arriving from a SIEM, SOAR or ticketing system is detected immediately with no polling delay, and threat intelligence advisories including CRISP reports, ISAC bulletins and vendor advisories are treated as first class inputs alongside alerts rather than as a separate feed. Underneath sits a knowledge graph that continuously maps the environment across users, assets, behaviours, relationships and access patterns, an orchestration layer that plans and executes the investigation itself, and a skills library covering threat hunting, full alert investigation, report generation and incident impact analysis.

The division of labour is explicit and unusually well stated for this category: Crogl handles the investigation and the analyst makes the call. Every action is visible, modifiable and documented, and every investigation arrives fully auditable and decision ready. Given that autonomous investigation is the product, that audit posture is the load bearing claim rather than a compliance footnote.

The deployment model is what separates it from the rest of the AI SOC field. Crogl works against your tools, your workflows and your data, and states that data never leaves your environment. It also ships a free enterprise grade version that installs on a workstation in minutes on macOS or Linux with no procurement cycle, which is a distribution strategy nobody else in this lane runs. Company research it published in 2026 frames the market problem: enterprise teams receive around 4,330 alerts a day and investigate only 37 percent of them.