The Failure of Post-Intrusion Security
Traditional Endpoint Detection and Response (EDR) was designed around a comfortable assumption: attackers move slowly enough for humans to spot them mid-stride. Security teams spent a decade building workflows around post-intrusion alerts. A process launches, a binary drops a suspicious payload, and an agent triggers an alert for an analyst to review. That model worked well when human adversaries had to manually map enterprise networks and execute commands over hours or days.
It collapses the moment artificial intelligence enters the picture.
On July 22, 2026, cybersecurity startup Glow emerged from stealth with a $180 million Series A round and a $1.2 billion valuation. The funding round was led by Sequoia Capital, Cyberstarts, Greenoaks, and Redpoint Ventures, with additional participation from Index Ventures, Swish Ventures, Lux Capital, Operator Collective, and Holly Ventures. Minting a unicorn before releasing public revenue numbers is rare. But investors backed Palo Alto-headquartered Glow because the way software reaches employee hardware has fundamentally changed.
Over the past decade, enterprise IT shifted toward centralized cloud infrastructure and SaaS applications. Suddenly, AI landed directly on the endpoint. Employees aren't just opening web browsers or drafting emails anymore. They are running local AI agents, running unvetted code interpreters, and integrating developer tools directly onto their laptops and servers.
At the same time, offensive capabilities are accelerating. Attackers use generative tools to automate spear-phishing, generate customized exploits, and launch multi-step intrusions in seconds. Concerns intensified when Anthropic unveiled its Mythos AI model, demonstrating advanced automated capabilities in finding and exploiting software vulnerabilities. When zero-days are discovered and weaponized at machine speed, waiting for post-intrusion telemetry isn't just risky. It's security suicide.
Heavyweight Leadership from Meta and Snowflake
Pitch decks can make any architectural claim sound revolutionary, but execution hinges on technical credibility. Glow was founded in 2025 by a team of veterans who built infrastructure at massive scale.
Chief Executive Officer Roi Tiger previously served as vice president of engineering at Meta. He co-founded Glow alongside Omer Singer, former head of cybersecurity strategy at Snowflake, Ophir Arie, former vice president of research and development at Claroty, and Arnon Joseph, a former Meta engineering leader.
The company also brought in Chief Operating Officer Emily Heath. Heath brings deep enterprise operations background, having served as Chief Information Security Officer at both United Airlines and DocuSign. She also held a board seat at Wiz leading up to its $32 billion acquisition by Google, after previously working as a partner at Cyberstarts.
Glow already employs nearly 100 people. Its operational footprint is split between its Palo Alto headquarters and an Israeli R&D hub, where about 70% of its engineering team is located. That split gives the startup direct access to Israeli security research while keeping executive decision-making close to enterprise buyer networks in Silicon Valley.
Continuous Pre-Execution Guardrails for AI Workflows
Rather than acting as a reactive logger that watches process trees execute after the fact, Glow acts as a preventative control layer. The platform relies on specialized AI agents that map local environments continuously, evaluate risk posture in real time, and enforce strict execution policies before code runs.
In active deployments covering tens of thousands of endpoints across healthcare, retail, and financial services, Glow's platform has already caught threats that traditional telemetry missed:
- Blocking malicious npm packages from being installed on developer workstations before build pipelines executed.
- Intercepting unauthorized AI agents attempting to fetch third-party software dependencies without approval.
- Flagging employee laptops and servers where existing EDR agents were missing or running with degraded functionality.
The goal isn't to replace basic posture checks. It's to stop unverified software components and rogue AI tasks before they can execute on local hardware. When an AI developer tool tries to pull down external code packages, Glow checks the integrity and policy compliance of the package in real time rather than cleaning up after a compromised binary infects the host.
Foundation Models with Enterprise Policy Context
Building an effective security control plane requires sophisticated reasoning, but off-the-shelf foundation models aren't ready to handle autonomous security enforcement on their own. Raw large language models lack internal context about corporate policy, user roles, or system sensitivity. Relying on them directly creates a high risk of false positives and hallucinations.
To solve this, Glow built an architecture that blends commercial foundation models with proprietary context engineering. The platform routes reasoning tasks to Anthropic models and Google Gemini via Amazon Bedrock.
On top of Bedrock, Glow overlays its own proprietary software layer. This context engine feeds local environment telemetry, internal corporate policy, and identity permissions directly into the underlying models. By pairing frontier model reasoning with specific enterprise policy boundaries, Glow aims to make automated security decisions reliable enough for real-time enforcement without slowing down host system performance.
Taking On the Legacy EDR Incumbents
Glow isn't competing in a vacuum. It is entering a market dominated by massive incumbents, including CrowdStrike, Microsoft Defender, SentinelOne, and Palo Alto Networks. These vendors possess enormous telemetry data lakes, established enterprise relationships, and multi-year corporate contracts.
However, legacy EDR engines remain fundamentally reactive. They collect log events, match file hashes against threat intelligence databases, and isolate systems after suspicious activity is detected. Glow is betting that enterprise security leaders are growing frustrated with detection-heavy stacks that flood security operations center (SOC) queues with endless post-breach alerts.
By focusing on pre-execution prevention for AI agents and developer workflows, Glow wants to carve out a distinct security category. Whether CISOs will view this as a complete replacement for legacy EDR or an added security layer remains to be seen. But the early willingness of enterprise buyers in finance and healthcare to deploy Glow suggests that existing tools leave clear blind spots when AI agents run locally.
The Operational Risks of Aggressive Prevention
Preventative security has always carried a trade-off. If a security agent blocks a benign developer package or halts a critical AI workflow during peak production, engineering teams hit a wall. When security rules impede business execution, developers inevitably find workarounds or demand that security controls be softened.
Glow's $1.2 billion valuation reflects huge investor confidence in its preventative vision. Yet the startup still faces significant operational hurdles as it expands beyond initial enterprise pilots. It must prove that its specialized AI agents can evaluate complex code dependencies and autonomous tool behaviors without introducing latency or breaking legitimate software pipelines.
As autonomous AI agents become standard across corporate endpoints, static signature rules and post-intrusion logging will no longer suffice. Glow has placed a massive bet on proactive, AI-native prevention. Delivering on that promise in complex, real-world enterprise environments will determine whether it can justify its unicorn status.
