WitFoo

WitFoo builds a federated, big-data security operations platform — Conductor, Reporter, and Analytics (formerly branded Precinct) — that ingests telemetry from a customer’s existing SIEM, EDR, and network tools and correlates it into what the company calls forensic-grade “attack narratives,” aiming to replace disconnected alert streams with a single coherent timeline for SOC analysts.

Founded in 2016 by Charles Herring (a former executive at managed-security provider Solutionary/NTT Security), Tim Bradford, and Fred Ritch, and based in the Atlanta suburb of Dunwoody, Georgia, WitFoo sells on a flat per-appliance basis with unlimited data ingestion — a deliberate contrast to the per-gigabyte or per-event pricing that makes traditional SIEM costs unpredictable as log volume grows.

The company is small: public headcount trackers put it anywhere from roughly 10 to 50 employees, and its most recent capital raise came through a 2024 retail equity crowdfunding round on StartEngine rather than institutional venture capital — a materially different, and generally weaker, growth signal than the funding paths of most SOC-platform competitors.

WitFoo’s pricing model addresses a real and widely-felt pain point in security operations, but the evidence available about it is almost entirely vendor-sourced: no named enterprise customer, independent efficacy benchmark, or third-party case study was found to substantiate its integration-count or detection-narrative claims.