Fig Security

Fig Security addresses a specific, often-overlooked failure mode in security operations: detection and response capability quietly breaking without anyone noticing. The platform traces data flows through the entire security stack — from log sources, through data pipelines and data lakes, into SIEM and SOAR platforms — and alerts security teams when an upstream change (a misconfigured log source, a broken pipeline, a schema change) silently degrades detection or response coverage. It also lets teams simulate how a proposed change, patch, or new integration would affect the pipeline before deploying it, rather than discovering the break after an incident goes undetected.

Founded in March 2025 by Gal Shafir (CEO), Nir Loya Dahan (CPO), and Roy Haimof (CTO) — veterans of Israeli intelligence unit 8200 and Mamram who previously worked at Siemplify, Google Cloud Security, and Cymulate — Fig Security emerged from stealth in 2026 with $38 million raised across seed and Series A rounds, led by Team8 and Ten Eleven Ventures with participation from former Splunk and Palo Alto Networks executives as angel investors. The company operates out of New York and Tel Aviv and has said it plans to roughly triple headcount.

The problem Fig Security targets is real and underappreciated: security teams routinely assume their detection pipeline is working simply because no alerts are firing, when in fact a silent break upstream means nothing is being monitored at all. Its differentiation from broader observability or data-pipeline tools is a security-specific focus on detection and response reliability rather than general infrastructure monitoring — though as a company barely a year old, its actual detection of real-world pipeline failures at scale is not yet independently documented.