LimaCharlie
Composable SecOps Cloud Platform providing open-API access to EDR sensors, telemetry, detection rules, and automation for security teams and MSSPs building their own stack.
Visit Website ↗ + Add to CompareOverview
LimaCharlie sells security infrastructure as composable building blocks rather than a finished product. Its SecOps Cloud Platform gives security teams an open API to endpoint detection and response sensors, log ingestion, detection-and-response rules, and automation — letting them assemble a security stack tailored to their environment instead of adopting a vendor’s fixed EDR or SIEM bundle wholesale. This appeals particularly to MSSPs, MDR providers, and security engineering teams that want infrastructure-level control without building sensors and telemetry pipelines from scratch.
Founded in 2018 as Refraction Point before rebranding to LimaCharlie, the company is based in California and has raised approximately $15.65 million to date, including a $10.2 million Series A in February 2024 led by Sands Capital with participation from Strategic Cyber Ventures and other security-focused investors. It remains a small team (roughly 30 employees) relative to the incumbents in EDR and SIEM, but its open, usage-based infrastructure model has resonated with the growing population of MSSPs and MDR providers who need to run detection engineering at their own layer rather than inside someone else’s black box.
The company’s real differentiation is architectural: rather than shipping a closed detection product, LimaCharlie exposes the primitives — sensor telemetry, detection rule engine, automation hooks — that let a security team or service provider build their own detection stack, priced by consumption rather than by seat. That is a meaningfully different go-to-market from most EDR vendors, and it is why LimaCharlie shows up more often in security-engineering and MSSP-tooling conversations than in traditional analyst EDR rankings.
Innovation Matrix Assessment
LimaCharlie has continuously expanded its SecOps Cloud Platform's API surface (sensors, detection-and-response rules, automation, log ingestion) since its 2018 founding as Refraction Point, and its February 2024 Series A raise was explicitly earmarked for platform expansion, indicating active, funded development.
At roughly 28-31 employees, LimaCharlie is lean relative to major EDR/SIEM vendors, but its usage-based, API-first model is designed to be operated largely self-service by MSSPs and security engineering teams, which reduces (though does not eliminate) the operational overhead a small team creates.
A $10.2M Series A in February 2024 led by Sands Capital, with follow-on participation from Strategic Cyber Ventures, CoFound Partners, and others, is a concrete, independently reported funding signal; total disclosed funding of ~$15.65M is modest but shows continued investor confidence years after founding.
Exposing EDR sensors, telemetry, and detection infrastructure as composable, API-accessible primitives rather than a closed product is a genuinely different go-to-market from traditional EDR/SIEM vendors, and it specifically targets the MSSP/MDR building-block use case that closed platforms serve poorly.
No public MITRE ATT&CK evaluation results or independent third-party detection efficacy benchmarks were found for LimaCharlie specifically; its efficacy case rests on architectural flexibility and adoption by MSSPs rather than published detection-accuracy testing.
The rise of MSSPs, MDR providers, and in-house security engineering teams that want infrastructure-level control over detection logic (rather than a vendor's fixed ruleset) makes LimaCharlie's composable model directly relevant to a growing segment of security operations buyers.
Why CISOs Should Care
For security teams or MSSPs that want to build and own their detection logic rather than accept a vendor's closed EDR ruleset, LimaCharlie provides the sensor telemetry and automation infrastructure to do that without building it from scratch.
What Makes It Different
LimaCharlie sells infrastructure primitives (sensors, telemetry, detection rules, automation) via open API and usage-based pricing, rather than a finished, closed EDR or SIEM product — a fundamentally different architecture and go-to-market from most security operations vendors.
The Matrix Verdict
62/100 — INCREMENTAL INNOVATOR
A well-differentiated infrastructure play for security engineering teams and MSSPs that is gaining real, independently verifiable funding traction; not a fit for buyers wanting a turnkey EDR product, but a strong option for teams that want to build their own.
Editorial Note: Claims vs. Verified Findings
Funding amounts, investor names, and the Refraction Point rebrand are independently corroborated via PR Newswire, SiliconANGLE, and multiple funding-tracking databases. Specific platform performance or detection-coverage claims made on limacharlie.io are vendor-sourced and not independently benchmarked.
Sources
Alternatives to LimaCharlie
Abnormal AI
AI-native behavioral security platform that analyzes sender identity and communication patterns, rather than message content alone, to stop…
Palo Alto Networks Cortex XSIAM
Palo Alto Networks' AI-driven 'autonomous SOC' platform that unifies SIEM, EDR, SOAR, and attack-surface data into a single…
Fenix24
Chattanooga-based ransomware recovery specialist that has restored operations after 500+ real-world incidents, including 30 Fortune 500 companies.
Torq
AI-native hyperautomation platform positioning itself as an 'agentic SOC,' using a multi-agent system to autonomously execute large volumes…
Edge Delta
A telemetry pipeline and AI-agent observability platform that processes logs, metrics, and security data at the edge to…
Lumu Technologies
Network detection and response vendor using Continuous Compromise Assessment to show where compromise has actually happened, integrating with…