Vorlon

Vorlon is a Mountain View-based startup tackling a problem that most enterprises still don’t have a real answer for: what is actually happening across the dozens or hundreds of third-party SaaS and API integrations connected to a company’s environment. Founded in 2022 and launched publicly in early 2023 by Amir Khayat and Amichay Spivak — both alumni of Demisto, the security orchestration company Palo Alto Networks acquired for $560 million in 2019 — Vorlon builds an agentless platform that gives real-time visibility into SaaS-to-SaaS data flows, secrets exposure, posture issues, and anomalous behavior across an organization’s SaaS ecosystem.

The founders’ Demisto and Palo Alto Networks pedigree is a genuine credibility signal in a market where SOAR and security-platform experience translates directly into understanding what security teams actually need operationally. Vorlon has raised $15.7M total, including a Series A led by Accel with participation from Cyberstarts, Sequoia Capital, Lightspeed Venture Partners, and Innovation Endeavors — a strong investor roster for an early-stage company, though the funding scale still reflects an early, unproven product rather than a mature platform.

For CISOs, the relevance case is straightforward: SaaS sprawl and shadow API connections between SaaS tools are a growing, under-monitored attack surface, and most existing tools (CASB, SSPM) weren’t built to track the API-level data flows between third-party SaaS applications themselves. Vorlon’s agentless approach lowers deployment friction, but as an early-stage company it lacks the multi-year production track record of established SaaS security posture management vendors, so proof-of-concept results should carry real weight in any evaluation.