Ask a CISO how many laptops their company has, and they can usually answer.
Then ask which of those laptops are missing endpoint protection. Then which belong to executives. Then which are running software with an exploitable critical vulnerability. Then who is going to fix them, and how you’ll know they did. Each question pulls in another system, and each system describes the same devices and people differently.
On its own, each question sounds like something a security team should be able to answer in seconds. In practice, by the time you’re three levels deep, engineers aren’t just looking up one stat. They’re spending hours, if not days, exporting CSVs, writing one-off scripts, and messaging colleagues to sort out duplicate devices, reused email addresses, and stale records. And even then, nobody fully trusts the final answer.
Security teams don’t lack data. The average organization runs 83 security tools from 29 vendors, according to IBM research. What’s missing is context: the relationships between devices, people, vulnerabilities, and owners, which aren't captured in any one place. Northstar Security was built to be that missing layer, a living map of the security environment that both people and AI agents can query and act on.
Why security’s context problem is still unsolved
The security industry has tried to close this context gap several times, and each attempt has left the hardest part, connecting the data, to someone else.
Data lakes centralize the raw data but leave security teams to hire data engineers and analysts to make sense of it. What those teams need is answers. Vendor copilots are useful inside their own ecosystems, but no enterprise runs a single-vendor security stack, and a copilot that only sees its maker’s data can’t answer a question that spans five tools. Generic AI-for-BI tools can write a query, but they don’t understand how a user, a device, a cloud workload, and a vulnerability finding relate to one another. And none of these approaches solve the harder problem underneath: the same users and devices show up in several systems under different names and IDs (jdoe in one system, john.doe@company.com in another). Reliably recognizing that they’re the same person or machine is much harder than it looks.
The newest approach is to point AI agents directly at security tools through individual MCP servers and let them work it out. This approach, however, inherits the same problem and makes it worse. Every agent rebuilds the picture from raw data on every task, which is slow and expensive. Hard cases, such as reused email addresses, job titles that differ between HR and identity providers, or stolen laptops, get resolved probabilistically. Two runs of the same question can return two different answers. In security, an answer you can’t reproduce is an answer you can’t act on.
What Northstar built
The core of Northstar’s platform is the Security Context Graph. Northstar connects to security tools and the systems around them, including AWS, CrowdStrike, Okta, GitHub, and Workday. It streams their data into a schema built around the entities that matter to security: people, laptops, servers, cloud resources, SaaS apps, vulnerabilities, and code. Records from different tools are resolved into shared entities, normalized, and deduplicated up front, so a laptop in device management, endpoint protection, and the vulnerability scanner becomes one device with one owner. The graph keeps both current and historical state, and it surfaces its assumptions about the environment so customers can correct them.
A reasoning engine that works like an expert analyst sits on top of the graph. It interprets the question, plans the steps, generates precise queries, and explains how it reached the answer. The most important design choice is what Northstar lets AI decide. Language models interpret questions and write queries, but they never decide whether two records describe the same laptop. Entity resolution is deterministic, which is what makes the answers repeatable.
Think back to the opening questions. With Northstar, a CISO can ask them all at once and get a single answer: which executive laptops are missing endpoint protection and running software with an exploitable critical vulnerability, and who owns each one. Northstar can then open remediation tickets and track them until they’re closed. Teams can also run these checks continuously, with Northstar proposing fixes for a human to approve. Over time, Northstar will handle more of those fixes on its own and report back to the security team. Endpoint coverage is one example. The same approach applies to excessive access, cloud misconfiguration, vulnerability prioritization, and more.
Northstar’s founding team
Amer Deeba and Ed Rowe first worked together at Adobe in the late 1990s, bringing PDF to the web. Ed handled the file format work, while Amer built the browser integrations with Netscape and Microsoft. More than 25 years later, they reunited to build Northstar, each bringing a different view of the same problem.
As the CTO and CISO of Farmers Business Network, Ed, previously SVP of Engineering at AppDynamics, regularly pulled senior engineers off production work to answer basic cross-tool security questions. Amer saw the problem from the vendor side. As an executive at Qualys, he watched large customers export vulnerability data into their own data platforms and staff entire teams to build dashboards on top of it. He went on to co-found Normalyze, a data security posture management company acquired by Proofpoint.
Between them, Ed and Amer have seen this problem from both sides of the table. They’re joined by Alex MacDonald and Chris Brichford, longtime Adobe and FBN collaborators who have been building the company alongside them from day one.
Why now
Security operations is moving from software that people operate to agents that do the work. Security teams want the leverage that agents offer. But an agent is only as good as the context it reasons over. Point it at fragmented, disconnected data, and it will make confident decisions based on a wrong picture of the environment. That’s why the layer that holds an accurate, continuously updated model of the environment, and serves it to every agent that needs it, becomes the substrate security operations run on. Northstar is building that layer. Its context graph powers Northstar’s own agents and is exposed through MCP, so customers’ agents can use it without rebuilding the picture from scratch.
Wing has invested in enterprise security and data infrastructure for years. The categories that last are built around a system of record. In agentic security, that system of record is the context agents reason over. Owning it takes deep domain knowledge, careful data engineering, and the judgment to know where AI belongs and where it doesn’t. Amer and Ed bring all three.
We’re proud to lead Northstar’s seed round, alongside MVP, Outliers, and security veterans Gerhard Eschelbeck, Renaud Deraison, and Justin Somaini. We’re excited to partner with Amer, Ed, and the team as they build the foundation for agentic security operations.
