7AI CEO Lior Div On Building Up A ‘Generational Company’ In Agentic SOC With The Channel

‘There is a rare opportunity to build a company that is in the size of Palo Alto [Networks] or CrowdStrike’ in the area of agentic SOC [Security Operations Center]—and working with partners is the only way to achieve the ambitious goal, Div tells CRN.

The dramatic shift to AI-driven security operations now underway is creating an opportunity to build a vendor on the scale of the cybersecurity industry giants—an ambitious goal that agentic SOC startup 7AI is pursuing by focusing its growth strategy fully on the channel, 7AI co-founder and CEO Lior Div (pictured center) told CRN.

Without a doubt, the opportunity to create a “generational company” in the agentic SOC (Security Operations Center) space requires a strong commitment to the channel from the get-go, Div said during an interview with CRN Executive Editor Jennifer Follett (pictured left) and Executive News Editor Steven Burke (pictured right) at the 2026 XChange Best of Breed Conference.

“I am a big believer that there is a rare opportunity to build a company that is in the size of Palo Alto [Networks] or CrowdStrike,” he said. “And in order to do that, at least in the U.S., in order to conquer this market, you cannot do it alone.”

In other words, “if you are a founder that wants to create a generational company—a company that actually will change the world—then there is no other way [than] to standardize yourself 100 percent on the channel community,” Div said during the conference, hosted by CRN parent The Channel Company in Atlanta.

That’s why 7AI hired a head of channel prior to any salespeople, he said—and why every deal the company has closed has involved partners.

“Even if a customer’s saying, ‘Hey, I want to do it alone’—we’re going to transact with some of our channel partners,” Div said. “Because we believe that’s the only way to go to market and build a big company.”

7AI was launched in 2024 by Div, a repeat entrepreneur in security who was formerly co-founder and CEO and Cybereason and has been among the fastest-growing players in the emerging market for agentic SOC platforms. The startup unveiled its first formal channel program in July following partnerships with major solution providers such as GuidePoint Security and DXC Technology.

In December 2025, 7AI raised a $130 million Series A funding round, led by Index Ventures. The round was the largest Series A in cybersecurity industry history at the time, according to 7AI.

Competitive Market

At this point, it’s clear that competing in the now-crowded agentic SOC market requires a fundamentally new approach to security operations technology, built for the era of AI-powered attacks, Div said.

“We’re not going to bolt AI on top of what we’re doing,” he said. “Everything that we build is AI-first or AI-native.”

That approach can make a major difference in a fast-moving and dynamic threat environment in part because 7AI is able to allocate its engineering organization to directly work with partners and customers, according to Div. That can enable faster development of new capabilities, he said.

A key difference between 7AI and larger players such as Cisco-Splunk is that with 7AI’s approach, “the data can stay where the data was born,” Div said.

In other words, 7AI is “meeting [customers] where they are. So we’re not asking them to move the data,” he said. “But then what they see over time, they’re saying, ‘Why am I paying so much and putting the data in Splunk [when] I can keep the data in a cheaper storage like an S3 bucket, and still get all the benefits of detection and reporting out of cheaper storage?’”

Ultimately, “we help them to basically flip the dollars that they are putting [toward] storage to dollars that go to security,” Div said. “That generates a situation [where] these customers are actually paying the same but becoming much more secure.”

What follows is more of CRN’s interview with Div.

Can you give us a little introduction into what the agentic SOC market looks like right now, what role 7AI is playing there and how you think the opportunity might be developing for your channel partners?

We’re a big believer in the channel community. What’s happening right now is there is a massive transformation in the cybersecurity market. Basically, the bad guys, hackers, are leveraging AI in order to attack us. This is something that we anticipated basically two and a half years ago when we started the company, to see this uptick. But right now it’s become clear that the bad guys are using AI in order to attack us. So the whole purpose about building 7AI was to counter that kind of motion and fight fire with fire—so literally create AI that can defend big organizations. And that’s translating to be a little bit more technical. Usually, the way that the companies are protecting themselves right now is bringing all the data to one place, a SIEM, then writing detection, doing investigation and then 24x7 eyes on glass. So I call it the pyramid. We believe that this pyramid eventually will become one technology that can create detection, go to the data--instead of the data being sent [to] one place—do investigation, respond and run in a loop [for] constantly protecting an organization. So it’s transforming completely the whole 24x7 eyes on glass in the way that we’re doing it. People can be mistaken by me [as] saying, 'Oh, we don’t need people.’ This is false because in the era of cyber, you always want to trust people. Just the job of the people is changing to be on the loop instead of being in the loop.

What was the moment where that spark came to you that you said, ‘This is what I want to do, and I’m going to call it 7AI?’

It’s important to start back and say, my first company, I ran that company for 12 years, and it was a big company. It was 1,500 people at the peak. We raised a lot of VC money, almost $1 billion, and it was hundreds of millions of recurring revenue. So once I was done with this company, I thought that I’m going to retire. So I’m painting, and I did it for two months, and then I realized that I can’t do it anymore. But the point is, we had a conversation, me and my co-founder, with the guy that was releasing ChatGPT 3.5 to the public. So that was the first time that everybody realized that AI can do stuff for us. And in that moment, we had a long conversation. It was supposed to be a 30-minute conversation and became a three-hour conversation, and we started to go deep. And it was clear to us that everything that we did in the past 30 years in order to protect organizations will change in a dramatic way. And if we’re not going to create AI to defend, we’re not going to be able to win. So for us, it was all about the mission, and that’s kind of the spark. I knew that day that we can create a big company around it, and as a result, 7AI right now leads in this market.

What does it mean to have an agentic SOC? What does that do for the customer, and what does that do for the partner?

I think that the first effect you see is the time is shrinking in a dramatic way. So if in the past it takes sometimes half an hour to an hour for a human to run an investigation and actually understand what just happened, AI can figure out those things in sometimes less than a minute—let’s say sub-10 minutes. This is shrinking the time to understand if you are under attack or not. And it’s shrinking the time to actually start the response process. And shrinking the time for the bad guys to be inside your environment. So this is the maximum effect that we see. This is without talking about identifying—using hunting and new detection—new types of attacks that are emerging and changing because of the use of AI. So this is us countering what the bad guys are doing with the new detection and ability to respond to that. To the partner community, we have multiple [types of] partnerships. We have people that resell the software. We have people that basically leverage our technology in order to serve their customers, so MSSPs and MDRs. So we have different types of engagement. And I think that the best effect is, you see kind of the level of how happy the customers are, moving from here to here in a split of a second. This is something that we knew [would be an advantage]—but right now, I don’t think that we have a single customer that is not happy. So all of them are super happy with what they see.

Is there any particular example you can point to of saying this worked exactly like we wanted it to, and I’m so proud of the way this came out?

Nothing is working exactly. So I don’t think that anything is out of the box working [perfectly]. I’ve been doing it for too long to know better that it’s never going exactly. But our thesis was that AI will be able to do investigation better than a human being. At the beginning, I think that we reached 80 percent [automation]. It was OK, but it was not [enough], and this is what you see a lot in the market. So you can leverage AI and you reach to 80 percent of what you needed to do, and then you’re kind of stuck. It took us almost another year in order to develop our own harness, skills, memory in the AI infrastructure—and not just using OpenAI or Anthropic in order to reach from the 80 percent to the 95 percent. Once we reached that, there is an ‘aha’ moment and almost a magic moment that people don’t think that you can reach to this level of accuracy, even in the channel community. But that affects the customer in a massive way.

What does that translate to then in terms of economics and ROI?

Usually we’re used to saying cheaper, faster, better. I’m not sure that it’s cheaper, but it is faster and better. So people that do appreciate the quality and the speed to mitigate attack, this is the right solution for them. In many cases, what’s happening [is that] it’s not becoming cheaper, but we can give them much more offerings that usually they cannot do. For example, hunting capability—the ability to go into an environment and seek, and in a very active way to check if the bad guys are there or not, and are they doing something bad or not—this always was on a wish list of CISOs, chief security officers, and never managed to actually do it. And right now, we see that it becomes almost part of everything that we’re doing—that it’s part of the offering. So you’re kind of paying the same, but you’re getting much more.

Can you give us a quick overview of the competitive landscape and what that looks like?

I think that we can divide the market into two [parts]. So there is the MDR and MSSP that is based on humans. And what they are doing, they are saying, ‘This is the way that we used to do it. Let’s add AI on top of what we’re doing.’ And there is this type of company like us that’s saying, ‘No. We’re going to [redesign] the whole thing, and basically we’re not going to bolt AI on top of what we’re doing.’ Everything that we build is AI-first or AI-native. That’s a change in the way that we build the company. So, for example, in the past with a SaaS company, usually you’d have the customer and the R&D, and you’d try to separate them as much as possible. So you’d create customer success and support and product—and you’d make sure that the customer will never speak with the R&D. What we did now is actually change it completely. So the first thing that we did, we put engineers in front of the customer, and we call them AI security engineers. And then there is the engineering that’s supporting the AI security engineers, and the AI security engineers basically serving the customers. This has enabled us to have a conversation with the customer, and the customer can say, ‘Hey, I need this feature,’ and in a 24-hour cycle, we’re going to build something new, implement it in production and provide it to the customer. This is something that you cannot do if you did not architect your company to be AI-native.

What is the partner ecosystem, as far as other technology partnerships? Are some of these large platform companies, like CrowdStrike or Palo Alto Networks, potential technology partners for you?

So yes and no. We are like the UN, to be honest, because we by now have built almost 200 connectors. So we’re connecting to Palo Alto, we’re connecting to CrowdStrike, but we’re [also] connecting to a company that probably you’ve never heard of. So when you have 200-plus connectors, you connect to everybody, and you can consume [all of their] data. The way that we architected the solution, we don’t have to bring all the data to one place. We can go to the data. So that’s a big change because this is changing kind of the dynamic for the data and how you’re saving the data and so on. When it comes to the partner community, I think that more partnership is better for us. That’s the reason that one of the first hires we did at 7AI was a person whose job is to make sure that we’re partnering not just with the channel partner to sell—[but] it’s with the MDRs, MSSPs, technical partners, the Big Four and all the others. So we have a very robust ecosystem of partners.

How do you stack up against Palo Alto Networks or Cisco-Splunk?

So the approach that we took is a very different approach. The approach of the big guys is usually, ‘Hey, bring all the data’—the conversation is starting by, ‘Bring all the data to my data lake, and then I can do all of those things for you.’ We took the opposite approach. And we’re saying, ‘No, the data can stay where the data was born.’ So if you have the data in Splunk, you can keep it in Splunk. If you have it split between Splunk and an S3 bucket, it can stay there. And then we’re building on top of that, so we have detection capability that is a federated detection capability, and then investigation, response capabilities and hunting capability. All of them are federated. We’re starting [by] meeting people where they are. So we’re not asking them to move the data. But then what they see over time, they’re saying, ‘Why am I paying so much and putting the data in Splunk [when] I can keep the data in a cheaper storage like an S3 bucket, and still get all the benefits of detection and reporting out of cheaper storage?’ So we help them to basically flip the dollars that they are putting [toward] storage to dollars that go to security. That generates a situation [where] these customers are actually paying the same but becoming much more secure.

Because you’re using AI, are you seeing threats that the legacy platforms can’t see? What has surprised you?

There are a few things that come to mind. One is the speed—the moment that there is a small signal, [the system can] figure out if you are under attack or not. This is second to none. We are talking about speed that we never managed to do before. But the second thing is the coverage and the quality of the coverage. What we see in many organizations that we’re coming into is that the detection that they have was very crafted to a specific thing that they had in their mind—and usually they are doing good if they have the right people. But it’s very limited [in terms] of what they are looking at. So, for example, the ability to take threat intel that just came out, understand that thing, write a new detection, check this detection and respond to that detection—that thing can happen with 7AI in minutes. This is something that used to take sometimes weeks or even more, or usually it’s never—because the list is just growing and growing. And this is kind of changing the dynamic because you can cover more and respond faster—and it’s really giving the upper hand to the defender. When we’re talking about AI that defends, that’s the idea.

What are the economics of the number of SOC analysts you’re replacing when you go in and do engagement with a partner?

I can give an example of a big MSSP that we are supporting. They are standardized on 7AI. They are [generating] $500 million in revenue that’s coming from this MSSP business. So they had 45 people in their SOC. These 45 people basically shrank to less than 10. The rest of the people, they didn’t let them go. So the rest of the people are now offering different types of services that they couldn’t offer before. As a result, business is going up and the customers [are happier]. People are very afraid. It’s like, ‘OK, AI will take our job.’ At least in security, it’s not really happening. People are very quickly retooling themselves and very quickly shifting to their bucket list of all the things that they wanted to do—and by the way, the customer wanted [this to be done] for them. And now there is a new opportunity that emerges as a result of that.

What are you looking for from partners to go all in? What’s the ideal partner for you?

If you’re a founder that wanted to create a company and flip the company and sell the company, you don’t need anybody and you don’t need the channel. But if you are a founder that wants to create a generational company—a company that actually will change the world—then there is no other way [than] to standardize yourself 100 percent on the channel community. So as a result, I am a big believer that there is a rare opportunity to build a company that is in the size of Palo Alto [Networks] or CrowdStrike. And in order to do that, at least in the U.S., in order to conquer this market, you cannot do it alone. This is the reason that my first hire was a head of channel, before I even hired any sellers— because we knew that if we’re fostering the right relationships, and we have the right programs to go with the channel partners, then we have the right pipeline. And then we can reach the territories. Because when it comes to cybersecurity, there is something to [be said] about trust. [When] the company is new, you cannot just assume trust. But [the partner community] that’s already established the trust with the customers can help us to get trusted by a customer and start selling. This is the reason that there is not a single deal that we’ve closed so far—and [7AI has] closed many—that has been done alone. Not a single [deal]. Even if a customer’s saying, ‘Hey, I want to do it alone’—we’re going to transact with some of our channel partners. Because we believe that’s the only way to go to market and build a big company.

What's the risk with staying with the old security model?

Once we realized that a new technology emerged, like AI, that’s actually giving you the ability to write faster code and find vulnerabilities faster. Using those two things, if you have the intent, it’s now shrinking the time to attack in a significant way. And the quality of the attack goes up in a significant way. So if in the past it took sometimes a year to find a zero day, and then take you another 20 people to create something that can [exploit] this vulnerability, it took half a year to do that. And that was a secret. Right now, Anthropic, specifically Mythos, they can generate those things on an hourly basis. And right now, if you go back to China with the open-weight models, GLM-5.3, it’s almost equivalent to the Mythos technology. And that is available now to every hacker that exists out there. So [with] open-weight models, you can just download it and use it on your machine. So now, when you combine this level of sophistication with the bad intent, this is creating a very pivotal moment in the cyber arena. We will see more and more people attacking, just in a faster cadence. So if we’re staying in the old approach, we’re going to be crushed. We’re not crushed yet because those technologies are evolving right now. But we used to say, ‘Hey, we have two years.’ Those two years became, ‘Hey, we have half a year.’ And right now, in my reading, with the risk [of] predicting the future, I think that this time is shrinking and shrinking. [It’s shrinking] to the point that I am anticipating that, somewhere in the near future, we will have a moment [similar to what] we had with Bitcoin and hacking that created ransomware as a business model. We’re going to have a moment, in the near future, that bad intent with open-weight models will enable hackers to [do mass exploitation] when it comes to big organizations. And I’m very afraid that if customers are not starting to adopt the new technology—and staying in the old model—it’s going to be too little, too late. But we still have this window that we can respond and do something. And sometimes, even if you do just the first step, it’s better than not doing anything.

Microsoft CEO Satya Nadella over the weekend was talking about the need for some kind of emergency brake or an AI kill switch. What’s your view on that?

[The question is] if they can build it. I don’t know how to build a kill switch. I’m less concerned about Microsoft and I’m less concerned about OpenAI or Anthropic. I’m more concerned about, as I said earlier, the open-weight models that are literally right now, as we speak, in the hands of [attackers] we don’t know. And those people do not have a kill switch. Those people we’re not controlling. Those are people that are not working under our regulation. And even when it’s come to values, they’re not working under the same values that we’re working under. So can we control ourselves for the benefit of us? Yes. But when it comes to enemies from the outside, that’s a different problem.