Deepwatch
Deepwatch is a managed detection and response firm layered on top of customers' security tools.
On the record
Checkpoint: Next funding event or strategic action under new CEO Brian Dhatt, two quarters into tenure
The call
Deepwatch is racing to rebuild itself around AI agents while its funding clock runs out and platform giants absorb the managed-response business it was built on.
Deepwatch helps companies monitor their computer networks and respond to threats by sitting on top of the security tools those companies already own, like Microsoft or CrowdStrike products. The problem is that bigger companies like CrowdStrike, Microsoft, and Palo Alto Networks are building the same monitoring and response work directly into their own tools, so customers might not need Deepwatch anymore. On top of that, artificial intelligence is starting to do the routine detective work that Deepwatch's human analysts have traditionally done, which means fewer people need to be employed to do the job. The company has not raised new funding since early 2023, has cut about 30 percent of staff in the past year, and a new CEO took over in May 2026. Watch the next funding announcement in the next year: if Deepwatch raises fresh money, it has a path forward; if it does not, the company will likely be bought by a larger competitor or forced into a difficult deal to survive.
Why
01
AI pressure: Agentic AI triage tools (including Deepwatch's own NEXA agents). AI agents now do the Tier-1/Tier-2 alert triage that Deepwatch used to bill analyst hours for, cutting its own labor model out from under it. Could AI do the core job? Yes, likely.
02
Bigger players: CrowdStrike Falcon Complete, Microsoft Defender Experts for XDR, Palo Alto Networks, SentinelOne. Platform vendors now bundle managed response into the EDR/SIEM they already sell, squeezing out independent MDR layers like Deepwatch. Could a giant copy it? Probably.
03
What protects it. Vendor-neutral SOC telemetry, integration depth across customer stacks, and a new ISO/IEC 42001 AI governance cert give it some switching-cost cover.
What would change this call
Deepwatch announces new funding round or raise within 12 months. Fresh capital would show investor confidence versus distressed financing.
A second layoff round occurs within two quarters of the November 2025 cuts. Would suggest acquisition-prep or continued financial strain.
Deepwatch is acquired by or merges with a larger security or platform vendor. Would confirm the consolidation path already seen with Red Canary and Secureworks.
A second layoff round occurs within two quarters of the November 2025 cuts. Would suggest acquisition-prep or continued financial strain.
Deepwatch is acquired by or merges with a larger security or platform vendor. Would confirm the consolidation path already seen with Red Canary and Secureworks.
Key numbers
- Headcount fell ~24% YoY to 231-250 by June 2026
- Cut 60-80 staff in Nov 2025 to fund AI shift
- Last raise: $180M Series C, Feb 2023, now stale
Named risks
- Stale capital: no new funding round since Series C closed February 15, 2023.
- Core labor-based triage model being displaced by agentic AI, evidenced by Nov 2025 layoffs.
- Independent MDR category consolidating into platform vendors via acquisition.
- New CEO Brian Dhatt only two months into tenure as of brief date, strategy unproven.
- Inconsistent third-party revenue and headcount data undermines external confidence.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| CrowdStrike (Falcon Complete MDR) | losing to | Ranked #1 in 2025 Frost Radar for MDR, bundling native managed response, July 2025 |
| Microsoft (Defender Experts for XDR) | losing to | Shipping Security Copilot autonomous SOC features comparable to NEXA, March 2026 |
| Red Canary (now Zscaler) | losing to | Independent MDR peer absorbed into Zscaler platform, August 2025 |
| Secureworks (now Sophos) | losing to | Independent MDR peer absorbed into Sophos platform, February 2025 |
| Arctic Wolf | losing to | Positioned as largest pure-play MDR competitor per 2026 buyer's guide |
| Palo Alto Networks, SentinelOne | contesting | Both bundling native managed response services against independent MDR vendors, 2026 |
Questions people ask
- Is Deepwatch profitable in 2026?
- No public profitability data exists since Deepwatch is private. Third-party revenue estimates range from $84M to $120M annually as of July 2026, with an outlier PrivCo estimate of $380M, but no audited figures or profitability disclosures are available.
- Has Deepwatch had layoffs?
- Yes. Deepwatch laid off up to 60-80 employees, roughly a quarter to a third of staff, on November 12, 2025, with then-CEO John DiLullo attributing the cuts to reallocating spend toward AI and automation investment.
- Could AI replace Deepwatch's analysts?
- Deepwatch's own blog stated on June 10, 2025 that AI can automate over 80% of routine SOC tasks and triage about 90% of alerts within minutes, and the company cited AI investment as the reason for its November 2025 layoffs of up to 80 staff.
- Who is Deepwatch's biggest competitor?
- CrowdStrike (Falcon Complete MDR) and Microsoft (Defender Experts for XDR) are platform vendors already bundling managed response and taking share, while independent peers Red Canary and Secureworks were acquired by Zscaler (Aug 2025) and Sophos (Feb 2025) respectively.
- Is joining Deepwatch a safe career move right now?
- Headcount fell about 24% year over year to roughly 231-250 employees by June 2026, following a November 2025 layoff of up to 80 people tied to AI automation, and the company has had no new funding since its Series C closed February 15, 2023.
- Who owns Deepwatch?
- Deepwatch is privately held, backed by venture and private equity investors including ABS Capital Partners, Goldman Sachs, Splunk Ventures, Springcoast Capital Partners, and Vista Equity/Credit Partners, with total funding of about $256M to $275M raised through a Series C closed February 15, 2023.
Timeline
- 2026-05-21Deepwatch NEXA achieves ISO/IEC 42001:2023 AI governance certification
- 2026-05-04Brian Dhatt appointed CEO, succeeding John DiLullo; Anand Ramanathan named President
- 2026-02Deepwatch expands SIEM-agnostic support to Securonix
- 2025-11-12Deepwatch lays off up to 60-80 employees, citing AI investment reallocation
- 2025-11-04Deepwatch launches NEXA agentic AI ecosystem with six AI agents
- 2025-08Rival MDR provider Red Canary acquired by Zscaler
- 2025-07-15Deepwatch joins Google Cloud Managed Security Services Provider Initiative
- 2025-02-18Deepwatch acquires Dassana for undisclosed sum, adding AI risk-exposure tools
- 2025-02Rival MDR provider Secureworks acquired by Sophos
- 2023-02-15Deepwatch closes $180M Series C led by Splunk Ventures, Springcoast, Vista
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Products, Competitors, Financials, Employees, Headquarters Locations (2026-05-20)
- Deepwatch Announces $23 Million Series A Investment
- Cybersecurity Services Firm Deepwatch Raises $53 Million (2022-02-09)
- deepwatch Stock Price, Funding, Valuation, Revenue & Financial Statements (2025-02-17)
- How Much Did Deepwatch Raise? Funding & Key Investors (2025-05-22)
- Deepwatch Announces Acquisition of Dassana (2025-02-18)
- Deepwatch Named to MSSP Alert's Top 250 MSSPs List for 2022 (2022-09-23)
- Deepwatch - Headcount, Funding & Open Jobs (2026-06-20)
- Cybersecurity firm Deepwatch lays off dozens, citing move to 'accelerate' AI investment (2025-11-12)
- Deepwatch Launches NEXA (2025-11-04)
- Deepwatch Achieves ISO/IEC 42001 Certification (2026-05-21)
- Deepwatch Appoints Brian Dhatt CEO to Scale Autonomous SOC (2026-05-04)