1stProtect

1stProtect is a Silicon Valley-based cybersecurity firm that provides a runtime security platform for the post-perimeter era. The company emerged from stealth on March 19, 2026, with $20 million in funding from Andra Capital and All Blue Capital. 1stProtect was established by security veterans from notable tech companies including Cisco, CrowdStrike, and Symantec. The leadership team includes CEO Kervin Pillay, who was previously the CTO of Automation at Cisco, and CTO Rafel Ivgi, who has held senior positions at SentinelOne, CrowdStrike, Symantec, and Forcepoint. Pillay stated the company was founded on the idea that by the time most security tools detect an attack, the data has already been compromised.

The San Francisco-based company's core offering is an endpoint security platform that monitors system behavior and user intent to prevent cyberattacks in real-time. Instead of depending on a cloud architecture for decision-making, 1stProtect's solution enforces security policies at the operating system level. This allows it to function as a self-defending system even in disconnected or restricted environments. The platform is designed to replace fragmented security models by using a single user-space SIGMA engine to enforce policies across various attack categories. This unified architecture allows organizations to monitor and enforce policies across access, systems, and data flows without needing multiple tools.

The platform includes 22 protection modules to address threats such as credential and session theft, ransomware, data exfiltration, and attacks on applications, browsers, and Active Directory. A key feature is its on-host AI investigator, which performs local forensic analysis and remediation directly on the system, even when offline. This on-device MCP server enables threat investigation without sending sensitive data to the cloud, ensuring privacy and allowing for immediate response. The SIGMA engine can stream telemetry to existing tools like Splunk, Datadog, and Okta. 1stProtect's technology is designed for various environments, including air-gapped systems, cloud and Kubernetes, and low-latency compute settings.

Keywords: endpoint security, runtime enforcement, real-time threat prevention, cyberattack prevention, on-host AI forensics, operating system level security, SIGMA engine, zero-cloud protection, credential theft protection, ransomware protection, data exfiltration prevention, application security, browser security, Active Directory security, offline security, AI investigator, MCP protocol, security policy enforcement, Kervin Pillay, Rafel Ivgi