A 37-Person Startup Says SIEM Is Dead. That's Interesting. The Rest Is Guesswork.

A thirty-seven-person startup in San Jose announced version 3.3 of its AI-native security platform on March 23, 2026, ahead of RSA Conference 2026. In the same breath it tells the world that SIEM is dead and XDR is already outdated. If you've never heard of PRE Security, you're not alone. The company raised $8 million and won three consecutive years of industry awards. The claims are large enough that they're worth thinking about. The evidence for them is not.

The press release describes version 3.3 as a breakthrough release of its AI-native predictive SecOps platform. That's a mouthful of marketing. The actual question underneath it is simpler: can you predict cyber attacks, or are you just detecting them faster than before? It matters because the difference between those two things changes what security operations is fundamentally about. Detecting an attack earlier is an improvement. Predicting one is a category change.

PRE Security claims it has solved the latter. Their platform, built since late 2023, uses what they call generative, predictive, and agentic AI to identify threats before they materialize. Their website says they're "10x more effective" than legacy approaches, not "just 10% more noise." The co-founder, Paul Jespersen, has thirty years in IT and left to build this because he was frustrated with how reactive the industry had become. That frustration is legitimate. Security teams spend more time triaging alerts than actually preventing incidents. The market for a solution to that problem is enormous.

But frustration is not the same as a solved problem.

Here's what I can find that's concrete. PRE Security's platform ingests security data without traditional parsers (patent-pending technology they call Parserless), correlates signals using a language model they call CyberLLM, and layers on generative XDR detections that look for behavioral similarities rather than exact signature matches. That last part - matching by similarity rather than by recipe - is the most interesting technical claim. If it works well, it would catch attacks that evade traditional rules simply by being slightly different. That's a real problem. Attackers use AI now to modify known techniques, and rule-based systems are structurally unequipped to handle variation.

The company also introduced an agentic system called SOARGPT in version 3.3, which it announced in the March 2026 press release ahead of RSA Conference 2026. This is supposed to reason across alerts, asset relationships, and threat intelligence in real time, then execute coordinated actions without analyst intervention. It sits on top of SOCGPT (for natural language investigation), ReportGPT (for generative report building), and BreachGPT (for attack simulation). A multi-tenancy layer added in mid-2025 targets managed security service providers who juggle dozens of clients with different tool stacks. A product called miniSOC packages the platform onto a Mac mini for on-prem deployment.

You can see the product logic. The architecture is internally coherent. A single AI-native stack that ingests without parsers, detects by similarity, responds autonomously, and predicts risk ahead of time - it's a cleaner design than bolt-on AI layered onto legacy SIEM. The problem is not in the architecture. It's in the proof.

I couldn't find independent verification of the "10x more effective" claim. There's no benchmark study, no third-party evaluation, no Gartner Magic Quadrant placement. The company points to Gartner research predicting that preemptive cybersecurity will dominate 50% of IT security spending by 2030, but that's a macro forecast, not a product evaluation. The awards PRE Security has won - Gold for Best AI SecOps and Bronze for Best Cybersecurity Startup, third year running - come from the Cybersecurity Excellence Awards. Winning three years in a row as a company with thirty-seven employees tells me the product is impressive enough to stand out at a small-company level. It doesn't tell me whether it's actually replacing SIEM for any meaningful enterprise.

The company has won some deployments. They recently closed a deal with a "leading global luxury hospitality company" that selected PRE over incumbent SIEM vendors. That's real traction. But it's a single anonymous win against a category of incumbents that spans Splunk, Microsoft Sentinel, Google SecOps, Palo Alto Networks, and others - companies with thousands of engineers and decades of customer trust. A thirty-seven-person startup winning one enterprise deal is encouraging. It's also the kind of milestone any ambitious security startup should hit.

The deeper question, which the press release doesn't address, is about the word "predictive." What does prediction actually mean here? If PRE Security's AI identifies an attack pattern "in formation" by correlating weak signals across the environment before a known detection rule would fire, that's essentially faster detection. It's valuable and useful, and it could absolutely be better than what legacy SIEM does. But it's not prediction in the way the word suggests - it's correlation at a different timescale. True prediction would mean anticipating attacks that haven't started generating signals yet. That's a different claim, and it's one I haven't seen any security vendor substantiate with independent evidence.

This isn't unique to PRE Security. Every company that claims to do predictive threat intelligence is really doing very fast correlation. The difference between "we found it three minutes before your SIEM would have" and "we predicted it" is semantic, not architectural. The reason the distinction matters is that customers pay very different amounts for those two things. Predictive is a category change that justifies premium pricing. Fast correlation is an improvement that competes on price.

There's another layer here worth sitting with. The company has 37 employees and $8 million in funding. The security operations market is dominated by incumbents with massive installed bases, compliance-driven buying cycles, and customer trust built over years. Replacing SIEM isn't a product decision for most enterprises. It's a months-long procurement process that involves legal, compliance, risk, and budget committees. The friction is enormous. The miniSOC product, packaged onto a Mac mini, is a clever workaround that lowers the barrier to entry. Clever doesn't mean scalable.

The company's public presence - 1,775 LinkedIn followers as of October 2025, a website that reads like it was built by engineers who haven't hired a marketing team - suggests a company focused on product rather than demand generation. That can be a strength. It can also be a vulnerability if the market doesn't find you on its own.

I suspect the honest version of this story is that PRE Security has built something genuinely interesting. The Parserless ingestion is a real pain point - SIEM pricing based on data volume has forced organizations to limit the telemetry they collect, which means they're missing signals. An AI-native architecture that doesn't have that constraint would be structurally better for the customer. The similarity-based detection approach is also the right direction. The industry needs to move away from hand-written detection rules toward behavioral understanding.

But "structurally better" and "replacing SIEM" are very different things. And "replacing SIEM" is what the company says it's doing.

The way to think about this isn't to decide whether PRE Security is a scam or a revolution. It's to ask whether the gap between their technical architecture and their public claims is a feature or a bug. If it's a feature - if the company is deliberately underselling its product to let results speak for themselves - then I'd expect to see independent customer evidence appearing soon. If it's a bug - if the claims outrun the execution - then the version numbers keep incrementing and the proof keeps getting deferred.

Here's the test I'd use. Watch whether PRE Security publishes third-party benchmark data within the next twelve months. Not a case study from a friendly customer, but an independent evaluation comparing their platform's detection and prediction capabilities against a legacy SIEM on a shared dataset. If the results hold up, the "SIEM is dead" claim becomes worth taking seriously. If they can't or won't do it, the platform may still be useful, but it's not what the press release says it is.

Most people in security are tired of reactive tools. PRE Security understands that frustration better than most, because they built their product specifically to solve it. Whether they've actually solved it, or whether they're selling a cleaner version of the same old problem, is something only the next round of independent evidence can answer.