In an industry drowning in alerts and struggling with chronic analyst burnout, Dubai-based Secure.com is taking a fundamentally different approach to cybersecurity operations. Rather than building another security tool to add to an already overwhelming stack, the AI-native company has developed Digital Security Teammates (DSTs)always-on AI agents that function as embedded colleagues within security teams. These teammates don’t just flag issues or provide recommendations; they actively investigate alerts, triage incidents, correlate threats across platforms, and execute remediation workflows with human oversight. For security leaders facing the impossible equation of exponentially growing workloads without corresponding team growth, DSTs promise to deliver what the industry has desperately needed: more hands, not more dashboards.
Founded by a team with nearly two decades of experience securing platforms for millions of users globally, Secure.com emerged from Disrupt Labs, the venture studio behind multiple high-growth companies including the $350M Cloudways exit. In this exclusive VMblog Q&A, secure.com CEO and co-founder Uzair Gadit breaks down how DSTs achieve up to 60% false positive reduction in current deployments through deep contextual knowledge graphs and cross-tool correlation, why their approach differs fundamentally from AI copilots offered by Microsoft, Google, and CrowdStrike, and how a single DST can scale to cover the repetitive workload of multiple L1 analysts without requiring additional “seats.” With deployment times as short as 48 hours and integration across 200+ platforms, Gadit explains why this isn’t workforce displacementit’s workforce elevation that finally lets security professionals focus on strategy instead of ticket-chasing.
++
VMblog: Can you start off by telling us a little bit about the company, for those folks who may not know about Secure.com yet?
Uzair Gadit: Secure.com is an AI-native cybersecurity company solving the biggest operational crisis in the industry: the workload has exploded, but teams haven’t. Today, AI accelerates threats – but most security teams are still stuck fighting fires manually. That’s not scalable.
We’re building Digital Security Teammates – always-on AI agents that embed directly into your stack. They investigate alerts, triage incidents, flag misconfigurations, and surface risks and remediate- all in real time, with human-in-the-loop transparency. Think of them like an extra colleague who never sleeps, never burns out, and handles the grunt work so humans can focus on judgment and strategy.
No new tools. No rip-and-replace. Just augmented capacity and faster decision-making.
We’re headquartered in Dubai and work with mid-market to enterprise customers across saas, finance, healthcare, and cloud-native industries – all of whom are trying to stay secure without hiring a 20-person SOC. Our mission is simple: help security teams defend at scale – without scaling headcount or cost.
Secure.com is incubated by Disrupt Labs, the venture studio behind several high-growth, AI-first companies spanning cybersecurity, cloud infrastructure, DeFi, retail etc. Disrupt has consistently backed and built multi $100M+ ventures, including the $350M exit of Cloudways and the successful $40M+ Zignaly ICO-effectively an “exit” to the public market within the crypto ecosystem.
With over 18 years of legacy & leadership in cybersecurity through trusted brands like PureVPN and PureSquare, Disrupt.com‘s technologies are white-labeled or resold by global industry leaders such as Samsung, TP-Link, and power critical infrastructure for enterprises, including Prudential Insurance and DAZN.
VMblog: According to the latest announcement, it sounds like you are positioning DSTs as “teammates” rather than just another security tool. Can you walk us through what that actually means in practice? What does a typical day look like for a security analyst working alongside a Digital Security Teammate, and how does this differ from using traditional SIEM or SOAR platforms?
Gadit: Absolutely. When we talk about Digital Security Teammates, we’re being very intentional – this is not another tool you bolt onto your stack. It’s an always-on colleague that works alongside your analysts, takes on the repetitive workload, and collaborates with them the way a real teammate would. Basically, a force multiplier, once deployed, can begin to deliver value in 30 mins.
Here’s what that means in practice.
In most companies today, analysts spend their day jumping between SIEMs, EDRs, cloud consoles, spreadsheets, and ticketing systems. Every alert demands manual investigation: pulling context, checking logs, validating false positives, figuring out ownership, creating tickets, and chasing people for remediation. By the time they’re done, the next hundred alerts have already arrived.
A Digital Security Teammate changes that workflow entirely.
From the moment an alert fires, the Teammate automatically investigates it – enriching it with threat intelligence, checking the user’s behaviour, identifying the asset owner, evaluating business impact, and mapping potential attack paths. Minutes later, the analyst receives a clear, human-readable summary in Slack or Teams: what happened, why it matters, and what action is recommended. One click approves the remediation workflow, and the Teammate executes the fix, documents the case, and updates SLAs across tools.
The same thing happens across the rest of the security program.
The Teammate discovers and classifies assets, detects vulnerabilities and misconfigurations, correlates identity risks, monitors for drift, and proactively highlights issues before they become incidents. It also handles the administrative work analysts hate – ticket creation, routing, follow-ups, evidence collection, and reporting – all with full transparency and human-in-the-loop approvals.
The result is a typical analyst day that shifts from firefighting to decision-making. Instead of hunting through dashboards, they get high-quality investigations done for them. Instead of manually stitching together context, it arrives pre-analysed. Instead of running scripts, they simply approve or escalate. Instead of drowning in alerts, they focus on the handful that truly matter.
That’s the fundamental difference between a tool and a Teammate.
Traditional SIEM or SOAR platforms give you data and workflows. A Digital Security Teammate gives you outcomes. It reduces the noise, handles the grunt work, communicates like a colleague, and scales the team’s capacity without adding headcount. It’s a step toward what security teams have been asking for years: not more tools, but more hands.
This shift – from dashboards to collaboration, from tools to teammates – is what allows lean security teams to defend at enterprise scale without burning out.
VMblog: Reducing false positives by 90% is an extraordinary claim in an industry where alert fatigue is endemic. What’s the underlying methodology that makes this possible? Are you using novel ML models, unique contextual enrichment, or something else entirely-and how do you maintain that accuracy as threat landscapes evolve?
Gadit: Reducing false positives at scale is difficult, and we anchor our claims in what we see in real deployments today. Across current customers, our Digital Security Teammates reduce false positives by up to 60%. The 90% figure applies only to our next-generation teammate which is still in development and depends heavily on the customer’s integration depth and visibility.
The performance we achieve today comes from three core mechanisms already built into the platform:
1. Deep Contextualization Through a Unified Knowledge Graph
Most false positives occur because traditional tools evaluate alerts in isolation.
Our DST continuously builds a knowledge graph that connects:
- assets and their criticality,
- identities and privileges,
- configurations and drift,
- vulnerabilities and KEV exposure,
- network and application dependencies,
- owner and business context.
So, when an alert such as an “unusual login” or “port scan” appears, the DST evaluates it inside this entire context. If the asset isn’t sensitive, the identity is behaving within normal patterns, and the path isn’t exploitable, the alert is deprioritized automatically.
This contextual layer is already part of our current deployed system.
2. Cross-Tool Correlation (SIEM + EDR + Cloud + IAM)
Most false positives originate from siloed tools that fire independently – SIEMs flag anomalies, EDRs flag behaviour, and cloud platforms raise configuration drifts.
DSTs correlate signals across the full stack:
- SIEM event data (normalized via OCSF)
- EDR detections
- cloud telemetry (AWS, Azure, GCP)
- identity posture (MFA gaps, privilege changes, role baselines)
- vulnerability & misconfiguration findings
- attack paths and exposure mapping
This correlation filters out alerts that are technically unusual but operationally benign.
For example, a scan on a non-critical, isolated dev server is not escalated the same way as one on a finance database with an exposed misconfiguration and a known KEV vulnerability.
This multi-source correlation is a major contributor to our current 60% reduction.
3. Human-in-the-Loop Reinforcement
DSTs are designed with human oversight, not unchecked autonomy.
Every analyst’s decision:
- dismissing a false alert,
- approving a remediation,
- escalating a case,
- clarifying asset behaviour,
feeds back into the DST’s internal scoring model.
Over time, the DST becomes environment-specific – learning your assets, your behaviour patterns, and your threat surface.
In several deployments, once this tuning period completes, certain alert categories see zero false-positive escalations.
Maintaining Accuracy as Threats Evolve
Accuracy is not static. DSTs maintain performance through:
- continuous ingestion of threat intelligence (CISA KEV, CTI feeds, ATT&CK updates),
- regular model updates for behaviour and anomaly scoring,
- configuration drift detection,
- baseline recalibration,
- and ongoing reinforcement from analyst actions.
This keeps the system aligned with both emerging external threats and internal environment changes.
In summary
The false-positive reduction is real because the DST doesn’t treat alerts as isolated events.
It evaluates them through: context (knowledge graph) + correlation (cross-tool signals) + reinforcement (human oversight).
That combination is what enables up to 60% reduction today, and it’s the foundation for achieving higher reductions in next-generation teammates under the right conditions.
VMblog: You mention that half of security leaders are considering leaving the profession due to routine work. As DSTs take over more tier-1 and tier-2 analyst functions, how do you see the role of human security professionals evolving? Are we looking at workforce displacement, or workforce elevation?
Gadit: It’s workforce elevation, not workforce displacement. DSTs are explicitly designed to augment human work with a strong human-in-the-loop requirement.
Security teams spend up to 60% of their time on work never intended for humans: triage, evidence gathering, config checks, ticket updates. That’s what’s driving burnout.
DSTs remove the repetitive layers so humans can focus on strategy, threat hunting, incident analysis, and high-judgment decisions. Teams that adopt DSTs don’t shrink – they finally get to do the work they were hired to do.
A useful analogy is cloud automation:
It didn’t eliminate cloud engineers; it eliminated the undifferentiated heavy lifting. DSTs bring the same leverage to security teams.
VMblog: Microsoft, Google, and CrowdStrike are all integrating AI copilots into their security platforms. Palo Alto has Cortex. What makes Secure.com’s approach fundamentally different from these embedded AI features, and why should a CISO choose a standalone DST over enhanced capabilities from their existing vendors?
Gadit: What makes our approach fundamentally different is that we didn’t build an AI feature inside a traditional security product – we built a full-time operational teammate that works across the entire security program. It’s the result of designing for the problems we’ve lived through ourselves over nearly two decades of building and scaling security infrastructure for millions of users worldwide.
1. A unified operational brain built on real experience
Our team has spent years operating large-scale global security environments – from endpoint fleets to cloud workloads to compliance-intensive infrastructures. DSTs reflect those lessons.
They maintain a continuously updated understanding of your environment – assets, identities, configurations, vulnerabilities, misconfigs, org structure, and attack paths – and use it to make better decisions automatically.
This isn’t theoretical. It’s built from the kinds of operational realities we’ve solved repeatedly in environments serving tens of millions of users.
2. A teammate that actually performs the work, not just explains it
Instead of offering summaries or suggestions, DSTs handle the operational load:
- triage
- enrichment
- correlation
- workflow execution
- owner assignment
- SLA tracking
- drift validation
- evidence collection
Every action is transparent, explainable, and fully auditable.
This mirrors how our own teams have run high-scale security operations for years – with automation doing the grunt work and humans driving judgment.
3. Human-in-the-loop by design – a principle shaped by real-world lessons
Because we’ve built and deployed security systems in production environments for almost 20 years, we understand that trust is earned through control, not abstraction. DSTs are intentionally designed with:
- human-approval gates
- transparent reasoning
- full audit trails
- environment-specific tuning
Human analysts remain the final decision-makers – DSTs simply remove the noise so they can operate at the top of their skillset.
4. A platform shaped by building security for millions of users
Our founding team has built:
- global consumer security products
- enterprise-grade security platforms
- large-scale compliance infrastructures
- cloud hosting platforms serving 100+ countries
- incident response and governance programs
DSTs are informed by this broad, multi-layered experience.
They’re not inspired by research papers – they’re inspired by what we wished we had while running real security teams under real pressure.
Why this matters for a CISO:
You’re not just getting an AI layer – you’re getting a teammate engineered from years of operational trenches, designed to remove the work humans should never have had to do:
- repetitive triage
- log stitching
- evidence gathering
- config checks
- ticket chasing
- vulnerability sorting
- drift revalidation
DSTs elevate the human team into the roles that matter: strategy, threat hunting, incident command, architecture, and decision-making.
It’s not an AI feature. It’s the operational teammate we always wished existed while building and securing platforms at a global scale.
VMblog: Most enterprise security deployments take months, not days. What’s the secret to achieving deployment in 48 hours when you’re integrating with 200+ platforms? What are the biggest gotchas or prerequisites that could extend that timeline in real-world scenarios?
Gadit: Because of how DSTs are built, deployment is dramatically faster than traditional enterprise tools. Most environments see the first value within the first 30 minutes.
Three reasons:
- Agentless architecture:
DSTs integrate via APIs, eliminating most infrastructure friction.
- Pre-built connectors:
We support deep integrations with 200+ platforms across SIEM, EDR, cloud, identity, and SaaS.
- Automatic context-building:
DSTs immediately begin mapping assets, identities, configs, and relationships – work that normally takes teams weeks.
The only factors that can extend timelines are:
- outdated or broken integrations
- missing permissions
- highly fragmented environments
Even then, most deployments are complete within 72 hours.
In one design partner environment, DSTs reduced 100,000+ raw vulnerabilities to 27 priority issues within 48 hours.
VMblog: You cite an average savings of $2.2 million compared to traditional hiring. Can you break down that ROI model? How many human analysts does one DST actually replace, and what are the hidden costs (training, maintenance, oversight) that organizations should factor into their TCO analysis?
Gadit: We actually removed the $2.2M savings figure from our public materials because it only applied to very large enterprises and could be misinterpreted. A Digital Security Teammate doesn’t replace people – it replaces the repetitive operational workload that burns analysts out. Our ROI model focuses on workload coverage, efficiency gains, and avoided costs rather than “headcount replacement.”
The ROI Model Has Three Components
1. Workload Coverage (the core efficiency driver)
Our Digital Security Teammate doesn’t behave like a traditional “AI worker” SKU where you buy one agent per analyst.
You only ever deploy ONE DST per environment.
That single baseline DST continuously scales to cover the repetitive workload of any number of L1 analysts and junior security engineers, regardless of environment size.
In practical terms:
At the entry plan, your DST automates the full workload of one L1 analyst plus a portion of a security engineer’s operational tasks (evidence gathering, config checks, ticket lifecycle actions).
As the customer environment grows (more alerts, more assets, more misconfigurations), the DST does not “max out” or require new seats.
Instead, customers upgrade into higher slabs only when the volume of automated work performed by the DST increases – not because they need “more agents.”
This is a fundamental design decision:
The DST is built as an “infinite teammate” – horizontally scalable, continuously improving, and priced by usage outcomes rather than headcount replication.
This is possible because the DST automates:
- repetitive triage
- cross-tool correlation
- asset/identity lookup
- misconfiguration and drift detection
- enrichment and documentation
- ticket creation and SLA tracking
In real deployments, this accounts for 50-70% of the daily volume that consumes analyst time.
Key point:
It’s workload replacement, not role replacement.
2. Reduced Turnover & Burnout-Driven Costs
Burnout is one of the most expensive hidden costs in security.
Replacing a single analyst can cost 1.25-1.5 their annual salary when you include:
- recruitment
- onboarding
- lost productivity
- institutional knowledge loss
- training time for new hires
Since DSTs remove the operational drag that drives burnout (triage, documentation, ticket-chasing), organizations see meaningful reductions in churn – a major financial impact often ignored in traditional TCO models.
3. Better MTTD/MTTR = Lower Breach Impact
The largest financial savings don’t come from labor efficiency – they come from faster detection and containment.
A DST:
- performs initial triage instantly
- correlates identity, cloud, and EDR signals
- surfaces high-risk alerts early
- executes workflows with human approval
This reduces Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), both of which have direct financial correlations in incident impact models. Even modest improvements here translate to significant avoided losses.
This is where the vast majority of the economic value comes from.
What About TCO? (The Unspoken Costs)
From a total cost of ownership perspective, Digital Security Teammates are intentionally designed to be light on operational burden. Oversight is built into normal SOC workflows – analysts simply approve, dismiss, or escalate DST actions, which creates trust without adding new workload. Maintenance is minimal because the platform automatically updates its connectors, baselines, correlation logic, and knowledge graph behind the scenes. Training is equally simple: the DST improves through the team’s day-to-day decisions rather than requiring custom playbooks, rule writing, or model tuning. And while initial integration speed depends on an organization’s IAM and cloud permissions, ongoing connector management is fully handled by our integration fabric, not the customer. In short, the TCO stays low because the complexity sits inside the product, not on the security team.
In summary:
DSTs don’t replace analysts. They replace the repetitive layers of analyst work.
The ROI comes from:
- workload coverage
- burnout reduction
- faster detection and lower incident impact
not salaries saved.
VMblog: You secured $4.5 million from Disrupt.com with “months of embedded product development.” That’s an unusual investor relationship. How did their embedded involvement shape the product, and what does this model of investor-as-co-developer mean for your go-to-market strategy?
Gadit: Disrupt.com is the leading venture builder operating in the MENA region with a unique model for early-stage ventures, which includes a combination of investment capital (cash), hands-on leadership (co-founders), embedded teams (dedicated resources across engineering, product, and GTM), and high-efficiency G&A services to support scale. Therefore, Disrupt operates like a co-founder as much as it supports with funding in the early stages, as the first cheque into the business (post-market validation and IC approval). We operate like a co-founder as much as an investor, with each venture structured around its specific needs and potential. It’s a fundamentally different model: Investor-as-co-developer, not investor-as-spectator.
And for us, it’s been one of the biggest accelerators in getting Secure.com market-ready at speed and scale.
VMblog: Right now, DSTs investigate and escalate. What’s the roadmap toward autonomous response? Are we heading toward a future where DSTs can automatically contain threats, isolate endpoints, or block traffic-and what are the governance and liability frameworks that need to exist before that becomes viable?
Gadit: Today, our DSTs focus on investigation, correlation, workflow automation, and light remediation – always with a strong human-in-the-loop requirement. Autonomous response is on the roadmap, but it will roll out in a staged, responsible progression.
We’ll begin with low-risk, reversible actions that customers explicitly pre-approve, then gradually expand autonomy based on confidence, asset criticality, and environmental context.
For higher-impact systems, humans will always remain the final decision-makers. Before full autonomy is viable, organizations need clear policies, auditability, kill-switch controls, and simulation modes so security leaders can trust what the system is doing.
So yes – we’re moving toward autonomous containment, but always with governance, transparency, and customer control at the center.
##
