Spellune

Spellune is an AI-native security company that integrates artificial intelligence into cybersecurity products, founded in 2021 by former Google and MIT researchers.

Spellune is a cybersecurity company that develops AI-native security products, integrating artificial intelligence directly into its threat detection and response platforms. The company was founded in 2021 by a team of former Google and MIT researchers, including CEO Dr. Elena Vasquez, a former machine learning engineer at Google DeepMind, and CTO Dr. Raj Patel, who previously led security research at MIT's Computer Science and Artificial Intelligence Laboratory (MIT CSAIL). Headquartered in San Francisco, California, Spellune focuses on using deep learning and large language models to automate and enhance security operations.

The company's core premise is that traditional security tools are reactive and signature-based, while AI-native approaches can proactively identify novel threats. Spellune's platform, called SentinelAI, uses transformer-based models to analyze network traffic, user behavior, and system logs in real time. This approach allows the platform to detect anomalies that might indicate zero-day exploits or insider threats, without relying on known attack signatures. As of 2025, SentinelAI is deployed by over 200 enterprise customers, including financial institutions, healthcare providers, and government agencies.

Founding and Early History

Spellune was incorporated in March 2021, with seed funding of $12 million from venture capital firms including Sequoia Capital and Accel. The founding team had deep expertise in both AI and security: Elena Vasquez had worked on anomaly detection at Google DeepMind, and Raj Patel had developed intrusion detection systems at MIT CSAIL. They were joined by Dr. Priya Sharma, a former researcher at OpenAI, who became the Chief AI Officer.

The company's first product, Spellune Shield, was launched in early 2022. Shield was an AI-powered endpoint detection and response (EDR) tool that used deep learning to classify malware and ransomware. In a 2022 independent evaluation by the MITRE Corporation, Shield achieved a 99.2% detection rate for known malware families and a 94.7% detection rate for previously unseen variants, outperforming traditional EDR products by significant margins.

In 2023, Spellune released its flagship product, SentinelAI, which integrated natural language processing capabilities. This allowed security analysts to query the system using plain English, such as "Show me all suspicious login attempts in the last 24 hours," and receive detailed reports. The product was built on a custom large language model, fine-tuned on security-specific data, including threat intelligence feeds and incident reports.

Technology and Architecture

Spellune's technology stack is built around several key AI techniques. The core of SentinelAI is a transformer-based model, similar to those used in natural language processing, but adapted for time-series data. The model processes sequences of events - such as network connections, file accesses, and user authentications - and learns to predict normal behavior. Deviations from this predicted behavior are flagged as potential threats.

The company also uses graph neural networks to model relationships between entities, such as users, devices, and applications. This helps identify lateral movement within a network, a common tactic in advanced persistent threats. For example, if a user account suddenly accesses a server it has never accessed before, and that server is later compromised, the graph model can correlate these events.

Spellune employs a technique called reinforcement learning from AI feedback (RLAIF) to continuously improve its models. The system generates hypotheses about potential threats, and security analysts provide feedback on whether those hypotheses are correct. This feedback is used to update the model, making it more accurate over time. As of 2025, the company reports that its models improve their detection accuracy by approximately 1.5% per month on average.

Products and Services

Spellune offers a suite of products under the SentinelAI brand:

SentinelAI Core: The main threat detection and response platform, which ingests data from various sources, including network sensors, endpoint agents, and cloud logs. It provides real-time alerts and automated response actions, such as isolating compromised devices.
SentinelAI Cloud: A cloud-native version designed for organizations using Amazon Web Services (AWS), Microsoft Azure, or Google Cloud. It integrates with cloud-specific security tools and provides visibility into cloud workloads.
SentinelAI SOAR: A security orchestration, automation, and response module that uses AI to automate incident response workflows. It can automatically contain threats, block malicious IPs, and generate incident reports.
Spellune Threat Intelligence: A subscription service that provides curated threat intelligence feeds, enriched by AI analysis. The service identifies emerging attack patterns and provides actionable insights.

In 2024, Spellune introduced a free tier for SentinelAI Core, targeting small and medium-sized businesses. This move was intended to build brand awareness and gather more data to train its models. By 2025, the free tier had attracted over 10,000 organizations, and the company reported a 40% conversion rate to paid plans.

Funding and Growth

Spellune has raised a total of $85 million in funding across three rounds. The Series A round, in 2022, raised $30 million and was led by Accel. The Series B round, in 2024, raised $43 million and was led by Sequoia Capital. The company's valuation reached $500 million in the Series B round, according to press releases.

The company has grown from 15 employees in 2021 to over 300 employees in 2025. It has offices in San Francisco, London, and Bangalore. The Bangalore office, opened in 2023, focuses on research and development, particularly in the area of AI model optimization. The company has also established partnerships with major cloud providers, including Amazon Web Services and Google Cloud, to offer its products through their marketplaces.

Research and Contributions

Spellune has contributed to the academic community through publications and open-source projects. In 2023, researchers at Spellune published a paper at the International Conference on Machine Learning (ICML) on "Graph-based Anomaly Detection for Enterprise Networks," which introduced a novel method for detecting lateral movement. The paper was cited over 200 times by 2025.

The company also released an open-source library called "SpellunePy," which provides tools for building and training security-specific AI models. The library has been downloaded over 50,000 times and is used by researchers at institutions such as Carnegie Mellon University and the University of Toronto.

In 2024, Spellune launched the "AI Security Research Grant" program, providing $1 million annually to academic researchers working on AI-related security challenges. The first recipients included projects on adversarial robustness and privacy-preserving machine learning.

Challenges and Controversies

Spellune has faced challenges related to the limitations of AI in security. In 2023, a false positive incident caused a major retail customer to block legitimate user accounts, leading to a temporary service disruption. The company acknowledged the issue and improved its model calibration, but the incident highlighted the risks of relying on AI for critical decisions.

There have also been concerns about the use of large language models in security, particularly regarding data privacy. Spellune processes sensitive customer data, and questions have been raised about how this data is used to train models. The company states that it uses differential privacy techniques to protect customer data, but some experts remain skeptical.

In 2025, a group of researchers from the University of California, Berkeley, published a paper criticizing the lack of transparency in AI-based security products, including Spellune's. They argued that the models are "black boxes" and that customers cannot fully understand why certain alerts are generated. Spellune responded by introducing a "model explainability" feature in its product, which provides natural language explanations for alerts.

Future Directions

Spellune is exploring several new areas as of 2025. The company is developing AI agents that can autonomously respond to cyber threats, potentially reducing the need for human intervention. These agents would use reinforcement learning to make decisions about containment and remediation.

Another focus is on adversarial machine learning - defending AI systems themselves from attacks. Spellune has a dedicated team researching how to make its models robust against adversarial examples, which are inputs designed to fool AI systems. This is particularly relevant as attackers increasingly target AI-based security tools.

The company is also expanding into the Internet of Things (IoT) security market. In 2025, it announced a partnership with a major IoT device manufacturer to embed its detection capabilities into edge devices. This would allow for real-time threat detection at the device level, rather than relying on centralized servers.