Infra

Investing in Neo

Zane Lackey and Joel de la Garza Posted July 20, 2026

The endpoint security market is entering its third generation. The first was antivirus: static signatures, easily evaded, built for a world of known malware. The second was behavioral detection and response such as SentinelOne, CrowdStrike, and the EDR category they created, which watched process behavior instead of file hashes and became the standard enterprise defense for over a decade. In both of those generations, the assumption was that the endpoint followed a familiar pattern: A human clicks, a program runs, and security tooling watches for the process to misbehave.

That assumption no longer holds. AI agents now run directly on the endpoint with the same privileges as the user they serve, reading files, executing code, calling APIs, and moving data between apps. Microsoft embedding Copilot into Windows made this the default configuration for the modern enterprise. The interactions on the endpoint have fundamentally changed and every control built on the old assumption (EDR, DLP, Zero Trust) breaks the moment it can no longer tell whether an action came from the person at the keyboard or the agent acting in their name.

This is not a gap incumbents can patch. They built durable platforms for the behavioral-detection era, and reworking that architecture to attribute every action and intent to both humans and synthetic agents would mean rebuilding from scratch. Most will add basic AI discovery as a feature, but this new problem requires a complete rethink of what security means in the agentic age.

Neo is built for this new generation from the ground up. Rather than attempting to retrofit yesterday’s approach, Neo is pioneering agentic software control for a world where AI agents act continuously, often outnumbering the humans they serve. Its core bet is that security has to anchor back to a few simple questions at the moment of execution: is this action coming from a real, verified person or is it coming from an agent, is that agent configured with the correct guardrails, and what happens when malicious or negligent activity occurs. Answering that in real time, and enforcing it autonomously, is what the tools out there today were never built to do.

Neo’s founders are as strong as they come in security. Nick Warner scaled SentinelOne through its IPO in multiple executive leadership roles. Shlomi Salem spent over 11 years leading threat research at SentinelOne. Eran Shirazi brings deep technical grounding and prior experience co-founding and serving as CTO of EasySend. Together, they combine the commercial instincts, security depth, and credibility with top-tier security talent that this category demands.

The shift from antivirus to EDR created category-defining companies. We believe this new shift is at least just as large, and arguably more urgent. We’re proud to have led Neo’s Seed round and to partner with Nick, Shlomi, Eran, and the rest of the Neo team as they build the security layer the agentic endpoint requires.

Want More a16z Infra?

Analysis and news covering the latest trends reshaping AI and infrastructure.

Learn More
Recommended For You
Infra

new Investing in Runta

Martin Casado, Yoko Li, and Guido Appenzeller
Infra

Investing in Netris

Guido Appenzeller, Raghu Raghuram, and Jason Cui
Infra

Investing in Mirendil

Matt Bornstein and Malika Aubakirova
Enterprise

Investing in Probook

Alex Rampell, David Haber, Olivia Moore, and Seema Amble

Investing in Prosper AI

Jay Rughani and Jane Rhee

Want More Infra?

Analysis and news covering the latest trends reshaping AI and infrastructure.

Sign Up On Substack

Views expressed in “posts” (including podcasts, videos, and social media) are those of the individual a16z personnel quoted therein and are not the views of a16z Capital Management, L.L.C. (“a16z”) or its respective affiliates. a16z Capital Management is an investment adviser registered with the Securities and Exchange Commission. Registration as an investment adviser does not imply any special skill or training. The posts are not directed to any investors or potential investors, and do not constitute an offer to sell — or a solicitation of an offer to buy — any securities, and may not be used or relied upon in evaluating the merits of any investment.

The contents in here — and available on any associated distribution platforms and any public a16z online social media accounts, platforms, and sites (collectively, “content distribution outlets”) — should not be construed as or relied upon in any manner as investment, legal, tax, or other advice. You should consult your own advisers as to legal, business, tax, and other related matters concerning any investment. Any projections, estimates, forecasts, targets, prospects and/or opinions expressed in these materials are subject to change without notice and may differ or be contrary to opinions expressed by others. Any charts provided here or on a16z content distribution outlets are for informational purposes only, and should not be relied upon when making any investment decision. Certain information contained in here has been obtained from third-party sources, including from portfolio companies of funds managed by a16z. While taken from sources believed to be reliable, a16z has not independently verified such information and makes no representations about the enduring accuracy of the information or its appropriateness for a given situation. In addition, posts may include third-party advertisements; a16z has not reviewed such advertisements and does not endorse any advertising content contained therein. All content speaks only as of the date indicated.

Under no circumstances should any posts or other information provided on this website — or on associated content distribution outlets — be construed as an offer soliciting the purchase or sale of any security or interest in any pooled investment vehicle sponsored, discussed, or mentioned by a16z personnel. Nor should it be construed as an offer to provide investment advisory services; an offer to invest in an a16z-managed pooled investment vehicle will be made separately and only by means of the confidential offering documents of the specific pooled investment vehicles — which should be read in their entirety, and only to those who, among other requirements, meet certain qualifications under federal securities laws. Such investors, defined as accredited investors and qualified purchasers, are generally deemed capable of evaluating the merits and risks of prospective investments and financial matters.

There can be no assurances that a16z’s investment objectives will be achieved or investment strategies will be successful. Any investment in a vehicle managed by a16z involves a high degree of risk including the risk that the entire amount invested is lost. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z and there can be no assurance that the investments will be profitable or that other investments made in the future will have similar characteristics or results. A list of investments made by funds managed by a16z is available here: https://a16z.com/investments/. Past results of a16z’s investments, pooled investment vehicles, or investment strategies are not necessarily indicative of future results. Excluded from this list are investments (and certain publicly traded cryptocurrencies/ digital assets) for which the issuer has not provided permission for a16z to disclose publicly. As for its investments in any cryptocurrency or token project, a16z is acting in its own financial interest, not necessarily in the interests of other token holders. a16z has no special role in any of these projects or power over their management. a16z does not undertake to continue to have any involvement in these projects other than as an investor and token holder, and other token holders should not expect that it will or rely on it to have any particular involvement.

With respect to funds managed by a16z that are registered in Japan, a16z will provide to any member of the Japanese public a copy of such documents as are required to be made publicly available pursuant to Article 63 of the Financial Instruments and Exchange Act of Japan. Please contact compliance@a16z.com to request such documents.

For other site terms of use, please go here. Additional important information about a16z, including our Form ADV Part 2A Brochure, is available at the SEC’s website: http://www.adviserinfo.sec.gov.