An AI workforce that runs the SOC end to end under contractual service levels

Joon positions itself between an AI SOC product and a managed service. The agents connect to the tools already in place, learn the specifics of the environment, and then take on four jobs continuously: triaging and investigating alerts, maintaining detection coverage by tuning rules and closing gaps, validating defenses through simulated attacks to confirm that controls actually detect what they are supposed to, and proactively hunting for anomalies. The company commits to service levels on that work, including full alert coverage, which shifts the buying conversation away from how many analysts a platform saves and toward whether the outcome was delivered.

The founding team's background is the company's main credential. Joon was founded in 2025 in Tel Aviv by Alon, who co-founded Siemplify and led its roughly $500M acquisition by Google, alongside Jenya, who worked on Gemini for security operations at Google, and Dan, previously founder and CTO of GlobeKeeper. That lineage runs from SOAR through Google SecOps to security-tuned models, which is the same arc the product follows. Joon reports raising about $6M to date and states that it is SOC 2 and ISO compliant. Published performance claims, including twenty-times operational speed and complete alert coverage, come from the company rather than independent testing.