Agentic Security Operations & Incident Response

COMPANY OVERVIEW

Spacewalk AI builds agentic security operations for complex enterprise environments, connecting AI investigation with human-led incident response. Its two products, Escalations and Cases, help security teams establish what happened, examine the evidence, and carry an investigation through the response without losing context.

Spacewalk serves enterprise SOCs, incident response teams, MSSPs, MDR providers, and specialist IR firms. Founded by Tim Wenzlau, Chris Fuller, and David Elston, the team brings experience from Mandiant, UK intelligence, and Obsidian Security. The company is based in Irvine, California, and backed by CRV and Engineering Capital.

CORE FOCUS

Spacewalk focuses on the quality of the investigation: conclusions supported by evidence, reasoning analysts can challenge, and clear visibility into what remains unknown. Teams of AI agents pursue parallel lines of enquiry across connected security tools, testing competing explanations to distinguish legitimate activity from threats. Each finding is traceable to its supporting evidence, and investigations can return an indeterminate verdict when the evidence is insufficient.

Teams guide investigations through plain-language playbooks, organisational context, and their own threat model. Spacewalk draws on previous investigations to inform future work, while analysts can inspect and refine how conclusions are reached.

When an investigation needs a coordinated response, its evidence and reasoning become the starting point for a shared case. Responders direct the work, agents investigate alongside them, and the incident record stays connected across teams and shifts.

PRODUCTS & TOOLS

Escalations – Agent-led triage and investigation

Turns alerts, tickets, threat hunt findings, and provider hand-offs into investigations. Agents gather evidence across connected tools, test competing explanations, and deliver a verdict with supporting reasoning and unresolved questions. Analysts can challenge findings, direct further investigation, and set action boundaries and review requirements.

Cases – The incident response workspace

Brings evidence, timelines, observables, shared notebooks, and reporting into one workspace for responders and incident leads. Agents analyze files, query tools, and pursue leads while people direct the response and review what enters the record. Cases can begin independently or continue an investigation from Escalations.

Reporting and handovers

Case summaries and impact statements update from accepted case knowledge as the investigation develops. Responders can review and export reports, brief stakeholders, and hand over the evidence, reasoning, and open questions to the next team.