.webp)
Software is undergoing one of its most fundamental shifts in decades.
For years, software was built around applications. We bought SaaS products, logged in, navigated dashboards, ran searches, created reports, and manually turned what we learned into action.
AI is changing that model.
We are moving from software as a service to software as an agent.
We believe security will be one of the fields most profoundly changed by this transition.
Instead of asking security teams to navigate dozens of applications and stitch together information themselves, AI agents will increasingly reason across data, make decisions, and act on their behalf.
But a fundamental problem stands in the way.
You can't build agents without context
Every system in a security organization knows something important, but none knows the whole story. Cloud security platforms understand infrastructure. Data security products understand sensitive data. Endpoint tools understand devices and agents. Vulnerability management systems understand vulnerabilities. Identity platforms understand users and permissions. Network security tools understand connectivity.
Traditional systems of record add another layer of knowledge: configuration management databases (CMDBs), ticketing systems, HR systems, asset databases, and other operational platforms.
To compensate for this fragmentation, security teams jump between consoles, export data to spreadsheets, write queries, correlate findings, open tickets, message other teams, and manually determine what actually matters.
An AI agent faces the same obstacle: it can reason effectively only when it understands the environment in which it operates.
Without context, there is no agentic security.
Building the context layer for agentic security
Northstar unifies security data across cloud security, data security, endpoint security, vulnerability management, identity and access, and network security with traditional systems of record, such as CMDBs and ticketing platforms.
We connect this information in a real-time context graph that understands not only individual assets, identities, vulnerabilities, configurations, and controls, but also the relationships among them.
That distinction matters.
Knowing that an endpoint has a vulnerability is data.
Knowing that the endpoint is internet-facing, contains sensitive data, is missing its EDR agent, has a critical vulnerability, and is accessible by an overprivileged identity is context.
And context changes what AI can do.
With the right context, agentic AI can accurately answer complex security questions, reason across an organization's environment, identify toxic combinations of risk, prioritize what matters, and determine what should happen next.
Context is also what will help security move from a reactive operating model to a proactive one. Whereas security has traditionally been about operating tools and manually coordinating workflows, agentic AI, guided by context, will shift security teams to defining policies, guardrails, and desired outcomes – and letting agentic AI continuously work toward them. This is a very different future for security.
Making security context available to any agent
We also believe this context should not be locked inside Northstar.
As organizations build their own AI agents with platforms such as Claude and other agentic frameworks, those agents need access to trusted, real-time security context.
That is where the Model Context Protocol (MCP) becomes important.
Northstar exposes its context graph through MCP, allowing authorized agents to access and reason over the connected security context Northstar has built.
Instead of integrating with dozens of security products, learning their individual data models, and recreating the relationships among them, an agent can access Northstar's context graph to get the security context it needs.
Imagine an agent built in Claude trying to determine whether a particular asset represents meaningful risk.
Instead of receiving isolated data points, the agent gets connected context it can reason over.
This makes Northstar more than an AI security application. Our context graph becomes a security intelligence layer that any authorized agent can use to understand the environment and take action.
As enterprises build more agents of their own, that shared intelligence layer becomes increasingly important.
In an agentic world, every agent needs context. Northstar provides the security context.
From answers to autonomous outcomes
But better answers are only the beginning.
The real opportunity for AI in security is not another chatbot layered on top of security data.
It is turning intelligence into action.
Once Northstar understands the relationships across the security environment, teams can build workflows that continuously identify risk and autonomously drive security outcomes.
Consider endpoint security.
Instead of a security analyst periodically running a report to find machines with unhealthy or missing EDR agents, Northstar can continuously identify which endpoints should be protected, detect gaps or unhealthy coverage, incorporate each asset’s business and security context, and initiate the appropriate remediation workflow.
The same model applies to identity and access.
Northstar can continuously identify excessive privileges or inappropriate access, understand the surrounding user, application, asset, and risk context, and drive the workflow needed to remediate it.
These workflows can be created in Northstar and run continuously and autonomously. They can generate dashboards and reports, send notifications, create and route tickets, trigger remediation, and validate that an issue has been resolved.
The result is a fundamental shift: security teams move from finding problems and coordinating remediation to defining the outcomes they want and allowing AI agents to work continuously toward them.
Security should become proactive
Security has historically been reactive.
Find the vulnerability. Investigate the alert. Review the access. Open the ticket. Chase the owner. Fix the problem. Run another report to confirm the fix.
Agentic AI gives us an opportunity to change that operating model fundamentally.
Imagine a security platform that continuously understands your environment, reasons about changes as they happen, identifies combinations of risk before they become incidents, and autonomously takes the appropriate action.
The security team moves from operating tools and manually coordinating workflows to defining policies, guardrails, and desired outcomes.
That is a very different future for security.
And we believe context is the foundation for that future.
Why now
The transition from SaaS to agents is already underway.
As AI becomes more capable of reasoning and acting, the value of software will increasingly move beyond the interface to the intelligence, context, and workflows underpinning it.
Security has an enormous opportunity in this transition because the industry already has tremendous amounts of data. What has been missing historically is a way to connect that data, understand the relationships within it, and make the resulting context available to AI.
We started Northstar to build the real-time context layer for agentic security.
Northstar gives AI the understanding it needs to reason across the security environment, makes that context available to other agents through MCP, and enables security teams to turn intelligence into autonomous outcomes.
Because in an agentic world, the advantage will not belong to the platform with the most data. It will belong to the platform that can turn data into context – and context into action.
That is the future we are building at Northstar.