Corporate security has long been about more than detection. Monitoring tools can spot a threat within minutes; after that, the response gets stuck in tickets, access requests, manual procedures and queues that grow faster than teams can handle. CyberKord, a startup founded in Milan in 2026 by Alessandro Maggio, Dragos Tanasa and Cosimo Michelagnoli, has raised €2.7 million in a pre-seed round led by 360 Capital, with participation from Plus Partners, Addendum Capital and Vento, to bring automation to the resolution side as well.

The stated logic is straightforward: companies add infrastructure, software and AI agents every week, and operational work outpaces any team. Senior people end up absorbed by patches, access requests and incidents, one ticket at a time. CyberKord says it has built an AI that does that work end-to-end, showing every step, and lets the team decide how far it can act.

The technical core is a digital twin of the IT infrastructure: the platform analyses issues, simulates possible fixes and applies corrective actions using the tools already present in the company. It can be triggered by security alerts, support tickets or messages on Microsoft Teams and Slack. The integration covers both cloud-based and on-premise systems, without forcing companies to replace their existing stack.

This is where the announcement stops being a simple funding story. CyberKord's approach signals a structural shift: the value is no longer in detecting more events, but in reducing the friction between alert and action. In many environments, alert saturation has created a paradox: more telemetry, less response capacity. Automating remediation is not just about saving time; it changes the nature of SOC work, turning analysts into supervisors of recorded actions rather than executors of repetitive procedures.

That model carries an often-overlooked constraint. A digital twin that simulates fixes on a real infrastructure needs access to system state, identities and configurations. For teams evaluating on-premise or hybrid deployments, the question is not just how good the model is, but where inference runs, where action logs are stored, and who can review the audit trail. AI-RADAR offers analytical frameworks at /llm-onpremise to weigh these trade-offs without prescribing a single answer. The ability to control autonomy levels is not a product detail: it is the lever that prevents remediation speed from becoming a new operational risk.

Legacy detection vendors risk being bypassed by platforms that act directly on incidents. Companies with mixed stacks, by contrast, gain an incentive not to centralise everything in the cloud, because automation can also operate on on-premise components. It is no coincidence that the first announced pilots target manufacturing, technology, healthcare and telecommunications, sectors where legacy systems and continuity constraints make manual response especially expensive.

With the €2.7 million, the startup plans to further develop its platform and launch its first pilot projects with large European companies. The planned expansion of technical and commercial roles indicates that the next phase will not be purely engineering: it will need to convince CISOs that response automation can be governed, not suffered.