Sweet Security
Sweet Security protects cloud workloads by watching what they do while they run, through a lightweight sensor and cloud logs, and adds posture, vulnerability, identity and API security plus tools that find and control AI agents.
CyberReviewed Editorial Team · Updated · sweet.security
Company details
- Score
- 7.3/10Ranked 13 of 22 (tied)
- Category
- Cloud security
- Founded
- 2022
- Headquarters
- Tel Aviv, Israel
- Leadership
- Dror Kashti, co-founder and CEO
- Funding disclosed
- $120 million, including a $75 million Series B in 2025
- Pricing
- $50,000 a year per 100 workloads for Sweet Primary, or $60,000 for Sweet Advanced (AWS Marketplace)
- Best fit
- Large cloud security and SOC teams that want runtime detection with fewer alerts
Our take
Sweet is a strong choice for enterprises that already know their cloud configuration risks and want to see which attacks are unfolding right now, with alerts grouped into readable stories. At $50,000 a year for 100 workloads on AWS Marketplace it is priced for large teams, and reviewers say the interface takes time to learn.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 6.4 |
| Product scope and fit | 8.3 |
| Company durability | 7.6 |
| Evidence of adoption | 6.9 |
| Ease of adoption | 7.2 |
| Overall score (average of the five) | 7.3 |
Each criterion is defined on our methodology page.
Security that starts at runtime
Sweet's platform combines runtime detection and response with vulnerability and posture management, identity threat protection for human and machine identities, and API security.2 Its eBPF-based sensor profiles how each application normally behaves, and the company says it deploys in under five minutes.46 A patented engine that uses a large language model to spot unusual log sessions groups related events into incidents, and Sweet says it cuts alert noise to 0.04%.2 In November 2025 it added an AI security platform that maps models and agents, flags shadow AI and blocks attacks such as prompt injection.2
Priced per 100 workloads
Sweet does not publish prices on its own site, but its AWS Marketplace listing does. Sweet Primary, which protects workloads using cloud logs, costs $50,000 a year for each unit of 100 workloads, and Sweet Advanced, which adds the eBPF sensor for deeper runtime protection, costs $60,000 a year per unit.1 A workload is any running container, virtual machine, Kubernetes pod or serverless function.1
Built by former military cyber chiefs
Sweet was founded in 2022 by Dror Kashti, a retired brigadier general who was chief information security officer of the Israel Defense Forces, Eyal Fisher, former head of the Cyber Department at Unit 8200, and Orel Ben-Ishay, who led cybersecurity research and development at Unit 81.56 It came out of stealth in 2023 with a $12 million seed round led by Glilot Capital Partners, then raised a $33 million Series A led by Evolution Equity Partners in 2024.54 In November 2025 Evolution led a $75 million Series B that brought total funding to $120 million, after a year in which annual recurring revenue grew sixfold and enterprise customers tenfold, including several Fortune 1000 companies.2 It employs about 70 people in Israel and the United States.3
How it compares with Upwind and Orca Security
Upwind also uses an eBPF sensor and puts runtime data at the center of a broad cloud platform. Orca Security started with agentless scanning, which sees configuration and vulnerabilities quickly but sees less of live behavior. Sweet sits closest to Upwind, with its emphasis on turning runtime signals into a few readable incidents and on securing AI agents, and its AWS Marketplace prices are higher than either rival publishes.
Limits
Reviewers say the interface is hard to navigate, and that SIEM and ticketing integrations and executive reports could be easier. The published entry price of $50,000 a year for 100 workloads puts it out of reach for small teams.1 It is a younger company than most rivals and has fewer public reviews.
What customers say
Quoted word for word from public reviews on PeerSpot, retrieved October 23, 2026. Each quote links to the review or post it comes from.
Where it helps
The best feature of Sweet Security is that the events come in the form of stories, which are very informative, making it very clear what's going on.
Sweet Security reduced most false positives and combines all alerts and events into a single alert or incident, which is helpful for the security team to review everything together.
Where it falls short
One thing I think Sweet Security can definitely improve is that they have a lot of features, but the UI right now is not so well designed in my opinion. It's a bit difficult to navigate and get to the signal.
Additional integration with third-party SIEM solutions and ITSM ticketing tools could be made easier.
Sources
- AWS Marketplace, Sweet Security listing, accessed October 23, 2026
- Sweet Security, Sweet Security raises $75M Series B, November 12, 2025
- Calcalist Ctech, Sweet Security secures $75M Series B, November 2025
- FinSMEs, Sweet Security, interview with CEO Dror Kashti, March 2024
- Calcalist Ctech, Security startup led by former Israeli military cyber chiefs lands $12 million in seed funding, 2023
- Security Current, Dror Kashti, CEO and co-founder, Sweet Security
