Devo, Inc. Startup Diligence Report
Devo merits continued diligence only if management can substantiate durable enterprise/SOC demand, differentiated security-data economics, defensible AI/SIEM outcomes, clean preference/legal/security posture and efficient growth after the 2021-2022 late-stage valuation step-up.
Devo, Inc. Startup Diligence Report
Devo is an active private cybersecurity unicorn with strong public financing, product and compliance signals, but its investability cannot be underwritten from public evidence alone because financial quality, customer retention, cap table, security artifacts and legal schedules are private.
ARR, revenue growth, gross margin, burn, cash runway, backlog, receivables and forecast accuracy cannot be underwritten from public sources.
Diligence request: Require audited/reviewed financials, monthly management accounts, cohort retention, cash balance, debt and detailed forecast model.
Public logos do not reveal ARR concentration, renewal status, gross retention, NRR, product adoption or reference quality.
Diligence request: Request top-customer schedule, cohort retention, churn bridge and permission for independent reference calls.
Devo competes with Splunk, Elastic, QRadar, LogRhythm, Microsoft, Google Chronicle, Palo Alto/Cortex, CrowdStrike, Exabeam and Securonix.
Diligence request: Request win/loss, pricing benchmarks, displacement proof and pipeline by competitive source.
Large late-stage rounds at $1.5B and $2B valuations may include liquidation preferences, ratchets or senior rights not visible publicly.
Diligence request: Request full cap table, financing documents, option pool, warrants, debt and 409A/common valuation history.
The trust center is public, but SOC reports, pen tests, DPAs, incident logs and customer security exceptions require private review.
Diligence request: Review SOC 2, ISO/FedRAMP packages, pen-test reports, incident register, DPAs and material customer security commitments.
DeepTrace, ThreatLink and autonomous-investigation claims need proof of accuracy, explainability, analyst-time savings and customer adoption.
Diligence request: Run product demo using realistic data, review model governance, false positives, customer case studies and roadmap burn-down.
Ingest-based pricing, 400 days hot storage and data orchestration create infrastructure-cost and architecture-dependency questions.
Diligence request: Request COGS by ingestion tier, storage unit economics, cloud commitments, architecture review and supplier concentration data.
Government-market authorizations improve credibility but require continuous controls, boundary management and audit costs.
Diligence request: Verify official authorization status, sponsoring agency, authorization boundary, POA&M, incident history and continuous-monitoring costs.
Public sources provide financing and valuation milestones but no audited financial statements, operating KPIs, cash runway, cap table or debt schedules. Devo appears active and private based on public materials, with last public valuation of $2B in 2022.
not publicly verifiable confidence: high
Income statements, balance sheets, cash flows, backlog, AR aging and management reports are not public; only financing/growth press signals are available.
| Area | Public evidence | Gap | Risk IDs |
|---|---|---|---|
| Income statements, balance sheets and cash flows | No public statements found; company is private | Audited/reviewed financials and footnotes | R-001 |
| Backlog and accounts receivable aging | No schedule found in public materials | Backlog by customer and AR aging | R-001, R-003 |
| Sales/gross profit by product/geography | Product packaging is public but revenue mix is not | ARR and gross margin by package, region and channel | R-001, R-006 |
not publicly verifiable confidence: high
Public growth and product-expansion signals do not provide forecast model inputs, pricing assumptions or capital expenditure/working-capital needs.
| Area | Public evidence | Gap | Risk IDs |
|---|---|---|---|
| Growth drivers | Funding releases and product launches imply growth ambitions | Pipeline conversion, expansion, churn and quota capacity | R-001, R-003, R-004 |
| Pricing and market assumptions | Packaging visible; public price book not visible | Discounting, ACV, renewal uplift and price elasticity | R-001, R-004 |
| International assumptions | Global positioning and Spain/Logtrust history | FX exposure, local costs, data residency and country-level revenue | R-009 |
partially verified confidence: high
The public financing timeline is strong enough to verify late-stage venture backing and valuation headlines, but ownership, dilution and preferences are private.
| Date | Round | Amount | Valuation or scale claim | Evidence |
|---|---|---|---|---|
| 2020-09-15 | Series D | $60M | CEO transition; U.S. Air Force contract and growth/headcount claims cited | EC-003 |
| 2021-10-26 | Series E | $250M | $1.5B valuation; more than 400 employees stated | EC-002 |
| 2022-06-02 | Series F | $100M | $2B valuation; total capital raised above $500M | EC-001 |
| Item | Public evidence | Diligence implication |
|---|---|---|
| Public-market exclusion | No IPO/SPAC/public ticker found in reviewed sources; financing releases describe venture funding | Treat as private unless corporate counsel discovers subsequent transaction |
| Acquisition/shutdown exclusion | Company site, product pages and 2025 CEO release are active | No public acquisition/shutdown trigger found in this research pass |
| Corporate aliases | Logtrust rebrand to Devo provides alias trail | Use Devo, Devo Technology, Devo Technology Inc. and Logtrust in legal/entity searches |
not publicly verifiable confidence: high
Tax positions, revenue recognition, accounting policies, cloud commitments and contingencies are not public.
| Area | Public evidence | Gap | Risk IDs |
|---|---|---|---|
| Cap table and preferences | Series D/E/F amounts and valuations public | Ownership, liquidation preferences, warrants, debt and option pool | R-002 |
| Revenue recognition and tax | No accounting policies or tax positions public | Revenue policy, deferred revenue, NOLs and transfer pricing | R-001, R-009 |
| Cloud commitments/off-balance sheet | Data platform model implies infrastructure commitments but no contracts public | Cloud spend, minimum commitments, leases and contingencies | R-006 |
Devo publicly presents a cloud-native data/security analytics platform, Intelligent SIEM, Data Analytics Cloud, Data Orchestration and DeepTrace. The public evidence supports product-scope existence, not adoption, efficacy, cost or profitability.
partially verified confidence: medium
Product pages and releases verify public packaging and recent launches, while market share, customer adoption, COGS and profitability remain private.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Data Analytics Cloud | Packaging page and data-orchestration launch point to analytics/log data platform positioning | ARR, gross margin and usage by package | R-001, R-006 |
| Intelligent SIEM | Company page markets SIEM, SOAR, UEBA and AI | Detection efficacy, analyst workflow outcomes and attach rate | R-005, R-004 |
| DeepTrace / AI investigation | DeepTrace product page markets autonomous investigation and threat hunting | False positives, explainability, model controls and customer adoption | R-005 |
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Data Orchestration | July 2024 launch; destinations include S3, Databricks and Snowflake | Customer adoption, routing economics and partner dependencies | R-006 |
| ThreatLink/Behavior Analytics | Referenced in Intelligent SIEM positioning | Coverage, roadmap, integrations and customer outcomes | R-005 |
| Storage/ingestion value proposition | IDC release mentions ingest-based pricing and 400 days hot storage | COGS and price realization at scale | R-006, R-004 |
Devo shows public customer, partner and integration signals but does not disclose top-customer revenue, concentration, churn, NRR, severed relationships or supplier economics.
partially verified confidence: medium
Customer logos and stories are visible, but top-15 customer schedules and application-level deployments are not public.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Public logos/testimonials | Customer stories and logos marketed by Devo | Top-15 customers, ARR, products used, renewal dates and references | R-003 |
| Revenue by customer | Not disclosed publicly | Any customer over 5% of revenue; federal exposure; customer credit risk | R-003, R-001 |
| Severed relationships | No public severed-customer list found | Churned top accounts and lost partner relationships in past two years | R-003, R-004 |
partially verified confidence: medium
Partner and integration pages indicate a public ecosystem, but revenue contribution and obligations are not disclosed.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Partners | Partner ecosystem page is public | Sourced ARR, resale/referral obligations and renewal status | R-003, R-004 |
| Integrations | Integration directory is public | Critical integrations, maintenance burden, API dependencies and SLAs | R-006 |
| Cloud/data destinations | Data Orchestration routes to S3, Databricks and Snowflake | Cloud supplier concentration and customer data-flow obligations | R-006, R-010 |
not publicly verifiable confidence: high
Revenue by customer, including customers above 5% of revenue, is not publicly available.
not publicly verifiable confidence: medium
No public schedule of severed customer, partner or supplier relationships was found.
partially verified confidence: medium
Top suppliers are not public; public integration and data-routing materials imply cloud/data-platform dependencies that require contract review.
Devo operates in a crowded SIEM/security-data market with incumbent SIEM, open/cloud analytics, hyperscaler and XDR/SOC workflow alternatives. Public analyst and review-site signals help category placement but not market share or win/loss.
partially verified confidence: medium
Competitor names and market-category signals are public; market share, win/loss, pricing realization and differentiation proof are not.
| Segment | Named competitors | Basis of competition | Risk IDs |
|---|---|---|---|
| SIEM / security analytics | Splunk, QRadar, LogRhythm, Elastic | Detection breadth, search speed, migration cost, price and storage economics | R-004, R-006 |
| Cloud-native security data / hyperscaler analytics | Microsoft/Azure, Google Chronicle | Platform bundling, cloud commitments, buyer consolidation and data gravity | R-004 |
| XDR/SOC workflow and analytics | Palo Alto/Cortex, CrowdStrike, Exabeam, Securonix | Workflow automation, response orchestration and analyst productivity | R-004, R-005 |
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| IDC Leader position | Company release quotes 2024 IDC MarketScape Leader placement | Obtain full IDC report, methodology and customer substantiation | R-004 |
| Ingest pricing / 400 days hot storage | IDC release repeats these differentiators | Unit economics and price realization versus alternatives | R-004, R-006 |
| AI-enabled SOC workflow | Intelligent SIEM and DeepTrace pages | Benchmark accuracy, time savings and attach rate | R-005 |
Public materials show Devo positioning, customer marketing, partner pages and product launches, but not quota capacity, pipeline, sales cycle, compensation, CAC, budget or conversion economics.
partially verified confidence: medium
Public positioning is clear around cloud-native security data and Intelligent SIEM, but marketing effectiveness and risk are not quantifiable publicly.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Positioning | Cloud-native logging/security analytics/SIEM materials | Persona, segment mix, budget owner and sales cycle by segment | R-004 |
| Partner/channel | Partner page is public | Partner-sourced pipeline, channel margin and conflict with direct sales | R-003, R-004 |
| Customer marketing | Customer page and testimonials are public | Reference quality, expansion motion and case-study representativeness | R-003 |
partially verified confidence: medium
Major-customer relationship status, trends and expansion prospects are not public beyond curated stories.
partially verified confidence: medium
Principal new-business avenues appear to include direct enterprise selling, partner ecosystem and regulated-market positioning, but sourced pipeline is not public.
not publicly verifiable confidence: high
Sales-force productivity metrics are not public.
| Metric | Public status | Requested evidence | Risk IDs |
|---|---|---|---|
| Quota and ramp | Not disclosed publicly | Quota by role, attainment, ramp time and hiring plan | R-001, R-003 |
| Pipeline and conversion | No public pipeline schedule | Pipeline by stage, win rate, sales cycle and source | R-001, R-004 |
| Compensation and CAC | Not public | Sales comp plans, CAC, payback and channel economics | R-001 |
not publicly verifiable confidence: high
Ability to execute marketing plan with current/projected budgets cannot be verified from public sources.
Recent product launches and AI/security analytics claims create meaningful R&D diligence needs around architecture, model governance, integration burden, COGS, roadmap delivery and talent.
partially verified confidence: medium
Public product claims imply R&D in data platform scale, security analytics, AI investigation and integrations, but org structure and development cost are private.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Data platform scale | Cloud-native logging and 400-day hot-storage positioning | Architecture, scalability, latency, reliability and COGS | R-006 |
| AI/analytics personnel | DeepTrace and Intelligent SIEM claims imply AI/security research expertise | Team roster, model ownership, ML governance and roadmap capacity | R-005, R-008 |
| Integration engineering | Integration directory and orchestration launch | Maintenance burden, test coverage, integration SLAs and partner roadmaps | R-006 |
partially verified confidence: medium
New product pipeline evidence includes Data Orchestration and DeepTrace/Intelligent SIEM claims, but adoption, timing, cost and risks are not public.
| Product or launch | Public timing/status | Critical technology | Diligence risk |
|---|---|---|---|
| Data Orchestration | Launched July 2024 | Routing, policy controls, connectors, cost optimization | R-006 |
| DeepTrace | Product page active | Attack graphing, AI investigation, analyst workflow explainability | R-005 |
| Intelligent SIEM enhancements | Product page active | SIEM/SOAR/UEBA integration and automated response | R-005, R-006 |
Public evidence confirms recent leadership transition and historical management changes. Headcount by function/location, compensation, stock plans, employee relations and turnover are not public.
partially verified confidence: medium
Public leadership evidence supports current CEO/executive-chair mapping but not full org chart.
| Person or role | Public evidence | Diligence question | Risk IDs |
|---|---|---|---|
| Ken Naumann, CEO | CEO appointment announced March 2025 | Strategy reset, priorities, operating cadence and retention plan | R-008 |
| Walter Scott, Executive Chairman | 2025 CEO release describes executive-chair role | Board involvement, delegation and transition plan | R-008 |
| Marc van Zadelhoff historical CEO | 2020 Series D release announced appointment | Continuity between 2020-2025 strategies and leadership changes | R-008 |
partially verified confidence: medium
Historical/current headcount by function and location is mostly not public; 2021 release stated more than 400 employees.
| Area | Public evidence | Requested evidence | Risk IDs |
|---|---|---|---|
| Headcount by function/location | 2021 release stated more than 400 employees; current headcount not public | Monthly headcount by function, location and legal entity | R-008, R-009 |
| Compensation and benefits | Not disclosed publicly | Executive agreements, sales comp, benefits, bonus and retention arrangements | R-008 |
| Turnover and employee relations | No public turnover schedule or employee-relations issues found in this pass | Attrition by function, regretted losses, ER claims and engagement surveys | R-008, R-011 |
partially verified confidence: medium
Senior-management biographies are partly available from company pages/releases, but ages, tenure details, references and complete employment history require validation.
not publicly verifiable confidence: high
Compensation arrangements and benefit plans are not publicly disclosed.
not publicly verifiable confidence: high
Incentive stock plans and option grants are not public.
inconclusive confidence: low
No public significant employee-relations issue was found in this pass, but public screening is incomplete.
not publicly verifiable confidence: high
Personnel turnover data for the last two years is not public.
Public security and regulated-market signals are meaningful, but legal, regulatory, IP, contract, insurance and security artifacts require counsel/security review. Public docket screening was limited and not dispositive.
inconclusive confidence: low
Public docket screening did not surface a confirmed material lawsuit against Devo in this pass, but the search is incomplete.
| Matter type | Public result | Limitation | Risk IDs |
|---|---|---|---|
| Lawsuits against company | No confirmed material matter surfaced in CourtListener screening pass | May miss state, international, arbitration, sealed or alias-related matters | R-011 |
| Lawsuits initiated by company | No comprehensive public schedule available | Company/counsel schedule required | R-011, R-012 |
| Regulatory inquiries | No public regulatory-problem schedule found | Regulatory correspondence is often non-public | R-007, R-010 |
inconclusive confidence: low
Pending lawsuits initiated by the company are not publicly scheduled.
partially verified confidence: medium
Environmental/safety exposure appears primarily office/software-company related publicly; security/privacy and regulated-market controls are more material.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| Trust center | Public trust center exists | SOC reports, pen tests, DPAs, incident history and customer exceptions | R-010 |
| FedRAMP Moderate | Authorization announced January 2024 | Official listing, boundary, POA&M and continuous-monitoring cost | R-007, R-010 |
| StateRAMP Moderate | Authorization announced June 2024 | Official status, customer use and ongoing obligations | R-007 |
not publicly verifiable confidence: medium
Material IP schedules are not public; Logtrust history and AI/security modules make ownership and licensing diligence important.
| Topic | Evidence | Open question | Risk IDs |
|---|---|---|---|
| IP ownership | Logtrust-to-Devo rebrand and AI/product claims are public | Assignments, patents, trademarks, open-source scans and invention agreements | R-012 |
| Material contracts | Customer, partner and integration pages imply contracts but terms are not public | Top customer MSAs, partner agreements, cloud commitments and change-of-control terms | R-003, R-006, R-010 |
| Insurance | No public insurance schedule found | Cyber, E&O, D&O, general liability limits and claims history | R-010, R-011 |
not publicly verifiable confidence: high
Insurance coverage and material exposures are not public.
not publicly verifiable confidence: high
Material contracts are not public; customer, partner, cloud/supplier and compliance commitments are high-priority requests.
| Artifact | Why it matters | Source trigger | Priority |
|---|---|---|---|
| SOC 2 / ISO / FedRAMP / StateRAMP packages | Validate controls, exceptions and regulated-market obligations | Trust center and authorization releases | High |
| Customer and partner contracts | Validate revenue quality, SLAs, indemnities and termination rights | Customer/partner public pages | High |
| IP schedule and open-source scan | Validate ownership and license obligations for product/AI modules | Logtrust rebrand and DeepTrace claims | Medium |
partially verified confidence: medium
FedRAMP and StateRAMP announcements are positive regulated-market signals; any regulatory agency problems, POA&Ms or exceptions require private counsel/security review.
| Risk cluster | Primary evidence | Closure request | Priority |
|---|---|---|---|
| Financial and financing | EC-001, EC-002, EC-020, EC-021 | Financial model, statements, cap table and financing documents | High |
| Market, customer and GTM | EC-006, EC-011, EC-012, EC-013 | Customer schedule, references, pipeline and win/loss evidence | High |
| Product, security, legal and team | EC-008, EC-014 to EC-019, EC-022 | Product demo, architecture, security package, legal schedule and management interviews | High |
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | Devo publicly announced a $100M Series F financing at a $2B valuation on June 2, 2022, bringing total capital raised to more than $500M. | verified high | SRC-001SRC-012 |
| EC-002 | Devo publicly announced a $250M Series E financing at a $1.5B valuation in October 2021 and stated it had more than 400 employees. | verified high | SRC-002 |
| EC-003 | Devo publicly announced a $60M Series D in September 2020, named Marc van Zadelhoff CEO, referenced a U.S. Air Force contract and cited strong 2020 growth/headcount momentum. | verified medium | SRC-003 |
| EC-004 | Devo presents itself as an active private cybersecurity software company focused on cloud-native logging and security analytics. | verified high | SRC-004 |
| EC-005 | Devo publicly presents packaging around Data Analytics Cloud, Intelligent SIEM Starter and Intelligent SIEM, with pricing requiring contact rather than a transparent public price book. | partially verified medium | SRC-005 |
| EC-006 | Devo publicly markets customer logos, customer stories and testimonials, but does not disclose top-15 customers, ARR by customer or churn. | partially verified medium | SRC-006 |
| EC-007 | Devo publishes partner and integration pages that indicate a go-to-market and technical ecosystem, while partner economics remain undisclosed. | partially verified medium | SRC-007SRC-008 |
| EC-008 | Devo maintains a public trust center, but underlying SOC reports, penetration tests, security exceptions and DPAs require private review. | partially verified medium | SRC-009 |
| EC-009 | Devo appointed Ken Naumann as CEO in March 2025 and described Walter Scott as Executive Chairman, indicating a recent leadership transition. | verified high | SRC-010SRC-011 |
| EC-010 | Devo traces corporate/product history to Logtrust, which announced a rebrand to Devo in 2018. | verified medium | SRC-013 |
| EC-011 | Gartner Peer Insights lists Devo in the Security Information and Event Management market category, corroborating category placement. | verified medium | SRC-014 |
| EC-012 | Devo identifies competitive alternatives including Splunk, Elastic, QRadar, LogRhythm, Microsoft/Azure, Google Chronicle, Palo Alto Networks/Cortex, CrowdStrike, Exabeam and Securonix. | verified medium | SRC-015 |
| EC-013 | A Devo release quoting IDC states the SIEM market was $6.2B, grew 21.7% from 2022 to 2023 and named Devo a Leader in the 2024 IDC MarketScape. | partially verified medium | SRC-016 |
| EC-014 | Devo publicly markets Intelligent SIEM as combining SIEM, SOAR, UEBA and AI capabilities, including ThreatLink, DeepTrace and Behavior Analytics. | partially verified medium | SRC-017 |
| EC-015 | Devo launched Data Orchestration in July 2024 with routing to destinations such as Amazon S3, Databricks and Snowflake. | verified medium | SRC-018 |
| EC-016 | Devo publicly markets DeepTrace as autonomous investigation and threat-hunting functionality for tracing attacks. | partially verified medium | SRC-019 |
| EC-017 | Devo announced FedRAMP Moderate authorization in January 2024. | verified medium | SRC-020 |
| EC-018 | Devo announced StateRAMP Moderate authorization in June 2024. | verified medium | SRC-021 |
| EC-019 | A public CourtListener screening search did not surface a confirmed material Devo litigation matter in this research pass, but the search is not exhaustive. | inconclusive low | SRC-022 |
| EC-020 | Devo annual/quarterly financial statements, backlog, accounts receivable aging, revenue by customer and management financial reports are not publicly available. | not publicly verifiable high | SRC-001SRC-002SRC-003SRC-004 |
| EC-021 | Devo current cap table, share counts, option pool, liquidation preferences, debt and off-balance-sheet obligations are not publicly available. | not publicly verifiable high | SRC-001SRC-002SRC-003 |
| EC-022 | Devo has had multiple public CEO transitions since 2020, including Marc van Zadelhoff in 2020 and Ken Naumann in 2025. | verified high | SRC-003SRC-011 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.