The Ukraine Fund That Led SOC Prime’s Quiet Round

SOC Prime closed its next investment round on October 16, 2025, then put Sigma detections on live Kafka streams the following spring. The Boston company never published the check size.

u.ventures led. DNX Ventures, Atlantic Bridge, J-Ventures, and Angel One joined. A share of the money was earmarked for U.S. defense, energy, finance, and technology accounts, on a platform already used by over 11,000 organizations.

u.ventures Led a Round Nobody Priced

Databases later filed the deal under later-stage labels. SOC Prime called it a strategic investment. The amount is still undisclosed.

That gap is not a rounding error. In October 2021 the company said it had closed an $11 million Series A led by DNX Ventures, taking its total raised at that time to $11.5 million. Four years on, it chose not to print a figure at all.

THE ROUND AT A GLANCE

• Close date: October 16, 2025, announced from Boston.
• Lead: u.ventures, with Andrii Sorokhan as venture director.
• Other backers: DNX Ventures, Atlantic Bridge, J-Ventures, and Angel One.
• Amount: Undisclosed; the 2021 Series A was $11 million.

DNX was not a tourist. It led the 2021 round and came back. Atlantic Bridge had also been around the company. The new names at the front of the release were u.ventures and Angel One, both tied to Ukrainian capital rather than a standard Sand Hill growth shop.

Andrii Sorokhan, venture director at u.ventures, said, “AI is reshaping every layer of the security stack.” He described SOC Prime as a bet on an AI-native SOC that is real-time, resilient, and privacy-first. He did not disclose his fund’s check.

A USAID-Era Fund With a Kyiv Checkbook

u.ventures is not a generic AI fund that happened to like a pitch deck. Western NIS Enterprise Fund, now the Ukraine-Moldova American Enterprise Fund, launched u.ventures for Ukrainian and Moldovan startups in 2017. The parent was created by the U.S. Congress and funded through USAID under the SEED Act to build private firms in the region.

UMAEF, based in Chicago, said in 2024 that it had put more than $190 million into 143 companies that employ about 27,000 people. The same release described u.ventures as a $15 million early-stage arm. On its own site, u.ventures says its investments range from $200,000 to $2 million, and it lists offices in San Francisco and Kyiv.

A $15 million arm writing checks in that band does not price a late-stage AI giant. It prices a follow-on into a company UMAEF can claim as proof that Ukrainian founders still sell globally. Angel One made that reading explicit. Ivan Petrenko, managing partner of Angel One Fund, said, “SOC Prime represents the strength and global ambition of Ukraine’s deep-tech ecosystem.”

FROM THE FUND TO THE PRODUCT

1. 2015: SOC Prime is founded by Andrii Bezverkhyi and fellow Ukrainian engineers, later dating the firm from Boston.
2. 2017: The U.S. enterprise fund for Ukraine and Moldova sets up u.ventures as its early-stage tech arm.
3. October 19, 2021: SOC Prime closes an $11 million Series A led by DNX Ventures, taking total raised to $11.5 million.
4. October 16, 2025: u.ventures leads a strategic round with DNX Ventures, Atlantic Bridge, J-Ventures, and Angel One.
5. February 20, 2026: SOC Prime open-sources DetectFlow, a Sigma engine on Kafka streams via Apache Flink.
6. March 12, 2026: The company ships DetectFlow Enterprise for air-gapped and cloud customers.

Bezverkhyi has also said the firm’s early detection queries helped investigators of the BlackEnergy 2 and 3 attacks on Ukraine’s power grid. That history sits behind the patriotism in the new round. It also sits behind the product the money paid for, which is not a chatbot bolted onto a SIEM console.

DetectFlow Is What the Round Bought

The October release promised a scalable AI-native detection automation platform that would tailor a library of more than 600,000 detections to each customer, plus shift-left logic that runs closer to the source. In February 2026, SOC Prime put a public GitHub repo, detectflow-main, in front of that claim.

The company said DetectFlow runs thousands of Sigma rules on live Kafka streams through Apache Flink, with millisecond matching, before data hits the SIEM. No vendor lock-in. It works air-gapped.

We open-sourced DetectFlow, a detection intelligence engine that runs Sigma detections on Kafka streams via Flink. Thousands of rules, millisecond matching, before data hits the SIEM. No vendor lock-in. Works air-gapped.

Get repo here: https://t.co/LOqKximbje#soc pic.twitter.com/ZwcOGtxDzx

— SOC Prime (@SOC_Prime) February 20, 2026

Three weeks later it sold the paid layer. SOC Prime released DetectFlow Enterprise on March 12, 2026, still from Boston. The enterprise build keeps the stream engine and adds attack-chain correlation, log and user management, and support SLAs. On X, the company listed those as the gaps versus the open-source code.

An Open-Source Engine in February

Open-sourcing the matcher was a distribution move as much as a licensing one. Anyone who already runs Kafka can put Sigma on the pipe without buying a new SIEM. That is how a vendor-agnostic shop with over 56 SIEM, EDR, data lake, and data pipeline platforms tries to sit in front of all of them at once.

The Enterprise Build in March

Enterprise is the billable form of the same idea. SOC Prime said DetectFlow can reach a mean time to detect of 0.005 to 0.01 seconds and raise rule capacity on existing kit by up to ten times. It needs no change to established SIEM workflows. It supports air-gapped and cloud-connected deployments, which is the privacy-first line from the funding memo, restated as a shipping SKU.

WHAT DETECTFLOW DOES IN FLIGHT

• Match at ingest: Tens of thousands of Sigma detections run on live Kafka streams with Apache Flink, before SIEM, EDR, or data lakes.
• Tag and enrich: Events are labelled and filled out while they are still moving, so downstream tools see less raw volume.
• Correlate early: Pre-SIEM correlation across log sources is meant to surface attack chains and cut false positives.
• Keep data local: Air-gapped and cloud modes let a customer hold telemetry instead of shipping it all to a vendor cloud.

On April 22, 2026, SOC Prime was still running a live DetectFlow walkthrough with Bezverkhyi on the call. The round was then six months old. The product tour was the fundraising pitch, still in market.

Why Put Detection on the Kafka Stream?

The obvious objection is duplication. If a SIEM already runs detections, a second engine on Kafka looks like a copy of the same rules with extra moving parts. One engineer put that challenge to the company in February, asking what DetectFlow added besides a second rule count.

SOC Prime’s answer is economic, not poetic. It said most SIEMs degrade past about 500 custom rules, while DetectFlow runs 12,000-plus Sigma detections per pipeline on the Kafka stream before ingestion. Classified events do not have to be indexed again. The SIEM’s machine-learning and behavior tools, in that telling, keep the work they are good at.

That is the shift-left number from the funding release, turned into a product. The company said its engineers hit a sustained throughput of 23 TB/day per CPU core by running detection logic closer to the source. DetectFlow is that claim with a SKU, a GitHub repo, and a millisecond timer.

I have spent most of my career working across threat detection, SIEM, EDR, and SOC operations, and one challenge remained constant. Detection logic was always constrained by the performance and economics of the underlying stack. With DetectFlow Enterprise, we are giving teams a way to move beyond those constraints by turning the data pipeline into an active detection layer, running rules at stream speed, enriching telemetry in flight, and helping organizations scale detection without rearchitecting the rest of their security environment.

Andrii Bezverkhyi, CEO and founder of SOC Prime, DetectFlow Enterprise launch

Whether those economics hold depends on Kafka already being in the customer’s path. Teams that still dump logs straight into a SIEM have to insert a stream layer first. The pitch assumes that insertion is cheaper than buying more ingest.

Over 11,000 Organizations Already Sit on the Library

The round did not create the customer base. SOC Prime said it already served over 11,000 organizations and that its detection intelligence runs on over 56 platforms. The asset u.ventures bought into is a content library, not a greenfield model.

The company calls that library the world’s largest private set of context-enriched rules and queries, at more than 600,000. Uncoder AI is the IDE that writes, translates, and patches those rules across SIEM, EDR, and data-lake languages, including Sigma. DetectFlow is how those rules leave the IDE and sit on the wire.

SOC PRIME IN NUMBERS

Those figures are the company’s. They are also why a small lead check can still matter. A fund that writes up to $2 million does not need to buy distribution if 11,000 organizations are already pulling rules. It needs the library to run cheaper, earlier, and on gear the customer already paid for.

Privacy is the other half of that sale. Uncoder and the wider platform run on SOC Prime’s private cloud with a SOC 2 Type II program the firm marked at five years in late 2025. DetectFlow’s air-gapped mode is the same promise at the ingest layer, aimed at buyers who will not ship telemetry to a public model.

Defense and Energy Are the Boston Push

SOC Prime’s dateline is Boston. Its founding story is Ukrainian. A portion of the new money, the company said, expands U.S. presence and direct support for customers in defense, energy, finance, and technology. That is the export path UMAEF was built to finance, dressed as a domestic sales plan.

Angel One joined the investment round of SOC Prime on those terms. Petrenko framed the deal as Ukraine setting a global cyber-defense standard. Bezverkhyi, a Ukrainian-born engineer who runs the company from the U.S. side, said the work was “AI for defenders, by defenders,” built to hold up in tough environments.

The environments named in the release are U.S. critical-infrastructure sectors, not a lab. DetectFlow’s air-gapped mode is the feature that makes that list plausible. A defense or energy SOC that will not put logs on a public LLM can still run Sigma on its own Kafka cluster.

The check size is still unpublished. The GitHub repo is not. In April 2026 the company was still walking buyers through DetectFlow on a live call, six months after u.ventures took the lead slot, and the product on that call was a stream engine, not a priced term sheet.