Above joins the Microsoft for Startups Pegasus Program

Above Security has joined the Microsoft for Startups Pegasus Program, Microsoft's invite-only program for B2B startups selling to the enterprise. 

The Pegasus Program empowers startups building with AI by connecting them with the tools, support, and global reach they need to turn bold ideas into real-world impact. 

Why this matters

Microsoft has a strong foothold in just about every part of the corporate ecosystem. Identities live in Entra ID, their endpoints report to Defender, their data policies sit in Purview, their SOC works out of Sentinel, and their people spend the day in Teams, Outlook, and Microsoft 365 Copilot. 

Those tools already collect a great deal of signals about what people do. The hard part is making these signals actionable, which is the work that Above does. We answer the investigative questions that have previously been manual to find out, if they were found at all: who (or what agent) did this, was it intentional, and what should happen next.  Our fleet of AI investigators combine telemetry from employee activity across SaaS, internal and custom applications with what Microsoft already sees. This means you get evidence instead of another alert. 

The Pegasus program ultimately leads to stronger security for Microsoft’s enterprise customers. This industry is very noisy and moves quickly, especially in the agentic era. Pegasus connects relevant participating startups not only to each other, but also to the enterprise. This collaboration allows security teams to spend less time evaluating emerging solutions by introducing them to those already vetted by one of the largest tech companies in the world. 

Pegasus also opens up a direct line of communication with a number of the Microsoft teams who help customers get more from their estate. This isn’t just access to a technical lead, it spans all the way from a success manager and industry lead all the way to their field sellers and partners. 

How Above works with a Microsoft environment 

We built Above to enhance the security stack a customer already owns by providing context to their data-rich Microsoft environment. We’re not here to replace any part of it, but rather to make their investment more useful. 

Microsoft Purview

Above allows Purview to improve from real incidents rather than manual tuning and static policies. We read every Purview DLP alert in the context of the person's behavior across apps, and how Purview responds. We check whether Purview blocked or only audited the action, then investigate what that person’s behavior afterward. When an investigation finds a gap, Above drafts a new Purview DLP policy from the incident for an admin to approve and test before it goes live. Above and Purview working together brings both agility and action, which is imperative for a modern insider risk program.  

Microsoft Defender and Sentinel

Many security teams already rely on Microsoft Defender to see what is happening on their endpoints, and on Microsoft Sentinel to run their SOC. Above builds on both. We map each Defender device to the person who uses it and pulls live evidence from Defender into its AI-led insider-risk investigations, including AI coding agents and MCP servers that show up in Defender data you already collect. When an investigation is finished, Above sends it to Sentinel as an incident with the full context attached, so the SOC can act on it in the console it already uses.

It finds AI coding agents and MCP servers in the Defender telemetry customers already collect. Finished investigations can land in Sentinel as incidents the SOC can act on. 

Microsoft 365 Copilot and Copilot Studio

Above sees Copilot use across Teams, Office and the browser, including the files, mail and plugins Copilot drew on. Copilot Studio agents are treated as identities, with each action tied to the person who drove it. Microsoft's own prompt-injection and jailbreak flags are investigated with that person's full context. Security teams get an owner for every Copilot action, which makes it easier to say yes to broader Copilot rollouts. 

Microsoft Entra ID and Intune

Each integration needs one Entra app registration and admin consent. Above supports SAML SSO and SCIM, and it rolls out to devices through Intune. Customers deploy it with the tools they already use. 

Above is available on Azure Marketplace 

Customers can purchase Above through the Microsoft procurement path they already have in place in Azure Marketplace. No new vendor setup, just terms negotiated. 

See Above on Azure Marketplace →

What comes next 

Above will be demoing at Microsoft for Startups Innovation Basecamp in at Microsoft Ignite San Francisco, November 16-18. If you'll be there, come by the Demo Hub or get in touch to set up a meeting. 

"Our customers run their security on Microsoft. Joining Pegasus means we can work with Microsoft's teams to bring investigated insider risk to every one of those customers, and to make the Microsoft platform they already trust even more valuable." 

- Aviv Nahum, CEO and Co-Founder, Above Security