Published 22 hours ago

Blumira Launches Hearth: AI Command Center for Security Teams Using Multiple Tools

Most security teams aren’t running a clean, single-vendor stack. They’re running a patchwork — an EDR from one vendor, identity tools from another, a firewall from a third, cloud logging from somewhere else entirely. The result is constant context-switching, slow investigations, and alert fatigue that no amount of dashboards seems to fix.

Blumira’s answer to that problem is Hearth, a vendor-agnostic AI command center built to work across the tools security teams already have — without asking them to rip anything out.

4 mins read

7 sections

Key Highlights

Hearth adds an AI command layer over existing multi-vendor security tools, not a new stack.
DFIR, compliance, and threat hunts produce schema-validated artifacts that can be reused over time.
Built for SOCs and MSPs needing cross-tenant visibility and response without tool consolidation.

What Hearth Actually Does

Hearth is positioned as a command layer, not a replacement stack. Instead of consolidating the underlying tools, it consolidates where analysts think, investigate, and act.

The platform reasons across three data sources simultaneously:

Parsed logs from Blumira’s existing platform (for current customers)
The broader tool environment — identity, EDR, firewall, cloud, and raw logs
The organization’s public-facing attack surface

That cross-source reasoning is what separates Hearth from a standard SIEM query interface. An analyst can ask a question and get an answer that draws from multiple systems at once, rather than manually correlating data across tabs.

The Output Is Built to Last

One of the more practical design decisions here is that Hearth generates schema-validated artifacts — not just answers that disappear after a session.

That means a DFIR investigation doesn’t just surface findings in the moment. It maps activity to MITRE ATT&CK, identifies affected entities, establishes severity, and recommends actions. The compliance evidence Hearth produces comes with the underlying query attached, so an auditor can see exactly how the answer was reached. Threat hunt playbooks can be saved and re-run next quarter.

This reusability angle matters. Security work tends to be disposable by default — investigations close, notes get buried, institutional knowledge walks out the door. Hearth appears to be designed around the idea that security intelligence should compound over time rather than reset with every case.

Four Use Cases at Launch

Blumira is leading with four specific scenarios:

Full-scope DFIR investigations — severity, MITRE mapping, affected entities, and recommended actions, reportedly in minutes rather than hours
Compliance queries — ask where an audit control stands, get live log evidence with the query that produced it
Response orchestration — Hearth proposes an action, a human approves it, it executes through existing integrations, removing the need for a separate SOAR tool
MSP fleet management — a single query covers an entire client base, so analysts don’t have to page through separate account dashboards to check exposure to a newly disclosed vulnerability

The MSP use case is worth noting specifically. Multi-tenant visibility at scale is a genuine pain point for managed service providers, and a single-question interface across a client fleet is a meaningful workflow improvement if it holds up in practice.

Who This Is For

Hearth is explicitly available to organizations that don’t use Blumira at all. That’s a deliberate positioning move — it signals that Blumira is competing for the command layer, not just trying to expand its existing customer base.

The target buyer is a security team that has already made tool decisions and isn’t looking to consolidate onto a single vendor. They want faster investigations and better coordination without a rip-and-replace project.

As Blumira CEO Matt Warner put it, the pitch is that Hearth “reasons across the environment a team already has, and produces resources that outlive any single case.”

Context: Where Hearth Fits in Blumira’s Trajectory

Hearth isn’t a standalone pivot. It follows a busy stretch for the company that included expanded endpoint and identity threat detection coverage, the Kindling auto-triage engine, and the launch of Blumira Managed, a 24/7 managed detection and response service.

Blumira was founded in 2018 and has raised approximately $28 million, with backers including Ten Eleven Ventures, Mercury Fund, M25 Group, RPS Ventures, and Array Ventures. The most recent round — $15 million — closed in June 2023.

Hearth is available now.

The Practical Takeaway

The “consolidate your tools vs. keep best-in-class” debate has been running in security circles for years. Hearth doesn’t resolve it — but it does sidestep it by making the command layer the consolidation point instead.

For security teams that are tired of that debate and just want faster investigations without a procurement project, Hearth is worth a close look. The real test will be how well the cross-tool reasoning holds up across genuinely complex, multi-vendor environments — and whether the artifact quality is good enough to hand directly to an auditor.