Problem

Haleum’s haleum.ai domain now presents Candor Security, which a startup listing identifies as formerly Haleum. The company addresses insider risk and data loss prevention: employees may share sensitive data with third parties, email source code to personal accounts, or move files before leaving, while legacy DLP and insider-threat tools rely on static rules that generate noisy false positives. The resulting pain is slow, costly, error-prone investigation work, delayed containment, and exposure of corporate data and customer trust—risks that can affect a company’s ability to close deals.

The killer use case is helping a lean security team determine whether a suspicious employee action is genuinely dangerous. Rather than treating every isolated event as equally important, the system is intended to identify the riskiest individuals, assemble the surrounding behavioral context, and surface cases such as sensitive USB transfers after resignation, data sent to personal accounts, or other coordinated signals that require rapid containment.

Product / Service

Haleum/Candor is an agentic DLP and insider-risk-management platform. Its AI agents correlate activity from endpoints, identity systems, SaaS applications, collaboration tools, HR systems, ITSM platforms, and SIEMs, then construct behavioral timelines that connect data movement with the person and apparent intent behind it. The product ranks high-risk individuals, provides an investigation graph and context-aware investigation copilot, supports plain-English data-movement rules, and can trigger actions such as disabling an account, restricting access, escalating a ServiceNow case, or notifying a manager.

The delivery model is enterprise software available through cloud or on-premise deployment, with most organizations reportedly live within a week and integrations delivered through APIs rather than installed agents or network taps. The claimed benefit is higher-signal detection with less analyst triage: the company says its approach reduces mean time to investigate by 80%. It also says inference runs on isolated infrastructure, customer data remains within the customer tenancy, and outputs are auditable and explainable.

Market

The company competes in cybersecurity, specifically the emerging overlap of agentic data loss prevention, insider risk management, human-risk intelligence, behavioral analytics, and adjacent UEBA/SIEM workflows. Established and adjacent alternatives include DTEX Systems, Varonis, Securonix, Microsoft Purview Insider Risk Management, Proofpoint ObserveIT, Gurucul, Code42 Incydr, Forcepoint, Teramind, and others. Candor positions itself as a layer that complements rather than replaces existing SIEM and SOAR infrastructure, differentiating on behavioral context, intent, and reduced alert noise.

The available evidence indicates an early-stage company rather than a scaled incumbent. The current Candor record is an active Y Combinator Winter 2025 company, and the website displays testimonials attributed to a Fortune 500 enterprise, a global semiconductor company, and Chevron’s CISO, alongside a company-reported 80% reduction in investigation time. Public company-directory data reports no confirmed revenue or customer count and $0 in outside funding, so the most accurate traction description is early enterprise validation with revenue undisclosed—not definitively proven pre-revenue.