Skip to content
HOMETECH DIRECTORYNEWS & DEVELOPMENTSRELOCATEEMPLOYERSNEIGHBORHOODSABOUTSchedule a Call

Blumira: The Ann Arbor Cloud SIEM Built for the Mid-Market

Blumira is the Ann Arbor cloud SIEM and XDR platform for mid-market IT teams. $27.9M raised. Backed by Mercury Fund, Ten Eleven Ventures, and Duo co-fou...

A2Hub Editorial· Rusty Roof Media· Updated May 4, 2026

Blumira

By A2Hub Editorial. Published 2026-04-22. Last updated: 2026-04-22.

At a glance

  • Founded: 2018
  • HQ: Ann Arbor, Michigan
  • Employees: Approximately 40
  • Funding raised: Approximately $27.9M total ($2.6M seed; $10.3M Series A in 2021 led by Mercury Fund; $15M Series B in 2023 led by Ten Eleven Ventures with Duo co-founder Jon Oberheide participating)
  • Customers: 300+ mid-market organizations across IT, healthcare, manufacturing, financial services, and education
  • Status: Private, growth-stage
  • Website: blumira.com

The pitch in one line

Blumira is the cloud SIEM that mid-market IT teams can actually deploy. It was built in Ann Arbor by security operators who watched the SIEM category fail mid-market customers for two decades, and it has spent the last six years proving that detection and response can be packaged for IT teams without a 24/7 SOC.

Founding story: SIEM for the rest of the market

Blumira was founded in 2018 by a team of Ann Arbor security operators with backgrounds in mid-market IT, MSP services, and the broader SOC / SIEM industry. The thesis was specific. SIEM (Security Information and Event Management) had been a category since the early 2000s, with Splunk, IBM QRadar, and ArcSight as the dominant players. Every one of those products was priced and engineered for enterprises with full-time security operations centers and dedicated SIEM administrators. The mid-market IT team (a manufacturing company with 500 staff, a regional credit union, a school district) could not deploy any of them, and the consequence was that those organizations did not have meaningful detection and response coverage.

Blumira's bet was that you could build a cloud-native SIEM with detection rules built in, automated response actions out of the box, and a deployment model that an IT generalist could complete in hours rather than months. The product would be priced for the mid-market and supported in a way that did not require the customer to operate a SOC.

The bet hit. Blumira's customer count crossed 300 organizations, the platform expanded into XDR (Extended Detection and Response) territory, and the company raised institutional capital through three rounds.

What they build

Blumira's product is cloud SIEM and XDR for mid-market IT teams. The platform spans:

Detection. Pre-built detection rules covering identity, endpoint, cloud workload, network, and SaaS application telemetry. The detection content is curated by Blumira's security team rather than left to the customer to write, which is the SIEM-industry norm.

Response. Automated response actions (account lockout, session termination, IP block) that fire on detected threats without requiring a 24/7 SOC to make the call. The product also surfaces playbooks for the responses that need a human in the loop.

Cloud-native deployment. Hosted, multi-tenant, accessible via SaaS. Deployment is sensors-and-collectors rather than on-premises hardware, which has been the install-killer for legacy SIEM in mid-market environments.

Reporting and compliance. Pre-built reporting for the regulatory frameworks that mid-market customers actually have to meet (HIPAA, PCI-DSS, CMMC, SOC 2). The compliance reporting is the wedge for many customers who buy Blumira initially for audit purposes and then expand into operational security use.

The customer base is the long tail of US mid-market: regional banks, manufacturers, healthcare organizations, school districts, MSPs serving small business, and the IT teams of mid-sized professional services firms.

Funding history

Blumira's capital arc has been deliberate.

  • Seed (2019): $2.6M to validate the cloud SIEM thesis with early customers
  • Series A (2021): $10.3M led by Mercury Fund, the Houston- and Ann Arbor-active fund that has been deeply involved in Michigan cybersecurity. The round funded the build-out of the engineering and customer success teams.
  • Series B (2023): $15M led by Ten Eleven Ventures, with Jon Oberheide (Duo Security co-founder) participating as an investor. The round funded the XDR expansion and continued customer growth.

Total: approximately $27.9M. That is a capital-efficient profile relative to coastal SIEM and XDR competitors. The company has built a real customer base and a real ARR figure on a fraction of the capital that comparable category entrants have consumed.

Ann Arbor footprint

Blumira is one of the cleanest examples of how the Duo Security alumni effect has reshaped the downtown Ann Arbor cybersecurity scene. The Series B investor list includes Duo co-founder Jon Oberheide. The recruiting bench overlaps with Duo, Censys, and the broader Ann Arbor security cluster. Several Blumira hires have come from the Duo or Censys alumni network.

The Ann Arbor team is roughly 40 staff. The hiring profile favors experienced security engineers, customer engineers (deployment and detection-tuning), and the standard product engineering bench. The company runs a hybrid model with an Ann Arbor anchor. For a security engineer in the city, Blumira is the obvious mid-stage option for someone who wants ownership and product impact without the scale of Cisco Duo.

Leadership and people

Blumira's executive bench has been built from the Ann Arbor and broader Midwest security operator network. Steve Fuller has served as CEO. The leadership team has historically been composed of operators with mid-market security backgrounds rather than enterprise SaaS executives, which fits the customer-facing posture of the company.

The investor bench is part of the leadership story. Jon Oberheide's participation in the Series B is a signal: a Duo co-founder doubling down on the Ann Arbor security cluster as an investor and advisor.

Why it matters

Three reasons Blumira matters for the Ann Arbor cybersecurity story.

First, it is one of the most capital-efficient mid-stage cybersecurity companies in the city. Roughly $28M raised, 300+ customers, real product-market fit. That is a balance sheet that scales without the existential capital pressure that destroys many security startups.

Second, it is the clearest example of the Duo alumni effect operating across Ann Arbor cybersecurity. Duo's exit released talent and capital into the local ecosystem; Blumira is one of the firms that has absorbed both, with Duo alumni and Duo-founder investment shaping the company's trajectory. That maps onto the broader is Ann Arbor a tech hub story.

Third, the mid-market positioning is strategically defensible. Most cybersecurity product strategy aims at the enterprise top of the market, where budgets are large and competition is brutal. Blumira aimed at mid-market, where budgets are smaller per customer but the addressable customer count is much larger and the competition has historically failed to deliver an actual product. That is the kind of bet that compounds over a decade.

Related

  • Duo Security is the flagship Ann Arbor cybersecurity exit and the source of the alumni network and investor capital that has shaped Blumira.
  • Censys is the U-M-spinout internet intelligence company that anchors the other end of the Ann Arbor security stack.
  • Arbor Networks (NETSCOUT) is the historical lineage piece, the original Ann Arbor cybersecurity exit that Dug Song trained at before founding Duo.
  • The cybersecurity category hub covers every Ann Arbor security firm.
  • The companies directory is the master index.

FAQ

Where is Blumira headquartered? Blumira is headquartered in Ann Arbor, Michigan.

When was Blumira founded? 2018, by a team of Ann Arbor and broader Midwest security operators with backgrounds in mid-market IT, MSP services, and the SOC / SIEM industry.

What does Blumira do? Blumira is a cloud SIEM and XDR platform built for mid-market IT teams. The product spans detection, automated response, cloud-native deployment, and pre-built compliance reporting.

How much funding has Blumira raised? Approximately $27.9M total: $2.6M seed, $10.3M Series A in 2021 (Mercury Fund), and $15M Series B in 2023 (Ten Eleven Ventures, with Duo co-founder Jon Oberheide participating).

Who are Blumira's customers? More than 300 mid-market organizations across manufacturing, healthcare, financial services, education, MSPs, and professional services firms. The customer profile is mid-sized US enterprises that need detection and response coverage but cannot deploy a traditional enterprise SIEM.

How does Blumira differ from Splunk, QRadar, or other legacy SIEMs? Legacy SIEMs are priced and engineered for enterprises with full-time security operations centers. Blumira is cloud-native, deployable in hours rather than months, comes with detection content pre-built, and is priced and supported for mid-market IT teams that do not run a 24/7 SOC.