Eleven days of dwell time, cut to 89 seconds.

Enterprise security spending has tripled in a decade, and mean adversary dwell time has barely moved. Across the incidents Halstead Labs reconstructed in 2026, the median attacker held access for 264 hours before anyone acted — not because the alert never fired, but because a human had to read it, believe it and approve a response.^[2]

Sentinel Grid sells into that gap. Meridian is an autonomous containment platform that isolates a compromised identity, host or workload in under ninety seconds, without waiting for an analyst — and it is deployed today across 412 production tenants in regulated industries.^[1][5]

The product surface is deliberately narrow. Meridian does not try to replace the SIEM, the firewall or the email gateway; it consumes their telemetry and decides, autonomously, what to cut off.^[1]

Sentinel Grid Security Corp. is a cybersecurity software company incorporated in Delaware — founded in 2019 by three incident response leads who had spent a combined thirty years arriving at breaches after the fact and concluding, every time, that the detection had worked and the response had not.^[1]

The company sells Meridian directly to enterprises and through a managed-service partner channel, and in 2025 acquired Vantage Identity Systems, whose identity-graph engine now underpins Meridian's blast radius calculation.^[1]

On February 18, 2026, independent evaluators Halstead Labs and the Northbridge Cyber Test Range completed a blind adversary emulation series against Meridian, running 216 full attack chains across identity, endpoint, cloud and OT segments.^[2]

Median time from initial access to full containment was 89 seconds. More than 99% of containment actions were assessed as correct, with a false isolation rate of 0.3% — the metric that historically kills autonomous response products, because a platform that quarantines the CFO's laptop during a board meeting does not get a second chance.^[2]

Lower dwell time means smaller blast radius, lower breach cost, and a product an insurer will underwrite against — which is where enterprise budget actually comes from.^[2]

Most platforms in this market are detection systems: they generate signal and hand it to a human. The industry's answer to too many alerts has been better alerts, which is why the average SOC still triages thousands a week and dwell time has not moved.^[2]

Meridian inverts the design. Detection is an input, not the product. The system's job is the decision — cut this identity, freeze this workload, revoke this token — and to be right often enough to be trusted with the authority to act.

The evaluation also confirmed that Meridian's accuracy holds up because the identity graph makes blast radius computable. Rather than scoring an alert in isolation, the engine knows what a compromised principal can reach, and contains along that reachability boundary — a well-understood graph problem rather than a probabilistic guess.^[2]

“The Halstead results are definitive. They confirm that autonomous containment can operate at enterprise scale with a false isolation rate low enough for production. The ability to cut median dwell time from days to under two minutes, with no analyst in the loop, represents a compelling pathway for value creation.”

Meridian ingests telemetry from existing endpoint, identity, cloud and network controls, resolves every actor into a single principal on a continuously updated identity graph, and computes reachability — what each principal can touch, through which credential, at this moment.^[1]

The containment plane sits alongside it, holding pre-authorised enforcement paths into the customer's own controls. When reachability plus behaviour crosses a threshold, enforcement executes directly against those controls, with a full decision record written before the action completes — which is what makes the behaviour auditable to a regulator rather than merely fast.^[1]

Between 2019 and 2024 the platform was tested in five independent evaluation programs, each conducted under different methodologies and each showing sequential improvement in containment latency and decision accuracy (Corwin, Redline, Halstead, Northbridge).^[3][4]

The business has 412 production tenants, with the revenue base concentrated in regulated industries:^[1]

ARR grew 58% year over year, driven roughly two thirds by expansion within existing tenants and one third by new logos. The top ten customers represent 21% of ARR, down from 34% two years ago. Gross retention was 96%, and the company reported its first positive operating cash flow quarter in Q4 FY2026.^[1]

These figures are illustrative and belong to a fictional issuer created to demonstrate a landing-page format. ARR, net revenue retention and Rule of 40 are non-GAAP operating metrics; definitions vary between companies and these are not substitutes for GAAP revenue. Forward-looking statements involve risks and uncertainties, and actual results for any real issuer would differ materially. A qualified reader should rely only on audited financial statements filed with the relevant securities regulator. Nothing here is an offer of securities or investment advice.

These evaluations were conducted under differing methodologies, scopes and threat models, and are historical in nature. They should not be treated as directly comparable to one another or to the February 2026 results, and are presented to show the trajectory of the platform rather than as a current performance guarantee.^[4]

Phase 2 focuses on extending autonomous containment into operational technology and third-party SaaS estates, where reachability is hardest to compute and where the largest uncovered blast radius now sits. Additional evaluation results from Northbridge are expected in the second half, alongside the general availability of the OT connector suite and an expanded MSSP enablement program.^[2]

Disclosure regimes in the United States, the European Union and Australia now turn on materiality determined within days, not weeks. Cyber insurers have followed, pricing premiums against demonstrated containment capability rather than control inventories.^[1]

Sentinel Grid's strategy is to make containment latency a reportable, auditable number that a CISO can put in front of a board, a regulator and an underwriter — turning a security control into a financial instrument.^[1]

The company benefits from FedRAMP Moderate authorisation, which shortens procurement in the public sector and in defence-adjacent supply chains. The combination of a defensible accuracy advantage, a clear multi-segment expansion path and growing regulatory urgency around response time positions Meridian as a platform with significant commercial and strategic potential.^[1]

Vantage Identity Systems built a continuously resolved graph of principals, credentials and entitlements across hybrid estates. It was acquired in 2025 for $46M in cash and stock, and its engine is now the reachability core of Meridian rather than a separately marketed product.^[1]

*Vantage Identity Systems Inc., audited financial statements (2025), and management estimate. Pre-acquisition figures relate to the standalone business, not to consolidated Sentinel Grid results.^[6]

The graph is what makes autonomous action defensible. Without it, containment decisions are probabilistic scores applied to isolated alerts; with it, they are reachability calculations that can be explained line by line to an auditor after the fact.^[1]

Integration is complete across identity, endpoint and cloud connectors, with the OT connector suite in beta across nine manufacturing and utility tenants. Those environments carry the largest uncovered blast radius in the customer base and are the focus of the Phase 2 program.^[1]

Sentinel Grid Security Corp. acknowledges that a platform authorised to cut off identities and workloads without human approval carries an obligation beyond the commercial one. Every containment action is reversible, recorded and explainable, and every customer retains the authority to define, narrow or revoke the enforcement paths the platform is permitted to use.^[1]

• Publish independent evaluation results, including the failures
• Write an immutable decision record before any action completes
• Keep every containment action reversible by the customer
• Process telemetry in-region and never sell or train on customer data
• Maintain a coordinated disclosure program for our own product

The approach is grounded in the principles of least privilege, auditability and customer control — on the belief that autonomous security can only be sustained if the people it protects can see exactly why it acted.^[1]