Above Security Joins Microsoft Pegasus: Insider Risk Claims and What Purview Admins Should Check

What happened​

Above says it has joined the Microsoft for Startups Pegasus Program, Microsoft's invite-only program for B2B startups selling to the enterprise. Microsoft's own page describes the program narrowly. It helps qualified startups accelerate enterprise customer acquisition through curated introductions and hands-on go-to-market support.

That is a sales and introductions program. Microsoft's description doesn't say that members are certified, that their products are validated, or that customers will buy. Above's own post is more enthusiastic. It describes the program as a way to reach customers through products "already vetted" by Microsoft. Treat that as marketing language.

Above has also said it is available through Azure Marketplace. The company says its platform is available through Azure Marketplace. Marketplace availability gives customers a procurement route. It doesn't tell you the price, the terms or whether the product fits your tenant.

The company adds that this follows a $50 million round led by Ballistic Ventures, Merlin Ventures and Norwest, plus a strategic investment from CrowdStrike's Falcon Fund. Those figures are company-reported.

What Above says the product does​

Above sells a managed, AI-driven insider-risk service. Its pitch is that Microsoft tools already collect plenty of signals, and the hard part is turning them into answers. The questions it says it targets are who or what agent acted, whether it was intentional, and what should happen next.

Purview​

• Above says it reads each Purview DLP alert alongside the person's behavior across apps. It also checks whether Purview blocked the action or only audited it, then looks at what the person did afterward.
• When an investigation finds a gap, Above says it drafts a new Purview DLP policy from the incident, for an admin to approve and test before it goes live.
• The press release adds that, once the administrator approves, the policy is created in the customer's own tenant. It can run in test mode or block mode, and enforcement stays in Purview.

Defender, Entra and Teams/Outlook​

• The press release says Above imports Purview DLP alerts and the customer's sensitivity label catalog. It also imports endpoint signals such as USB transfers and printing from Defender for Endpoint, identity and role context from Entra ID, and Teams and Outlook activity.
• Above's blog says it maps each Defender device to its user. It also says it pulls live Defender evidence, including AI coding agents and MCP servers that appear in existing Defender data.
• The blog says finished investigations can be sent to Sentinel as incidents. The press release doesn't mention Sentinel, so treat that integration as a blog claim.

Copilot​

• Above says it reads the sensitivity labels on the files, emails and meetings Copilot draws on. If labeled content later leaves the company, the security team should already have context for what happened.
• The blog goes further. It says Copilot Studio agents are treated as identities, with each action tied to the person who drove it. It also says Microsoft's prompt-injection and jailbreak flags are investigated with that person's context.

Deployment​

Above's blog says each integration needs one Entra app registration and admin consent. It says the product supports SAML SSO and SCIM, and rolls out to devices through Intune. It gives no supported licensing tiers, regions or version requirements.

Context: Microsoft already does part of this​

Purview has its own Insider Risk Management. Microsoft's documentation says it correlates signals to identify potential malicious or inadvertent insider risks, such as IP theft and data leakage. It also says users are pseudonymized by default, with role-based access controls and audit logs.

Microsoft also ships Adaptive Protection. This feature links Insider Risk Management risk levels to DLP. Microsoft's Purview Suite bundles data loss prevention, insider risk management, audit and eDiscovery. Per Microsoft's docs, DLP policies can adjust as a user's risk level changes. The docs also say the quick-setup policies run in simulation mode. Elevated-risk users get block rules, and moderate and minor risk users get audit rules.

So Above's pitch is not "connect insider risk to DLP", because Microsoft already does that. The pitch is richer cross-app context, written investigation narratives, and policy drafts built from specific incidents. I haven't compared the two products, so I can't say how well Above does this or whether anyone else does.

One third-party profile argues that the main business risk for Above is Microsoft adding agentic investigation to Purview itself. That is an analyst view, not a fact. It is still a fair question for buyers.

Corrections and open points​

• Event dates: Above's blog gives November 16–18 for Microsoft Ignite in San Francisco. The press release and citybiz give November 17 and 18. Check the Ignite schedule before planning to stop by. Above says it will demo at the Microsoft for Startups Innovation Basecamp.
• USB and printing signals: The citybiz report mentions USB transfers and printing. That detail comes from the PR Newswire release, which attributes it to Defender for Endpoint. Above's blog doesn't mention it.
• Survey figures: The press release cites ISACA. ISACA's figures appear in the release as 59% naming AI-driven threats and deepfakes as their top 2026 concern, and 41% naming keeping pace with AI change as their biggest professional challenge. ISACA's own release dates the poll to October 20, 2025, and says it surveyed 2,963 digital trust professionals. These figures measure worry, not incident rates, and say nothing about whether Above works.

What admins should ask before adopting it​

1. Licensing: Which Microsoft 365 or Purview licenses does Above need to read DLP alerts, labels and Defender data? Microsoft's own Purview features carry licensing requirements.
2. Data handling: Where do imported alerts, HR data and employee activity live? What are the retention terms and regional boundaries?
3. Privacy and legal review: Microsoft's Insider Risk Management pseudonymizes users by default. Ask whether Above preserves comparable protections, and what HR and legal teams would see.
4. Permissions: The blog says one Entra app registration with admin consent is enough. Review exactly which Graph and Defender permissions are requested before granting consent.
5. Policy governance: AI-drafted DLP policies still need human review. Start in test mode, as Above itself suggests, and check for overlaps with existing Adaptive Protection policies. Microsoft notes the most restrictive Endpoint DLP policy wins when a user is targeted by several.
6. Accuracy evidence: Ask for customer references and false-positive data. Pegasus membership and Marketplace listing are not substitutes.

Bottom line​

The verified event is modest: a startup has joined a Microsoft go-to-market program. Everything about what the product does comes from Above's own announcement. Security teams already on Purview, Defender and Entra may find the human-context idea worth a pilot. They should check the product's claims directly and compare it with Adaptive Protection first.