HiddenLayer has closed a $100 million Series B, one of the largest rounds ever raised by a pure-play AI security company, and the clearest signal yet that protecting models, agents and AI workflows has moved from a niche concern to a board-level budget line. The round was announced on 2 September 2026 and led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, Microsoft’s venture fund M12 and Booz Allen Ventures all participating.
Three years ago, when HiddenLayer raised its $50 million Series A, sceptics still asked whether attacks on machine learning systems would ever materialise outside academic papers. That question has been answered. Enterprises now run production systems built on models they did not train, AI agents they cannot fully observe, and toolchains exposed to prompt injection, agent manipulation and malicious tool use. The cybersecurity industry has responded with a wave of funding, acquisitions and product launches aimed squarely at this new attack surface.
This article breaks down what HiddenLayer announced, the growth numbers behind the round, why enterprise demand for AI security is accelerating so quickly, and what the deal tells any business currently shaping its own AI strategy.
Table of contents
- What HiddenLayer Announced
- The Team Behind HiddenLayer
- Inside the HiddenLayer AISec Platform
- Adversarial AI, Explained: The Problem HiddenLayer Sells Against
- HiddenLayer Growth Numbers Behind the Round
- Why Enterprises Are Rushing to Secure AI Deployments
- The AI Security Funding Landscape
- What the $100M Means for HiddenLayer Customers
- What HiddenLayer’s Raise Means for Your Business
- HiddenLayer Funding FAQ
- References
HiddenLayer confirmed the $100 million Series B on 2 September 2026, first reported by TechCrunch and detailed in the company’s own press release. The Austin, Texas company did not disclose a valuation.
The round and who led it
Delta-v Capital led the investment. Ten Eleven Ventures — a firm that invests exclusively in cyber security — joined alongside Morgan Stanley, M12 and Booz Allen Ventures. The participation of Booz Allen is notable: the consultancy is one of the largest technology providers to the US federal government, and HiddenLayer already serves the US defence and intelligence communities.
What the money is for
The company says the funding will expand sales and distribution, deepen engineering and research investment, and accelerate growth in Europe and the wider EMEA region. HiddenLayer also plans to concentrate on three fronts where it believes enterprises are most exposed: agentic runtime security, securing autonomous coding agents, and protecting the agentic systems being layered on top of foundation models.
What it signals
A $100 million cheque into a single-category vendor is a bet that AI security becomes its own permanent discipline rather than a feature absorbed into existing platforms. HiddenLayer’s investors are effectively wagering that the attack surface created by enterprise AI deployments will keep growing faster than incumbent security suites can adapt.
HiddenLayer launched in 2022, founded by a team whose conviction came from direct experience: they had watched an adversarial attack against a production machine learning model unfold from the inside while working at security vendor Cylance.
Chris Sestito’s long game
Co-founder and CEO Chris Sestito has kept the company on a remarkably straight course. “We haven’t had to pivot, but we’ve had to grow our scope … from traditional modeling to Gen AI to agentic,” he told TechCrunch. That scope now runs from classical model theft and data poisoning through to prompt injection and rogue agent behaviour.
A patent moat
HiddenLayer reports 39 granted patents with a further 65 pending — an unusually deep intellectual property position for a company of its age, and a meaningful barrier for the fast-followers now entering the space.
HiddenLayer describes its product as security for AI, by design: a platform that protects models, agents and AI workflows from adversarial attacks, vulnerabilities and malicious code injections without needing access to a customer’s raw models or data.
The core capabilities
The platform spans discovery, runtime protection, attack simulation and supply chain security. Recent expansions have pushed it into distinctly agentic territory — detecting prompt injection, agent manipulation and malicious tool use as they happen.
| Capability | What it protects | Threats addressed |
|---|---|---|
| Discovery and supply chain scanning | Models and artefacts entering the estate | Malicious code hidden in model files, tampered dependencies |
| Runtime detection and response | Models and AI applications in production | Adversarial inputs, model theft, data extraction |
| Attack simulation and red teaming | Deployed AI systems before attackers reach them | Untested failure modes, jailbreak paths |
| Agentic Runtime Security | AI agents acting in production | Agent manipulation, tool misuse, unauthorised actions |
| Agent Harness Security | Autonomous coding agents | Compromised harnesses, unsafe code actions at runtime |
Agentic Runtime Security
The newest pillar gives organisations visibility into how their AI agents actually behave in production — flagging and stopping manipulation, tool misuse and unauthorised actions before they cause damage. Agents built with techniques such as reinforcement learning and large-model orchestration can drift in ways their builders never anticipated, and HiddenLayer’s pitch is that authentication alone cannot govern what an authenticated agent then does.
Agent Harness Security
Announced alongside the round, Agent Harness Security targets a very 2026 problem: enterprises adopting autonomous coding agents that write, refactor and ship software with limited human review. Securing the harness — the scaffolding that grants an agent its tools and permissions — is HiddenLayer’s answer to attacks that arrive through the development pipeline itself, a class of risk any ML model development programme now has to plan for.
To understand why investors keep writing nine-figure cheques for this category, it helps to understand what adversarial AI actually looks like in practice. These are not hypothetical attacks: each of the classes below has been demonstrated against production systems, and several have caused real-world incidents.
Data poisoning
An attacker who can influence the data a model learns from can shape its behaviour. Poisoning a fraction of one per cent of a training set can plant a backdoor that activates only on inputs the attacker chooses — invisible in normal testing, devastating when triggered. Because so many enterprises fine-tune on data scraped from the open web or collected from users, the poisoning surface is enormous.
Model theft and extraction
Trained models are expensive assets, and attackers can steal them without ever touching a file server. By systematically querying a deployed model and recording its answers, an adversary can train a close copy — extracting millions of pounds of research investment through a public API. Related extraction attacks recover fragments of the confidential data a model was trained on.
Prompt injection and agent manipulation
The newest and fastest-growing class targets generative systems and agents. A poisoned document, web page or email can carry instructions that hijack an agent’s goals when it reads them — persuading it to exfiltrate data, misuse a connected tool or take actions its operator never intended. Because agents increasingly hold credentials and act autonomously, a successful injection behaves less like a bad chatbot answer and more like a compromised employee. This is precisely the behaviour HiddenLayer’s agentic runtime products exist to catch.
Malicious models in the supply chain
Model files themselves can carry executable payloads. Security researchers — including HiddenLayer’s own — have repeatedly shown that a booby-trapped model downloaded from a public repository can run arbitrary code the moment it is loaded. For organisations pulling open-source models into their pipelines, scanning those artefacts is now as basic a hygiene step as scanning email attachments.
Investors did not fund a promise; they funded a growth curve. The figures HiddenLayer disclosed alongside the round explain why the Series B came together.
Revenue growing over 10x
Annual recurring revenue has grown more than tenfold in the past year, reaching tens of millions of dollars. More than 90 per cent of that growth came from new customers — evidence of a widening market rather than a handful of expanding accounts.
Customers across regulated industries
HiddenLayer signed more than 50 new platform customers over the period, spanning securities brokerage, banking, insurance, accounting, pharmaceuticals, airlines, automotive and government — plus contracts with the US Department of Defense and the intelligence community. The headline customer is an unnamed frontier model provider whose systems serve more than 700 million weekly users.
Why the government business matters
Defence and intelligence contracts are slow to win and slower to lose. For a young vendor, they function as both revenue and reference: if HiddenLayer’s controls satisfy the US intelligence community, a bank’s procurement committee has one less objection to raise.
Why Enterprises Are Rushing to Secure AI Deployments
The rush that gives the TechCrunch headline its verb is visible in the spending data. Gartner estimates that AI security spending reached $2.83 billion in 2026 — an 83 per cent increase on 2025, which implies organisations spent roughly $1.55 billion the year before. Gartner projects the figure will reach $4.78 billion by 2027, more than tripling the market in two years.
The visibility gap
The demand is not only about spend — it is about blindness. Research cited by HiddenLayer finds that 96 per cent of organisations now consider AI critical to their operations, yet nearly one third cannot confirm whether they have experienced an AI-related breach. Boards are approving AI deployments faster than security teams can build the monitoring to watch them.
From model theft to agent manipulation
The threat model has also broadened. Early AI attacks focused on stealing models or poisoning training data. Today’s incidents increasingly target the agentic layer: prompt injection that redirects an agent’s goals, manipulation of the tools an agent is allowed to call, and abuse of the trust chains between agents. Each new capability an enterprise switches on creates another path an attacker can walk — which is why penetration-style testing of AI systems, akin to classic penetration testing of networks, is becoming standard practice.
Regulators are catching up too
Compliance pressure compounds the technical pressure. The EU AI Act’s obligations are phasing in through 2026 and 2027, sector regulators in financial services are already asking how firms govern model behaviour, and security questionnaires from enterprise customers increasingly include AI-specific sections. An organisation that cannot evidence how its models and agents are monitored will feel that gap first in procurement and audit, long before it feels it in an actual breach. Tooling that produces that evidence automatically is an easier budget conversation than one framed purely around hypothetical attackers.
The AI Security Funding Landscape
HiddenLayer is not raising in a vacuum. Investor conviction — and consolidation pressure from the giants — is reshaping the whole category.
Rivals raising at pace
Competitors Noma and Zenity have each raised more than $100 million to date, closing large rounds within recent months. The venture market has effectively decided that AI security is a category worth building standalone companies around.
Incumbents buying their way in
At the same time, the largest cyber security vendors have chosen acquisition over organic build: Cisco, Palo Alto Networks and Check Point have all bought AI security startups. For buyers, that consolidation raises a familiar strategic question — best-of-breed specialist or integrated suite.
| Player | Route into AI security | Signal to the market |
|---|---|---|
| HiddenLayer | $100M Series B, standalone platform | Deep specialist bet, government-grade references |
| Noma | $100M+ raised to date | Investor appetite extends beyond one winner |
| Zenity | $100M+ raised to date | Agent-focused security drawing its own capital |
| Cisco / Palo Alto Networks / Check Point | Acquisitions of AI security startups | Incumbents buying capability rather than building it |
Why specialists keep winning deals
Sestito’s argument for independence is speed: the threat surface changes every time model providers ship a new capability, and a specialist that does nothing else can track that change faster than a platform vendor integrating an acquisition. The 10x revenue growth suggests enterprise buyers currently agree.
Funding announcements are marketing, but a balance sheet this size changes what a vendor can credibly promise its customers.
| Milestone | Year | What it established |
|---|---|---|
| Company launch | 2022 | Founding team shaped by a real adversarial attack at Cylance |
| $50M Series A | 2023 | Largest early-stage bet on AI security at the time |
| $100M Series B | 2026 | 10x revenue year, 50+ new customers, EMEA expansion mandate |
European expansion
For UK and European organisations the most practical consequence is proximity: HiddenLayer intends to grow its presence across Europe and EMEA, which usually translates into local sales engineering, regional data handling options and faster support in European time zones.
A roadmap centred on agents
The three declared investment fronts — agentic runtime security, autonomous coding agents, and the agentic layer above foundation models — tell customers exactly where the product is heading. Enterprises rolling out agent-based automation in 2026 and 2027 are the intended beneficiaries.
The durability question
A war chest also answers the quiet due-diligence question every buyer of young-vendor software asks: will this company still exist in five years? With roughly $150 million raised across its Series A and Series B plus earlier seed capital, HiddenLayer has runway measured in years, not quarters.
You do not need to be a HiddenLayer customer for this news to matter. The round is a leading indicator of where security budgets, auditor expectations and attacker attention are all heading.
AI deployments are now attack surface
If your organisation has deployed a chatbot, an internal copilot or an autonomous agent, you have added systems that traditional security tooling does not fully see. The visibility-gap statistic — nearly a third of organisations unable to confirm whether they have suffered an AI-related breach — describes mainstream businesses, not laggards. Reviewing that exposure belongs in the same conversation as your broader cybersecurity posture, from access control to incident response planning.
Questions worth asking this quarter
Ask which AI systems are running in production, who can prompt them, what tools your agents can invoke, and what would show up in logs if one were manipulated. HiddenLayer’s entire category exists because most organisations cannot yet answer those questions — and because attackers know it.
Start with an inventory, not a purchase
The cheapest first step costs nothing: list every AI system your organisation runs, from vendor copilots embedded in office software to internal chatbots and any automation that calls a model API. For each, note who owns it, what data it can reach and what actions it can take. Most organisations that do this exercise for the first time find systems nobody remembers approving — shadow AI adopted team by team. That inventory is the foundation any security control, insurance conversation or regulatory response will eventually be built on, and it turns the abstract headline risk into a concrete, manageable list.
The procurement takeaway
The market’s direction is clear: AI security is consolidating into a discipline with dedicated budgets, specialist vendors and government-grade reference customers. Whether you eventually buy from HiddenLayer, one of its rivals, or an incumbent suite, the time to scope the requirement is before your first agent-driven incident, not after it.
How much has HiddenLayer raised in total?
Adding the $100 million Series B to the $50 million Series A closed three years earlier and its seed capital, HiddenLayer has raised roughly $150 million-plus since launching in 2022. The company has not disclosed its valuation at either round.
Who invested in the HiddenLayer Series B?
Delta-v Capital led the round. Ten Eleven Ventures, Morgan Stanley, M12 (Microsoft’s venture fund) and Booz Allen Ventures participated. Several of these names are strategic rather than purely financial — M12 connects the company to the Microsoft ecosystem, while Booz Allen anchors its federal business.
What does HiddenLayer actually sell?
A software platform that protects AI models, agents and workflows: scanning model files for malicious code, detecting adversarial attacks at runtime, red-teaming deployed systems, and monitoring agent behaviour in production. It works without requiring access to the customer’s raw models or training data.
Is AI security really a separate product category?
Increasingly, yes. Gartner’s figures show spending nearly doubling in a year, dedicated vendors are raising nine-figure rounds, and the largest security incumbents are acquiring their way in. Whether specialists or suites win long-term, the budget line itself now exists in most large organisations.
What should smaller businesses take from this news?
That the threats being defended against are real enough to attract $100 million of diligence-backed capital. Even without an enterprise security budget, any business deploying AI can inventory its systems, restrict what tools its agents can touch, and put AI-related questions into its existing security review cycle.
References
HiddenLayer nabs $100M as enterprises rush to secure their AI deployments — TechCrunch
HiddenLayer Raises $100M Series B to Advance Trustworthy AI — PR Newswire
HiddenLayer — Security for AI
HiddenLayer raises $100M in Series B funding to enhance AI security — Crypto Briefing
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.