AI Security Is Becoming a Runtime Business

AI security used to sound like a market waiting for a problem. Three years ago, HiddenLayer raised its Series A while buyers were still asking whether attacks against machine-learning systems would appear often enough to justify a dedicated category. The Austin company has now raised a $100 million Series B, and the product has expanded far beyond protecting a model file. The new perimeter includes autonomous agents, coding tools, external connections, runtime behavior, and the software supply chain forming around all of them.

HiddenLayer announced the round on September 2. Delta-v Capital led it, with participation from Ten Eleven Ventures, Morgan Stanley, Microsoft's M12, Booz Allen Ventures, and other investors. The company says the capital will deepen its enterprise platform, expand agent runtime and harness security, support research and engineering, grow sales and distribution, and push into Europe and the wider EMEA region. TechCrunch independently reported the financing and interviewed co-founder and CEO Chris Sestito about the company's growth and product direction.

The operating claims are significant and should remain attributed. HiddenLayer says annual recurring revenue grew more than tenfold over the past year and that it signed more than fifty new platform customers. Sestito told TechCrunch that revenue is now in the tens of millions of dollars, though he declined to provide an exact figure, and said more than 90 percent of the growth came from new customers. The company also says it serves a frontier model provider reaching more than 700 million weekly users but does not name that customer.

Those numbers indicate traction, not proof of category dominance. A tenfold increase can start from a small base. Revenue in the tens of millions covers a wide range. An unnamed customer cannot be independently evaluated. Still, the pattern is hard to ignore because the buyers HiddenLayer identifies sit in sectors that punish weak controls: financial services, large technology companies, pharmaceuticals, government, defense, and intelligence. These organizations do not eliminate risk by purchasing a security product, but they create real budget when a new system crosses from experiment into operations.

The product shift explains where that budget is moving. HiddenLayer began with discovery, model scanning, attack simulation, supply-chain security, and runtime protection for predictive and generative systems. It now says those controls extend to prompt injection, agent manipulation, malicious tool use, autonomous coding agents, and the harnesses that connect models to enterprise systems. This is not a cosmetic expansion. A model that only returns text has a limited blast radius. An agent that can modify code, query internal systems, call external services, or approve a workflow creates a different security problem.

The dangerous layer is not intelligence alone. It is delegated authority. An agent receives instructions, collects context, chooses tools, passes data across boundaries, and takes actions under an identity. Every transition can be manipulated or misconfigured. A poisoned document can alter the instruction path. A malicious tool can misrepresent its behavior. An overprivileged credential can turn a minor prompt failure into an operational incident. A compromised model package can enter the stack before runtime even begins. Security has to follow the entire chain.

HiddenLayer frames runtime defense as an AI-specific counterpart to endpoint detection and response. The analogy is useful because endpoint products watch processes while they execute instead of trusting that software is safe because it passed an earlier scan. AI runtime security aims to observe prompts, model behavior, tool calls, data movement, and agent actions while the system is operating. The analogy also has limits. Model behavior is probabilistic, context changes every request, and a legitimate action can become dangerous because of the sequence around it.

That makes policy design harder than matching a known malware signature. A coding agent may be allowed to edit a repository, run tests, and open a pull request. Those actions are normal in one scope and unacceptable in another. A research agent may need external data but should never send internal records to an untrusted service. A customer-support agent may issue refunds within a limit but should not alter account ownership. Runtime security must understand identity, intent, context, sequence, and business rules without blocking every useful workflow into oblivion.

False positives therefore become an economic problem. If a security layer interrupts safe agent actions too often, users route around it or disable automation. If it misses manipulated actions, the product fails at the moment it matters. HiddenLayer's public announcement describes visibility and prevention capabilities but does not publish a complete set of independent detection rates, false-positive measurements, latency costs, or production benchmarks. Buyers should demand results on their own workflows because a benchmark built from generic attacks may not resemble the tools and permissions inside their environment.

Supply-chain security is another major piece. Sestito told TechCrunch that HiddenLayer parses and scans about fifty AI file frameworks, particularly for open models, to detect cases where an artifact is not what it claims to be or contains hidden models. That task is becoming more important as organizations download weights, adapters, datasets, agent skills, plug-ins, and tool servers from many sources. A checksum can establish that a file did not change after publication. It cannot establish that the original artifact was safe, appropriate, or honestly described.

The stronger workflow needs provenance, inspection, policy, and containment. Teams need to know where an artifact came from, who approved it, what it contains, which permissions it receives, and what happens when it behaves unexpectedly. A model package should not inherit production access because it performed well in a notebook. An agent tool should not be trusted because its documentation sounds polished. Every component needs a route from discovery to evaluation to controlled deployment, with records that make the decision auditable later.

Agent harness security pushes the product closer to the application control plane. A harness determines how a model receives context, which tools it can call, how memory is stored, what approvals are required, and how failures are handled. HiddenLayer says its new Agent Harness Security extends runtime protection to autonomous coding agents that can write, review, and ship code with less human oversight. That is a high-value surface because the harness contains the operational permissions that turn model output into a software change.

It is also a crowded surface. Cloud providers, model companies, code platforms, identity vendors, and traditional security firms can all add policy checks, monitoring, and scanning to products customers already use. TechCrunch notes that large security companies frequently acquire capabilities they do not build and that startups including Noma and Zenity have raised substantial capital in adjacent parts of the market. Sestito acknowledged that some AI-security features may eventually be bundled into platforms from Microsoft, OpenAI, AWS, and others.

That bundling risk defines HiddenLayer's strategic test. A standalone vendor wins if it sees across providers and catches problems each platform cannot or will not detect inside its own boundary. Enterprises rarely use one model, one cloud, one agent framework, or one code tool. A neutral security layer can map behavior across the whole environment, apply common policy, and provide evidence that does not depend on a vendor grading itself. Cross-platform visibility is valuable only if the integrations stay current and the signal is strong enough to justify another control plane.

The moat cannot be a dashboard that lists AI applications. Discovery will become a standard feature. The deeper advantage would come from an expanding corpus of attack behavior, model artifacts, tool patterns, policy outcomes, and production failures that improves detection across customers without exposing their sensitive data. HiddenLayer says its researchers hold 39 granted patents and 65 pending patents and have contributed to initiatives involving CISA, MITRE, NIST, OWASP, and OpenSSF. Those affiliations and patents indicate investment in the field. They do not guarantee product superiority.

The funding itself creates room and pressure. One hundred million dollars can support the integrations, research, enterprise sales, and international operations required for a security platform. It also raises the growth expectations attached to the business. HiddenLayer says part of the money will focus on distribution while engineering and research continue. That makes sense because security products do not spread through technical merit alone. They need trust, procurement approval, channel relationships, compliance evidence, and people who can support deployment when the customer's architecture is a mess.

Market forecasts should be treated with the same discipline as vendor benchmarks. TechCrunch cites Gartner estimates that spending on AI-security products will reach $2.83 billion this year, 83 percent above 2025, and approach $4.78 billion next year. Those figures describe a forecast, not booked market revenue. They still capture the direction. AI systems are gaining identities, permissions, memory, external tools, and responsibility. Each new capability expands the number of ways the system can be manipulated, misused, or simply configured badly.

The most useful question for buyers is not whether they need AI security. It is where existing controls stop working. Traditional application security still matters. Identity and access management still matters. Data-loss prevention, code review, endpoint security, network monitoring, and software supply-chain controls do not become obsolete because a model entered the workflow. A dedicated AI layer earns its budget when it detects model-specific behavior, understands agent context, or enforces tool-level policy that those systems cannot express.

HiddenLayer now has enough capital to prove that distinction at scale. The evidence to watch is concrete: independent detection testing, measured false-positive rates, latency overhead, customer retention, expansion within accounts, cross-platform coverage, and incidents prevented without breaking legitimate work. Revenue growth suggests enterprises are paying attention. It does not tell us whether the product becomes enduring infrastructure or a feature that larger platforms absorb.

The category has moved past the hypothetical stage because agents are moving past the chat window. Once software can act, security has to inspect the action path while it is happening. HiddenLayer's round is not proof that one startup owns that future. It is proof that the control layer around models, tools, and permissions has become valuable enough for serious buyers and serious capital. The company that wins will be the one that can secure that chain without reducing autonomy to an expensive system that asks a human to approve everything anyway.

LaunchPad positionThe new security perimeter is the chain between a model, its context, its tools, and the actions it can take. Vendors can build valuable controls there, but the independent category survives only if those controls remain better than the features cloud and model platforms will bundle into their own stacks.