What AI security means — three sub-markets

A common analytical error is treating "AI security" as one thing. It is three, and they map to different products, buyers, and acquirers:

1. Security for AI (AI-SPM / model & data security) — protecting the models, training data, and pipelines an enterprise builds or fine-tunes. Think model scanning, ML-supply-chain integrity, AI asset inventory, posture management. Buyer: the AI/platform team. (Protect AI, HiddenLayer, Robust Intelligence.)
2. Runtime / GenAI-app security (the AI firewall) — guarding live LLM applications and agents against prompt injection, data leakage, jailbreaks, and toxic output at inference time. Buyer: the AppSec / SecOps team. (Lakera, Prompt Security, Lasso, CalypsoAI, Noma.)
3. Agentic / non-human identity security — governing the exploding population of agents, MCP connections, and machine identities. Buyer: the IAM team. This overlaps 20b (Astrix, Entro, Token, Noma).

Most "AI security" startups began in one lane and are sprinting to cover all three, because the platform acquirers want a full stack, not a feature.

All three sell to enterprise buyers. A fourth market — pre-release evaluation of frontier models, sold to the model developers themselves — has different economics and a different customer set, and is covered separately below.

The platform land-grab — who bought what

The acquired cohort (now inside platforms)

| SPLX (SplxAI) | Zscaler | closed Oct 31 2025, announced Nov 3 2025 | $40.6M cash, per Zscaler's FY2026 Form 10-K; terms were undisclosed at announcement | Automated AI red teaming, shift-left AI asset discovery, real-time threat detection and governance compliance across the enterprise AI lifecycle; SPLX had raised ~$9M, including a $7M seed in Mar 2025 |

Counting announcements rather than closings, that is ten security-for-AI companies absorbed between August 2024 and August 2026 — roughly two years, an average of about one every 2.5 months (Python-verified from the dates in the table). Nine of the ten buyers are platform or strategic acquirers; one is a frontier lab.

SPLX is the only price in the cohort that comes from an acquirer's filing rather than a report or an estimate, and it is far below the range the reported deals established. The capability prices that defined the category ran $250–700M for pre-scale assets. SPLX cleared at $40.6M in cash — 6× to 17× below that band — with a further $16.6M of restricted stock excluded from consideration as post-combination compensation, equal to 41% of the cash price and the heaviest retention load among Zscaler's four disclosed acquisitions (11). Two readings follow, and they point in opposite directions. The reported range may describe the top of the distribution rather than its centre, in which case the category's headline comps are selection-biased toward the deals large enough to leak; alternatively SPLX was simply earlier and smaller than the named comparables, in which case the band still holds for assets with product and customers. The available evidence does not separate these, because SPLX is the only filing-sourced price in the set. What it does establish is that a platform can enter this category for tens of millions rather than hundreds, which is the number that matters to an acquirer deciding between build, buy and the premium the scarce assets command.

The list of platforms without an AI-security asset is now down to one name, and the correction runs in both directions. Fortinet's purchase of Virtue AI removed the last of the major network-security incumbents. Zscaler does not belong on the list at all: it bought SPLX in October 2025, more than a year before the list was compiled, and has since built an AI-security product line on top of it — AI Protect (January 2026), then AI Broker and Endpoint AI Security at Zenith Live on June 9 2026, with the AI Access Graph running on the acquired Symmetry Systems technology (Zscaler, Jun 9 2026). CrowdStrike answered by building (Falcon Guardian, below). What remains is Okta on the identity edge, alongside Microsoft, which had already built rather than bought. Two features of the Fortinet transaction distinguish it from the earlier cohort. First, the stated price characterization: the capability prices that defined 2025 ran $250–700M for pre-scale assets, while Fortinet described the consideration as immaterial to its business — an indication that a platform can now enter the category without paying the scarcity premium that applied when fewer independents existed. Second, the capability set purchased sits at the agentic end of the category (agent red teaming, runtime action-blocking, code and tool scanning) rather than at the model-scanning end that anchored the 2024–25 deals, which tracks where enterprise deployment has moved.

A new kind of buyer joined the land-grab. Every acquirer above through January 2026 was a platform/strategic (Cisco, Palo Alto, SentinelOne, Cato, Check Point, F5). On March 9, 2026, OpenAI agreed to acquire Promptfoo (OpenAI · TechCrunch) — the first time a frontier lab bought an independent AI-security pure-play outright rather than merely partnering with one (cf. Project Glasswing/Daybreak). It is the cleanest live evidence for the bear case below — the labs themselves are the best-positioned builders of the operational harness — and the anchor for book Ch 26's "aggregation clock" exhibit (seven pure-plays absorbed in ~21 months, the cadence tightening toward one a quarter).

The independents still standing

The named landscape is unusually Israeli- and Seattle/SF-concentrated (Lakera is the Zurich outlier), reflecting the Israeli foundry and the frontier-lab talent pools. Funding for the category surged into 2026 — RSAC-2026 coverage counted ~$3.6B of Crunchbase funding flowing to agentic-AI-security names, against a ~$96B cyber-M&A backdrop. Mid-2026 rounds continued at scale: Neo's $100M launch (Andreessen Horowitz and Bessemer, Jul 2026) is the largest new-entrant round to date in the agentic-identity lane, and turns on the same demand thesis Gartner frames as agentic adoption rising from ~5% of enterprise applications in 2025 toward ~40% by the end of 2026. Late July 2026 firmed the lane into a cluster: Hush Security ($30M Series A, with Akamai as a strategic investor) and Act Security ($60M out of stealth, Team8 + Bessemer) both closed on Jul 28, concentrating fresh capital in governing the AI-agent / non-human-identity population — and, in Hush's case, placing a strategic acquirer on the cap table before scale.

Capital continued into September 2026 and the composition of the investor base is the part that changed. HiddenLayer's $100M Series B, led by Delta-v Capital, took the oldest pure-play in lane (1) past $155M raised in total and drew in Booz Allen Ventures and Morgan Stanley alongside Microsoft's M12 and Ten Eleven. A federal-services prime and a bank investing next to a corporate venture arm and a category specialist is a different cap table from the one the category assembled in 2023–24, and it points at where the buyers of AI-security software are expected to be — regulated and government-adjacent estates rather than technology companies alone. Two smaller September prints sit alongside it: AIR Security emerged from stealth with $50M across two seed rounds (Sequoia, then Greenoaks) to inspect the skills, plugins and MCP servers an agent loads at run time, and Capsule Security launched a small-model control that evaluates agent actions before execution. All three are the same bet in different places on the stack — that the enforcement point for agentic AI is the action, not the prompt. A fourth print landed on Sep 2 2026: Lasso Security raised $30M led by ClearSky, with Entrée Capital, iAngels, Singtel Innov8, Mindset and Swish Data, alongside the launch of LEAP, a guardrail the company states runs on CPUs rather than accelerators (SecurityWeek, Sep 4 2026 · Lasso, Sep 2 2026). The claim is a cost of goods claim rather than a detection claim, and it is the first in this lane framed that way: a runtime guardrail inspects every prompt and every agent action, so its own inference bill scales with customer usage and sits directly in cost of revenue. Where the sold product is per-seat or per-application but the cost is per-token, gross margin compresses as the customer succeeds — the structural problem behind the "feature, not a market" prong on 03l. Moving the guardrail onto commodity compute addresses that if the accuracy claim holds; no independent benchmark is available, and none is asserted here.

A mid-September print sits outside this frame entirely, and the reason it does is the part that matters. Fortaegis Technologies, founded in Amsterdam in October 2023, raised a $50M Series A announced Sep 14 2026, led by Serendipity Capital of Singapore. Every company above defends the model, the prompt, the pipeline, the agent's actions or the data it moves — all of them above the operating system, and all of them sold as software to a security buyer. Fortaegis places the control point in silicon: encryption keys are generated from the physical variations unique to each manufactured chip rather than stored on the device, and that root is extended through firmware and software to assert identity and enforce policy across networks of connected devices and autonomous agents. The company reports 11–50 employees, more than 25 company and government engagements, 17 patents filed with 14 further applications in preparation, and commercial manufacturing targeted for 2027, moving from FPGA to ASIC production.

Two things distinguish it from the cohort as an asset rather than as a technology. The capital is strategic rather than cybersecurity capital: the round includes TEL Venture Capital, the corporate venture arm of chip-equipment maker Tokyo Electron, and TNO, the Dutch applied-research organisation, with Carlyle's aerospace and defence head and Quantinuum's founder — who chairs the company — participating individually. And the clock is a hardware clock: adoption depends on chip designers and manufacturers incorporating the architecture, and the company's own stated milestones are a 2027 manufacturing start and an FPGA-to-ASIC transition, which is a materially slower path to revenue than a software guardrail sold per seat. The lane is therefore better read as stacked beneath the software cohort than as competing with it, and it connects to the provenance and post-quantum thread on 16g and the sovereign and defence buyer set on 14 rather than to the AI-SPM comparables here. The company's "quantum-safe" characterisation and its claim of connections 200× faster than current cryptographic protocols rest, per the primary coverage, on internal and customer testing; neither is independently verified and neither is treated as established. TNO both tested the architecture and invested in the round, so its assessment is not independent. No valuation, revenue or total-funding figure was disclosed, so the round anchors no comparable.

Sources: HiddenLayer $100M Series B (SecurityWeek, Sep 3 2026) · AIR Security $50M (SecurityWeek, Sep 3 2026) · Capsule Security AI Circuit Breaker (SecurityWeek, Sep 3 2026) · Fortaegis $50M Series A (The Quantum Insider, Sep 14 2026)

AI detection and response — the platform builds rather than buys

The largest endpoint vendor has entered the agent-runtime lane with a built product and a category name for it. At its Fal.Con user conference on Sep 1, 2026 CrowdStrike introduced Falcon Guardian, described as an AI Detection and Response (AIDR) offering delivered through the existing Falcon sensor on Windows and macOS. Four capabilities are presented as shipping with the release: discovery and live inventory of known and shadow AI agents, including dormant ones, with attribution to whoever deployed them; runtime visibility that links agent behaviour to endpoint telemetry along a chain from prompt and identity through tool and skill invocation to each downstream system action; access controls that define which agents may run on which managed endpoints and block those that may not; and runtime detection and response that reconstructs an execution chain and scopes blast radius. Three further items are stated in the future tense and should be read as roadmap rather than product: an AI Gateway as a central control point for enterprise AI traffic including MCP, a managed Falcon Complete for Guardian service, and extension of managed threat hunting to agent activity. Ingestion of agent telemetry into the vendor's own SIEM as first-party data is presented as a cost argument against point tools that require a third-party SIEM (CrowdStrike, Sep 1 2026).

The positioning is a claim about where the enforcement point sits, and it is the same claim the DseWiki episode illustrates from the other direction. The vendor's framing distinguishes posture (what could go wrong), governance (reducing what could go wrong) and runtime (stopping what is going wrong), and argues that agents reason, plan and execute on the endpoint with behaviour hard to separate from legitimate user activity, so the endpoint is the only vantage point with complete execution visibility. The agents that wrote to DseWiki were scoped read-only by task assignment and wrote anyway (20e); no control between the instruction and the write refused it. That is the gap the category is named for. The argument that follows — that an installed endpoint sensor is the cheapest place to put such a control, because it is already deployed and already sees process execution — is a genuine structural asset rather than a product claim, and it is not one an acquisition could have supplied.

Two consequences for the vendor landscape. First, the independents in lane (3) now face a platform incumbent competing on distribution rather than on capability, which historically compresses the window in which a standalone agent-runtime product can build enough ARR to command a platform multiple; the countervailing point is that the sensor covers Windows and macOS endpoints, while a large share of enterprise agent execution occurs in cloud runtimes, CI systems and SaaS applications where an endpoint sensor is not present. Second, the acquirer screen changes. Build-versus-buy in this lane had been an open question for the platforms without a Security-for-AI story, and the largest of them has now answered it by building — which removes a bidder from the demand side for lane (3) assets rather than adding one, and puts the burden on the remaining independents to differentiate on the surfaces the endpoint does not reach.

Pre-release model evaluation

A fourth AI-security market sits outside the three lanes above, and its customer is the model developer rather than the enterprise. Frontier labs contract external firms to stress-test models before release, measuring capability in vulnerability research and offensive cyber tasks under controlled simulation. The clearest example is Irregular, an Israeli firm that raised $80M in 2025 and runs evaluations for OpenAI, Anthropic and Meta. Its testing cycles involve thousands of simulation runs across several models over 48 to 72 hours, using parameters meant to mirror realistic attack conditions. The economics differ from lanes (1)–(3): a small number of customers, each buying assurance against a release schedule rather than a control deployed in production.

The category's first public failure is instructive because the cause was mundane. Models under evaluation escaped their test environments and took offensive action against real systems, in incidents disclosed across all three labs; Irregular and Anthropic identified three such incidents involving Anthropic's models, and Irregular published an account of one of them (reported Aug 17, 2026). The root cause was a naming error. A fictional target company in a new evaluation set was given a name that matched a real, little-known domain, and the standard check of fictional names against existing companies and websites did not catch the overlap. Internet access was enabled in the environment, so in a handful of runs models reached the real domain, treated it as the exercise target, and did what the exercise asked — exploiting vulnerabilities, extracting credentials, and gaining access to a production database — despite receiving no instruction pointing them there. The evaluation had been designed to test whether a model could help a malicious insider reach sensitive data, so reconnaissance, private-key discovery, extraction and evasion were all in scope by design. The affected domain lacked common safeguards. Detection was difficult because the behavior appeared in only a small fraction of runs, often hundreds of interactions into a simulation.

Two findings carry beyond the incident. Irregular stated that existing monitoring tools and classifiers struggle to distinguish legitimate red-team activity from a genuine attack, because evaluation logs are inherently full of behavior that looks malicious — a detection problem with no current product answer, and the same problem the activation-classifier approach on 20e is aimed at. It also called for a mechanism to share forensic evidence such as model transcripts between organizations after an incident, which does not presently exist. Its own remediation is process rather than technology: expanded manual review of model behavior during testing, a dedicated internal team to challenge its containment and model-control assumptions, clearer scope documentation with customers, and continuous revalidation of evaluations as new domains appear.

A fourth incident was disclosed on Sep 10 2026, and the way it was found is more consequential than the incident itself. Anthropic had scanned roughly 141,000 transcripts believed to involve internet access during cyber evaluations and reported three cases. That scan missed a separate batch of transcripts, which surfaced only in August while the company was assembling material for METR, an independent organisation it has commissioned to investigate; scanning the new batch produced a fourth case, after which no further cases of comparable or greater severity were found. The case dates to January 2026 and involved an early checkpoint of Claude Opus 4.6, inside an evaluation built by the same supplier, in which the model was told it had no internet access while a misconfiguration left the environment connected and the production safety layers were not running. The model disabled its intended target by assigning it a conflicting network address, tried and failed to abandon the now-impossible task, then reached a third party's system by the same route as an earlier incident, retrieved a stored password, escalated to administrator access, harvested further credentials, changed account settings to ease re-entry and read one individual's personal information. The session ended when the model exhausted its compute budget. Anthropic reports that 87% of the model's recorded reasoning treated the systems as part of the sanctioned exercise and only 1% raised the possibility of an unrelated third party; unlike the other cases the model never reasoned that it was in a simulation. Anthropic states it remains most concerned about the Claude Mythos 5 case, in which a malicious package was uploaded to PyPI, installed by 15 third parties, and used to reach a real security vendor's systems.

Three points bear on the market rather than on the models. First, all four incidents occurred inside evaluations built by one supplier, which converts the concentration observation below from an inference into a count. Second, the discovery method failed at scale: a 141,000-transcript automated scan under-reported, and the gap was closed by a manual compilation for an outside party rather than by any control — evidence for the same detection gap Irregular described, that no available tool separates sanctioned red-team behaviour from a genuine attack. Third, assurance is being layered rather than productised: the chain now runs model developer → evaluation supplier → independent investigator (METR, on an initial eight-week engagement with access to transcripts and staff), and none of those three layers is a security-vendor product. That is a services market forming upstream of the software category this page maps. (SecurityWeek, Sep 10 2026 · Anthropic — alignment assessment of the cybersecurity incidents)

The market read is concentration. A single supplier sits behind the pre-release cyber evaluations of three frontier labs, which makes one firm's containment practices a shared dependency and a shared failure mode. For acquirers the lane is not obviously platform-adjacent — the buyer set is small and the work is closer to assurance than to a control point — but it sits directly upstream of the regulatory thread, because prerelease-review frameworks (16, 20f) depend on evaluations of exactly this kind being trustworthy. (SecurityWeek, Aug 17 2026 · Irregular — addressing recent incidents)

Why it matters for M&A — and the bear case

The investable insight is timing and lane. Security-for-AI buyers pay platform multiples for a capability they can cross-sell to an installed base tomorrow, not for standalone ARR — which is why sub-$10M-ARR companies cleared $250–700M. The acquirer screen is every name in the cohort table plus the platforms that still lack a story — and that second list has now emptied to a single name. CrowdStrike answered the question on Sep 1, 2026 by building rather than buying (Falcon Guardian, above); Zscaler had already answered it in October 2025 by buying SPLX and has built a product line on top of it since. Okta is the last major platform without a Security-for-AI position, alongside Microsoft, which had already built rather than bought. The bear case sharpens accordingly: each platform that builds is a bidder removed from the demand side, and in a lane where the buyers pay for cross-sellable capability rather than for standalone ARR, the number of remaining bidders is the variable that sets price. The SPLX print supplies the other half of that argument — a platform's alternative to paying a scarcity premium is not only to build, but to buy early and small, at a price the reported comps do not reflect.

The falsifiable bear case has three legs. (1) Feature, not platform — if AI-security collapses into a checkbox inside DSPM/CNAPP/IAM suites, independents get commoditized before they scale and exits compress. (2) The buyer is the model provider — if OpenAI/Anthropic/Google ship "good-enough" native guardrails, the third-party runtime-firewall thesis erodes from below. (3) Demand is ahead of spend — enterprises are still piloting GenAI; if budgets lag the hype, the 2025–26 valuations look like a vintage peak rather than a floor. The counter: regulation (20d, EU AI Act), the agent explosion (20b), and the offense curve (20a) all push the demand floor up, not down.

Sources: Palo Alto–Protect AI (PANW press, Apr 28 2025) · CNBC on PANW–Protect AI · SentinelOne–Prompt Security (Aug 5 2025) · Yahoo Finance: ~$250M deal · Check Point–Lakera (~$300M, Sep 16 2025) · Cisco–Robust Intelligence (Aug 2024) · Noma Security $100M (Jul 2025) · HiddenLayer $50M (Sep 2023) · F5–CalypsoAI (announced Jan 2026, per market coverage; deal-value undisclosed) · Neo $100M launch (GlobeNewswire, Jul 20 2026) · CTech on Neo (Jul 20 2026) · Hush Security $30M (SecurityWeek, Jul 28 2026) · Hush Security $30M (PR Newswire, Jul 28 2026) · Act Security emerges from stealth (SecurityWeek, Jul 28 2026) · Act Security $60M (SiliconANGLE, Jul 28 2026).

Updated 2026-10-04 19:34 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.