Aiceberg

• Cranium could withdraw the Aiceberg listing from AWS Marketplace and sell the screening capability only inside its own platform, leaving no separately purchasable product.
• Platform and model vendors could ship equivalent runtime screening natively, shrinking the standalone market the capability sells into.
• The Aiceberg documentation portal could stay frozen at its April 2026 release, leaving buyers who evaluate the marketplace listing reading material that no longer matches the product.
• Buyers that require a vendor attestation could rule the product out until the acquirer's compliance program covers it.
• ETR reports a shift toward vendor consolidation, so a screening capability sold as a standalone line could lose budget to a platform that already holds the account.

Aiceberg sold to enterprises and public-sector organizations putting generative and agentic AI into production. SecurityWeek describes a platform built to help governments and enterprises adopt AI safely, securely and compliantly, and the analyst database IT-Harvest states the same mission. SecurityWeek names prompt injection, prompt leaking and jailbreaking as the vectors it detects, and IT-Harvest names jailbreaks, prompt injection and unsanctioned model use.

An independent survey now puts numbers on that pain. ETR's 2026 State of Security report, drawn from 517 security leaders, finds 36% of respondents naming the prevention of sensitive data entering AI prompts as their hardest data-protection problem, twice the rate of the next concern, and it names shadow AI outside sanctioned tools as their top perceived data-exposure risk. Both name problems the reviewed sources say the product addresses, sensitive data in prompts and unsanctioned model use.

What the record does not carry is a measurement of that pain inside Aiceberg's own segment. The survey measures the category, and the buyer description in the reviewed sources stays broad. [s8, s10, s14, s7]

Aiceberg screens prompts, model responses and agent actions in real time. Its documentation sets out five analytical layers named context, information, content, instruction and alignment. The information layer extracts named entities to identify personal, health and payment data, and the instruction layer classifies jailbreaking and prompt injection.

Detection runs on non-generative models rather than on a large language model. IT-Harvest records the company emphasizing non-generative models for risk detection rather than relying on large language models to protect large language models, and SiliconANGLE describes the same design as delivering traceable oversight.

The trace view is where that argument becomes checkable. The documentation shows the samples used to classify an input, the labels attached to them, and the relevance the model assigned each one, and it ranks those samples by the weight the model gave them. No third-party technical evaluation, inspectable code, or customer technical writeup appears in the reviewed sources, so only vendor-authored material supports the accuracy claims. [s4, s5, s6, s9, s10, s17]

Aiceberg competed in the runtime AI guardrail category. IT-Harvest assigns the product to a guardrail category inside an AI security segment, and independent press describes it as an AI firewall and gateway that monitors user prompts and model responses for risk signals.

IT-Harvest names explainability and auditability as what the company emphasized. It frames the choice as using non-generative models for risk detection instead of relying on large language models to protect large language models.

Aiceberg's run as an independent company ended with the acquisition. Cranium AI announced the acquisition on May 21, 2026 and described a combined platform covering the AI lifecycle from development through autonomous agents. Cranium's own Observe page now describes deterministic classifiers, and it says every verdict can justify itself by showing the samples, labels and relevance scores behind each decision, which is the design Aiceberg argued for. [s10, s9, s11, s16]

Public traction evidence is thin and indirect. AWS Marketplace lists the product as software-as-a-service sold by Aiceberg, with a free trial and 12-month contracts from $60,000 for customers using up to a billion tokens a year to $680,000 for up to 80 billion, plus a usage charge for tokens beyond the contract. No named customer, case study or partnership appears in the reviewed sources.

The sale is the last dated commercial event in the record. Cranium AI acquired the company in May 2026, fourteen months after the March 2025 platform launch on a seed round SecurityWeek reported at $10 million from SYN Ventures and Sprout & Oak. The SEC Form D signed on February 19, 2025 records an equity offering of $7,522,240, fully sold to three investors. Neither the acquisition announcement nor its press coverage gives a purchase price, so the record does not show what the traction was worth. [s7, s8, s11, s13, s12]

Alex Schlager ran Aiceberg as its chief executive and signed its SEC Form D. Verizon's own site records him as its executive director of security services, which is the one role outside Aiceberg and Cranium that the reviewed sources document for him. Cranium named him chief technology officer of the combined company and said he would oversee the technical roadmap and the merging of the two technology stacks.

Cranium also said every Aiceberg employee would move across, crediting expertise in AI security, data science, engineering and go-to-market. The reviewed sources document no prior exit and no sustained publication record for the team, so the public evidence stays at verifiable senior experience. [s13, s19, s11, s12, s18]

No compliance attestation for the Aiceberg product appears in the reviewed sources, so a buyer that requires one finds nothing published to check. The acquirer's trust center asks a visitor to request access, so a product-level answer is not on the public web.

What the product offers instead is traceable decisions. Its documentation shows the samples and relevance scores behind each classification, which a security reviewer can inspect, and that is a property of the software rather than an audit of the company. The reviewed sources do not settle which compliance program now covers the product, and the marketplace listing still names Aiceberg as the seller. [s20, s6, s7]

Add analyzed competitors to compare them side by side with Aiceberg.

Aiceberg aimed at enterprises and public-sector organizations. IT-Harvest states the mission as enabling those organizations to deploy generative and agentic AI safely, transparently and compliantly, and the product's traceable decisions are built for that requirement.

The marketplace price list encodes how the company sorted its buyers. Twelve-month contracts scale by annual token volume, from a starter package for customers using up to a billion tokens a year at $60,000 up to $680,000 for organizations with advanced adoption running up to 80 billion. That sorts buyers by how much AI traffic they run.

The reviewed sources name no customer in any of those tiers. So the record shows who the company aimed at rather than who bought.

The core capability is real-time classification of AI traffic. Aiceberg's documentation sets out five analytical layers named context, information, content, instruction and alignment. The information layer extracts named entities to identify personal, health and payment data, the instruction layer classifies jailbreaking and prompt injection, and the alignment layer checks that an agent's actions match the instructions it was given.

The AI advantage is a deliberate refusal to use a large language model in the detection path. IT-Harvest records the company emphasizing non-generative models for risk detection rather than relying on large language models to protect large language models, and SiliconANGLE describes the same design as delivering traceable oversight through explainable models.

The explainability claim is checkable in the documentation, and no independent source tests it. The documentation shows the samples used to classify an input, the labels attached to them, and the weight the model gave each one. No third-party technical evaluation, inspectable code, or customer technical writeup appears in the reviewed sources, so only vendor-authored material supports the accuracy claims.

One public path to purchase ran through cloud procurement. AWS Marketplace lists the product as software-as-a-service sold by Aiceberg, with a free trial and published 12-month contract prices, so a buyer can evaluate and transact inside an existing AWS relationship.

How far that motion converted is not publicly measurable. No named customer, reseller or partnership appears in the reviewed sources, so a prospective buyer has no public reference to check. The acquisition settled the question a different way. Cranium said every Aiceberg employee would transition, crediting expertise in AI security, data science, engineering and go-to-market.

Aiceberg published a price list. The AWS Marketplace listing carries 12-month contract tiers keyed to annual token consumption, running from $60,000 for customers using up to a billion tokens a year to $680,000 for those using up to 80 billion, with a separate charge for tokens beyond the contract.

The unit says what the vendor believed buyers pay for, which is screened AI traffic. Billing by token volume ties the invoice to the volume of prompts and responses the product inspects. A buyer whose AI usage grows therefore pays more without renegotiating what the product does.

Delivery is software-as-a-service with two operating modes. In enforce mode Aiceberg sits between the customer's AI tool and its model, evaluating every request against the profile's signal settings and blocking, modifying or allowing it. In listen mode the same traffic is copied to Aiceberg for classification while the model call proceeds untouched, which gives a record and a recommended action without an inline dependency.

Inline screening makes availability part of the product promise. An application in enforce mode calls the Aiceberg interface before its own model sees the prompt, so every prompt the application sends waits for Aiceberg to answer. The reviewed documentation does not say what happens to that prompt when Aiceberg is unavailable, so a buyer would have to ask how the product fails. The documented way in is narrow. A customer submits prompts and responses through an interface, and alerts leave through a single SIEM connection at a time.

No compliance attestation for the Aiceberg product appears in the reviewed sources, so a buyer that requires one finds nothing published to check. The acquirer's trust center asks a visitor to request access, so a product-level answer is not on the public web.

What the product offers instead is a traceable decision. Its documentation shows the samples and weights behind each classification, which a security reviewer can inspect and an auditor can follow, and that is a property of the software rather than an audit of the company that ships it. The reviewed sources do not settle which compliance program now covers the product, and the marketplace listing still names Aiceberg as the seller.

Aiceberg positioned itself as a screening layer that sits beside whatever AI stack a customer runs. Its listing in the Cloud Security Alliance startup registry describes coverage of deployments on GPT, Claude and Llama and of applications built with frameworks such as CrewAI and LangChain, and its documentation adds a SIEM connection so alerts land in the customer's existing monitoring.

Aiceberg's independence as a standalone vendor ended with the acquisition. Cranium describes a combined platform covering the AI lifecycle from development through autonomous agents, and its Observe page now describes deterministic classifiers that show the samples, labels and relevance scores behind each decision. The Aiceberg documentation portal is still online and its release notes run from June 2025 to April 2026, with no entry after the acquisition month, so a buyer reading it sees the product as it stood before the deal.

Alex Schlager ran Aiceberg as its chief executive and signed the company's SEC Form D in that title. Verizon's own site records him as its executive director of security services, which is the one role outside Aiceberg and Cranium that the reviewed sources document for him. Cranium named him chief technology officer of the combined company and said he would oversee the technical roadmap and the merging of the two technology stacks.

The team was the visible part of the purchase. Cranium said every Aiceberg employee would transition, crediting expertise in AI security, data science, engineering and go-to-market. The reviewed sources document no prior exit and no sustained publication record for that team, so the public evidence stays at verifiable senior experience rather than a track record buyers would recognize.