Aim Security

• Cato said it would fold Aim into its SASE platform and offered standalone Aim customers a migration path, so a buyer that wants the AI security module without Cato’s networking could see that option get less investment than the converged one.
• CTech names Prompt Security, now owned by SentinelOne, and Lasso Security among AI security companies in the same field, so a buyer comparing AI security products from larger vendors could choose one bundled with a platform it already runs.
• Much of the team’s public standing comes from Aim Labs disclosures such as EchoLeak and CurXecute, so less research output under Cato would weaken a signal buyers can see.

Aim Security sold protection for the AI an enterprise uses and builds, and Cato now sells that protection as Cato AI Security. The acquisition release describes one engine used to secure employee use of public AI tools such as Microsoft Copilot and coding agents such as Cursor, protect internal AI applications and agents with an AI firewall, and secure the agentic AI development lifecycle. Cato’s solution page names the buyer as security, AI governance, and risk leaders who need to let the business use AI while keeping control of data, access, and agent behavior.

Aim Labs’ own findings show the attacks the product targets are real. EchoLeak, which NIST’s vulnerability database records as AI command injection in Microsoft 365 Copilot, let an attacker pull data from Copilot without the user opening the malicious email or clicking a link, SecurityWeek reported. The Hacker News reported the CVSS score of 9.3, and SANS NewsBites summarized the finding for defenders. CurXecute, tracked as CVE-2025-54135, let untrusted data fetched through an MCP server redirect the agent in the Cursor code editor, The Hacker News reported.

Surveys show security leaders expect governance of AI use to matter more. CTech reported in February 2026 that 47.6% of executives in a Glilot Capital survey named governance and monitoring of organizational AI usage among the trends they expect to gain momentum, and TechTarget reported that 60% of CISOs in an Absolute Security survey said board pressure to adopt AI was outpacing their ability to govern and secure it. [s1, s11, s4, s18, s16, s17, s19, s21, s22, s23]

Cato AI Security covers employee AI use, homegrown AI applications, and AI agents from one engine and one console. Cato’s launch release says the module unifies governance and runtime protection across those use cases, and the knowledge base splits it into an end-user scope for external AI services and an applications scope for AI built into enterprise systems. Cato’s solution page lists enforcement for coding agents such as Claude Code, Cursor, and Codex on the endpoint.

Aim’s AI firewall protects the application side. Cato says it inspects prompts, responses, and agent actions at runtime, blocks or redacts noncompliant actions before impact, and detects jailbreaks, prompt injection, and off-policy responses. Customers deploy it through proxy interception, AI-gateway integrations, or APIs, or run it on premises or in their own cloud with AI Security Outposts, according to Cato’s pages.

The evidence for depth comes from Cato and from Aim Labs’ research. Cato describes combining vulnerability research with semantic encoders and AI classifiers to detect new attacks, and Aim Labs’ EchoLeak and CurXecute findings drew independent coverage. The cited sources contain no third-party evaluation of the firewall’s detection accuracy. [s5, s10, s4, s2, s16, s20]

Aim competed for enterprise AI security budgets during a wave of acquisitions in the category. CTech counted Aim’s sale as the fifth acquisition in an emerging field of AI security startups, part of a trend of buying young Israeli companies, noted that Prompt Security had sold to SentinelOne a month earlier, and named Lasso Security, Pillar, and Noma among companies still independent at the time.

Cato won the deal against other platform vendors. CTech, citing sources, reports that Akamai and Check Point also competed for Aim and that Cato prevailed with a higher offer. Shlomo Kramer, Cato’s chief executive, wrote that in large enterprises Aim had shown strong win rates and the ability to run AI security at scale.

Cato now positions the module as part of a converged platform. Its launch release says Cato AI Security runs as a standalone solution or alongside Cato’s SD-WAN, SSE, and Universal ZTNA capabilities, and its solution page lets a customer start with AI security and expand later on the same platform. Crane Worldwide Logistics’ cybersecurity head credits that design, saying AI security is built directly into the Cato SASE platform rather than added as another console. [s12, s8, s5, s4]

Aim named its customers, and Cato names customers of the product it built from Aim. Aim’s site listed customer stories for Life Extension, Cerebral, MIO Partners, and Finance of America, with Finance of America’s CISO and MIO Partners’ CISO quoted. In the acquisition release, Matan Getz said a large global financial services company had deployed Aim, without naming it.

Cato’s pages quote executives at Dayforce, MoonPay, Just Born, and PlayPower on Cato AI Security. Dayforce’s security head says the company put Cato AI Security in line with a customer-facing admin agent to mask sensitive data customers type into the chat. Cato’s March 2026 launch release quotes Crane Worldwide Logistics, and SiliconANGLE carried the same quote.

Aim and Cato publish all of these references. The 300 million dollars in annual recurring revenue Cato reported passing at the time of the acquisition covers the whole company, so it does not size the AI security line. [s6, s9, s1, s2, s3, s4, s5, s15]

Aim’s founders came from Israeli military intelligence, and its chief executive moved to Cato with the product. SecurityWeek reports that Matan Getz, the chief executive, and Adir Gruss, the chief technology officer, are alumni of the IDF’s Unit 8200, where they worked on AI systems. Cato’s March 2026 release quotes Getz as Cato’s vice president of AI security.

Aim Labs is Aim’s research team. SecurityWeek and The Hacker News covered its EchoLeak finding in Microsoft 365 Copilot, and The Hacker News and SecurityWeek covered CurXecute in the Cursor code editor, which Aim Labs discovered and named. Aim’s site also listed research on flaws in model supply-chain scanners.

Investors and timing add context. CTech reports that some founders of Wiz and executives from Google and Palo Alto Networks invested in Aim. Aim’s June 2024 Business Wire release announced an 18 million dollar Series A led by Canaan Partners, while SecurityWeek’s acquisition article dates that round to June 2025. Cato announced the acquisition in September 2025, about three years after Aim’s founding in 2022. [s11, s5, s16, s17, s20, s21, s6, s12, s9, s1]

Buyers assess Cato AI Security through Cato’s company-wide Trust Center. Cato’s Trust Center offers documents, certifications, and compliance details for security reviews, with badges including SOC 2 Type II, PCI, ISO 27001:2022, and ISO 27701, plus downloadable reports such as a SOC 2 Type II and HIPAA attestation report and a NIST SP 800-53 attestation report.

The Trust Center publishes those attestations under Cato’s name. The captured Trust Center page does not name the AI security module in its scope, so a buyer reviewing the module confirms with Cato which reports cover it.

Cato’s product pages add AI-specific governance features. Its end-user page says customers can map AI usage to guidelines and standards such as the EU AI Act, GDPR, NIST, and OWASP, which supports a buyer’s own compliance work. [s7, s3]

Add analyzed competitors to compare them side by side with Aim Security.

Aim Security sold to large enterprises securing their own AI adoption, and Cato sells the same capability to security, AI governance, and risk leaders. The acquisition release says Aim shaped how organizations including those in the Fortune 500 and Forbes Global 2000 harness AI, and Aim’s Series A release said its platform had customers across banking, insurance, healthcare, manufacturing, and defense.

The segmentation runs across AI surfaces rather than buyer sizes. Aim and then Cato covered employee use of public AI tools such as Microsoft Copilot, coding agents such as Cursor and Claude Code, homegrown AI applications and agents, and the AI development lifecycle. Cato’s solution page describes the module as especially relevant for organizations already seeing unsanctioned AI tools, developer agents, and MCP servers.

The acquisition added a second route to the buyer. Cato sells AI Security on its own or alongside its SD-WAN, SSE, and Universal ZTNA capabilities, so Cato can sell the module both to new buyers and to customers already running its platform for networking and security.

Cato AI Security runs three use cases on one engine, which Cato traces to the Aim acquisition. The launch release says Cato converged AI governance and protection capabilities from the acquisition into its platform, and SiliconANGLE reports that the module uses technology from Cato’s acquisition of Aim Security. The use cases are governing employee AI use, protecting homegrown applications, and enforcing guardrails for autonomous agents.

The application protection runs Aim’s AI firewall inline in an application’s AI traffic. Cato says the firewall inspects prompts, responses, and agent actions at runtime and blocks or redacts noncompliant actions before impact, detecting jailbreaks, prompt injection, and off-policy responses. It deploys through proxy interception, AI-gateway integrations, or APIs, and AI Security Outposts run it on premises or in a customer’s own cloud.

The detection draws on Aim Labs’ attack research. Cato describes combining vulnerability research with semantic encoders and AI classifiers to detect new attacks, and Aim Labs’ EchoLeak and CurXecute findings, covered by SecurityWeek and The Hacker News, are research on the prompt-injection and agent-hijacking attacks the firewall targets. The cited sources contain no third-party evaluation of the firewall’s detection accuracy.

Aim sold to enterprise security teams and named customers on its site. Aim’s customer stories covered Life Extension, Cerebral, MIO Partners, and Finance of America, whose CISO said Aim secures the breadth of its generative AI use. Matan Getz said in the acquisition release that a large global financial services company had deployed Aim.

Cato now sells the product under its own licenses. Cato’s knowledge base says the module needs an AI Security for Users or AI Security for Applications license and directs customers to a Cato representative or authorized reseller, and Cato’s pages quote executives at Dayforce, MoonPay, Just Born, and PlayPower as customers of Cato AI Security. Cato’s March 2026 launch release added Crane Worldwide Logistics.

Aim and Cato publish all of these customer references. CTech reports Cato paid an estimated 300 to 350 million dollars for a company of about 30 people that had raised 28 million dollars, while CyberScoop reports the terms were not disclosed.

Cato sells AI Security as licensed modules within its platform. The knowledge base names two licenses, AI Security for Users and AI Security for Applications, and directs customers to a Cato representative or authorized reseller for more information.

The licensing fits Cato’s modular model. The acquisition release says Cato supports gradual adoption of platform capabilities under a simple license across SD-WAN, SSE, ZTNA, and AI Security, so a customer can buy the AI security module on its own and add networking and security capabilities later.

Aim’s standalone product moved into this model when Cato folded it into the platform. Cato said at the acquisition that it would offer a seamless migration path to customers who had deployed the standalone Aim solution.

Customers configure Cato AI Security policies for the AI traffic it inspects. Cato’s solution page says prompts, responses, and tool calls are inspected in real time in the path, and that the module covers coding agents on the endpoint, AI apps in the browser, and applications through the Cato cloud, an existing AI gateway, or on-premises Outposts.

Running inline makes the module part of the AI application’s live traffic. Dayforce’s security head says the company put Cato AI Security in line with a customer-facing admin agent to mask sensitive data, and another Dayforce quote says the deployment still met the company’s service-level agreements.

Cato launched the module alongside new inspection hardware in its network. Its launch release says Neural Edge places NVIDIA GPUs across the more than 85 points of presence on Cato’s private backbone to accelerate real-time traffic inspection and policy enforcement.

Buyers review Cato AI Security through Cato’s company-wide Trust Center. The Trust Center offers documents, certifications, and compliance details for security reviews, with badges including SOC 2 Type II, PCI, ISO 27001:2022, and ISO 27701, and reports such as a SOC 2 Type II and HIPAA attestation report and a NIST SP 800-53 attestation report.

The Trust Center publishes those attestations under Cato’s name. The captured Trust Center page does not name the AI security module in its scope, so a buyer confirms with Cato which reports cover it.

Cato’s product pages add governance features that support a buyer’s own compliance work. The end-user page says customers can map AI usage to guidelines and standards such as the EU AI Act, GDPR, NIST, and OWASP.

Cato built its AI security offering around Aim’s engine and its own network platform. The solution page says one AI-native engine and one console cover three use cases, whether AI runs on the endpoint, in SaaS, or in applications the customer hosts, and the FAQ describes Cato AI Security as one of the converged solutions on the Cato SASE Platform.

The module covers AI tools from many vendors. The solution page lists enforcement for Claude Code, Cursor, and Codex, and the applications page lets customers deploy through an AI gateway they already run or APIs into model platforms and developer tools.

Cato offers the module as a starting point for its wider platform. Its FAQ says organizations can start with AI Security and later add Zero Trust Security, Universal ZTNA, or SASE Convergence without moving to a separate architecture.

Aim’s founders came from Israeli military intelligence, and Matan Getz now leads AI security at Cato. SecurityWeek reports that Matan Getz and Adir Gruss are alumni of the IDF’s Unit 8200, where they broke and built AI systems, and Cato’s March 2026 release quotes Getz as Cato’s vice president of AI security.

Aim Labs gave the team its public research record. Independent outlets covered two of its disclosures in 2025, EchoLeak in Microsoft 365 Copilot and CurXecute in the Cursor code editor, and Aim’s site listed further research on model supply-chain scanners.

The investor base and the funding dates come from different sources. CTech reports that some founders of Wiz and executives from Google and Palo Alto Networks invested in Aim. Aim’s June 2024 Business Wire release announced the 18 million dollar Series A, while SecurityWeek’s acquisition article dates the round to June 2025.