Aim Security

• As a line folded into Cato's SASE platform, the standalone Aim product and its roadmap could be deprioritized in favor of bundled network-security selling, eroding the depth that made the research notable.
• Model providers such as Microsoft and OpenAI could ship native protection for the assistants and agents built on their platforms, removing the third-party budget line the AI Firewall depends on.
• Same-asset rivals such as Lasso Security and Prompt Security contest the same buyer, and with the category consolidating into larger vendors, a procurement team could pick a bundled alternative on equal footing with Aim's single named reference.
• The research reputation rests heavily on Aim Labs and the EchoLeak disclosure, so reduced research output after the acquisition could weaken the company's main differentiator.
• The acquisition price was not officially disclosed and rests on a CTech estimate, so a buyer or employee cannot confirm from the public record how the exit rewarded the 28 million dollars raised.

Aim Security treats the enterprise rollout of AI as the asset under attack and sells a platform to secure it. The acquisition release frames three jobs on one engine: discovering and monitoring how employees use public AI tools such as Microsoft Copilot and Cursor, protecting a company's own AI applications and agents at runtime with an AI Firewall, and securing the AI development lifecycle with posture management. The buyer is the enterprise security team enabling AI use without losing control of its data.

Independent records corroborate the pain beyond vendor marketing. Aim Labs disclosed EchoLeak, a zero-click flaw in Microsoft 365 Copilot that NIST's National Vulnerability Database catalogs as CVE-2025-32711, where a single crafted email could make Copilot leak organizational data with no user click. The SANS NewsBites summarized the same finding for defenders, and The Hacker News reported Microsoft's own description of it as AI command injection rated critical, which shows the data-exposure risk Aim sells against is real rather than speculative.

The problem points at a structural weakness, not one product's bug. EchoLeak abused how an AI assistant mixes untrusted input with trusted internal data, the same trust-boundary failure that applies to any AI app or agent reaching into enterprise systems, which is the surface Aim's platform watches. [s1, s8, s9, s6]

The Aim platform runs three use cases on one core engine rather than a single point feature. The acquisition release describes shadow AI discovery across end-user AI interactions, an AI Firewall that enforces policy on traffic between users, agents, and internal AI applications at runtime, and AI Security Posture Management spanning the development lifecycle from training models to building custom agents. SecurityWeek, reporting independently, describes the same three use cases, which corroborates the scope beyond the vendor's own page.

The research output probes the mechanism the product defends. Aim Labs published EchoLeak and showed external untrusted input could manipulate Microsoft 365 Copilot's retrieval to exfiltrate data. Because that work targets the prompt-injection mechanism the AI Firewall is built to stop, it is in-domain validation, now independently cataloged by NIST and summarized by the SANS NewsBites, rather than a marketing claim.

A third-party product evaluation is still missing. No public benchmark, open-source code, or independent test of the AI Firewall's efficacy appears in the record, and after the acquisition the standalone Aim documentation was absorbed into Cato's platform site, so a buyer assessing depth today works from the acquisition release and press coverage more than a dedicated Aim docs portal. [s1, s4, s6, s8]

Aim competed in enterprise AI security against same-asset independents and the platforms now bundling the category. Lasso Security, Prompt Security, and Lakera contested the same buyer with runtime AI protection and employee-AI controls, and Noma Security covered adjacent discovery and governance. CTech describes a 2025 AI security arms race for technology and talent in which several of these independents were themselves acquired, putting overlapping capability inside larger suites.

Aim's visible differentiator was research depth. The EchoLeak disclosure gave a small company a public profile larger than its headcount, and that brand raised the cost for a rival to match Aim's standing, though it is a head start rather than a structural barrier. It positioned Aim as a credible independent while buyers were still learning which AI problems mattered.

The exit resolved the positioning in the platforms' favor. Cato, a network-security vendor that disclosed surpassing 300 million dollars in annual recurring revenue, bought Aim as its first acquisition and folded the product into its SASE platform. A company that warned enterprises about AI risk now ships as one capability of a network-security subscription, the bundling outcome independents in this category caution buyers about. [s10, s1, s5]

Research was Aim's clearest source of market visibility, and it pointed outward as much as at named accounts. The EchoLeak disclosure drew coverage across the security press and a SANS NewsBites summary, building inbound awareness and positioning Aim Labs as a serious research team. This is demand generation through a public finding that ran alongside the deployment evidence.

The named commercial proof is real but narrow. Finance of America is identified as a reference account, with its CISO Drew Robertson quoted that Aim secures the entire breadth of its GenAI use across public SaaS apps, enterprise chats, and internal developments. Beyond that one account, the company's claimed deployments across the Fortune 500 and Forbes Global 2000 appear without further named customers speaking publicly. The remaining signal is indirect and comes from CTech, which reports Cato paid an estimated 300 to 350 million dollars for a roughly 30-person team.

The motion ended in a sale rather than a scaled independent book of business. Aim raised 28 million dollars, emerged from stealth in January 2024, and was acquired in September 2025, a short arc across which the public record names one customer speaking publicly. [s7, s10, s1]

The founding team pairs Israeli intelligence pedigree with strong investor validation. Co-founders Matan Getz, the chief executive, and Adir Gruss, the chief technology officer, came from the IDF's Unit 8200, and CTech reports angel investment from some founders of Wiz and executives from Google and Palo Alto Networks. That participation is a credibility signal from people who have built and sold security companies.

The research record is the team's strongest public signal. Aim Labs published EchoLeak, an in-domain disclosure against a production AI assistant credited with a critical CVE, work that NIST cataloged and the security press covered widely. This is research in the company's own product category, which supports the team's standing, though one disclosure is a public signal rather than a sustained publication record.

The team's pace reinforces the signal. Dark Reading reported the 18 million dollar Series A closing within months of Aim leaving stealth, an unusually quick raise, though SecurityWeek dates the same round to June 2025. The founders sold the company within about three years of its 2022 founding. [s4, s6, s10]

Aim's trust posture now inherits Cato's, and Cato's is well documented. The Aim site redirects to Cato content and the product ships as Cato AI Security, so a buyer assesses assurance through Cato's public Trust Center rather than a standalone Aim page. The Trust Center presents named, downloadable attestations and a security questionnaire rather than a blank assurance page.

That program is company-level and substantial. The rendered Trust Center lists SOC 2 Type II, SOC 3, ISO 27001:2022, ISO 27017, ISO 27018, ISO 27701, PCI DSS, a NIST SP 800-53 attestation, HIPAA, TISAX, and GDPR. The open readiness item is whether these certificates explicitly scope the AI Security line rather than the network platform around it, a detail a careful security review would confirm in the Trust Center documents.

The research record adds to that assurance. The EchoLeak disclosure against a production AI assistant is public evidence the team understands the attacks the product defends, an in-domain signal a buyer can weigh alongside the inherited Cato attestations. [s11, s3, s6]

Add analyzed competitors to compare them side by side with Aim Security.

Aim Security sold to the enterprise security team standing up generative AI without losing control of its data. The acquisition release frames the buyer as organizations in the Fortune 500 and Forbes Global 2000 that want to harness AI with trust and control, and the three use cases name the surfaces that team owns: employee use of public AI tools, internal AI applications and agents, and the AI development lifecycle.

The public positioning targets large enterprises and exposes a demo-led contact path. No public pricing or free tier appears in the record, so a direct enterprise motion into the regulated upper enterprise is an inference from that positioning rather than a documented sales model, and the named-target language points at large organizations where AI data exposure carries direct liability.

The segmentation widened across surfaces rather than buyers. By spanning employee AI, private applications and agents, and posture management on one engine, Aim addressed any enterprise adopting AI regardless of which models it ran, which broadened reach but placed it against both AI-security independents and the network and endpoint platforms now shipping their own AI controls.

The Aim platform ran three use cases on one core engine rather than a single point feature. The acquisition release claims shadow AI discovery across end-user AI interactions, an AI Firewall that enforces policy on traffic between users, agents, and internal AI applications, and AI Security Posture Management covering the development lifecycle from training models to building custom agents, with the unified engine as the common layer. SecurityWeek describes the same three use cases independently.

The research output probed the exact mechanism the product defends. Aim Labs disclosed EchoLeak, a zero-click flaw in Microsoft 365 Copilot that NIST catalogs as CVE-2025-32711, where external untrusted input could manipulate Copilot's retrieval to exfiltrate data. Because that work targets the prompt-injection mechanism the AI Firewall is built to stop, it is in-domain validation, independently summarized by the SANS NewsBites, rather than offensive research about an unrelated product.

The cited record contains no third-party product evaluation. The capability now appears as Cato's AI Security for Applications, blocking runtime AI attacks as a standalone capability or inside the SASE platform, so a buyer evaluating depth today works from the acquisition release and the Cato platform page rather than an independent benchmark or a dedicated Aim docs portal.

Research was Aim Security's clearest source of market visibility, and it pointed outward more than at named accounts. The EchoLeak disclosure drew wide coverage and a SANS NewsBites summary and positioned Aim Labs as a serious research team, demand generation through a public finding rather than a roster of paid deployments. The named-customer evidence is thin: one named pre-acquisition Aim customer quote, a finance CISO at Finance of America in the Series A announcement, on securing the breadth of the firm's GenAI use.

The acquisition is strategic context, not standalone traction. CTech reports Cato paid an estimated 300 to 350 million dollars for a roughly 30-person team that had raised 28 million, and the acquisition release says Cato surpassed 300 million dollars in annual recurring revenue. Those figures speak to the buyer's capacity and to Aim's strategic relevance, not to a scaled book of Aim-line business, because the cited record carries one named pre-acquisition Aim customer quote and broad vendor claims about Fortune 500 and Forbes Global 2000 organizations. The Cato platform page now displays customer references from Dayforce and MoonPay, and the Dayforce quote names Cato AI Security, the post-acquisition product name, though the page dates neither reference.

The company sold after a short standalone period. Aim raised 28 million dollars in total, closing an 18 million dollar Series A whose date the cited sources report inconsistently, the June 2024 announcement giving 2024 and SecurityWeek June 2025, and the company emerged from stealth in January 2024 and was acquired in September 2025. The cited record discloses no Aim revenue.

Aim Security published no public price, consistent with a negotiated enterprise motion. No rate card, metering unit, or free tier appears in the record, and the entry point was a sales conversation aimed at large organizations, the shape of a vendor selling to the Fortune 500 buyer it named.

The buying unit is not publicly answerable from the record. Because the AI Firewall inspects traffic between users, agents, and AI applications inline, cost would plausibly track the volume of AI interactions screened, but that is inference rather than a published unit.

After the acquisition the commercial terms move into Cato's selling motion. The capability is offered standalone or as part of Cato's converged SASE platform, with a migration path for standalone deployments; the early-2026 platform plan is acquisition-era history rather than current status. Whether it carries a separate price is not stated in the cited record.

Aim Security was delivered as an inline control the enterprise routed its AI traffic through, configuring policy rather than running detection itself. The AI Firewall enforces corporate security and governance policies on all interactions between users, AI agents, and internal AI applications and models, whether on premises or in a cloud data center, so a security team chose where the enforcement sat.

The operational promise tracks a moving attack surface. The platform pairs shadow AI discovery across employee tools such as Microsoft Copilot and Cursor with runtime guardrails and posture scans, so the operational job is enforcement that follows new risks rather than a static rule set.

The inline path raises the heavier operational question. A firewall in the production AI request flow becomes a dependency whose latency and availability a careful buyer examines. A converged deployment inherits Cato's platform posture, which the captured page marketed as low-latency security processing, while a standalone buyer must still confirm the AI-security service's own latency and service-level terms, which the cited record does not scope to that line.

The Aim line now answers its trust questions through the parent's program. The Aim site redirects to Cato content and the product ships as Cato AI Security, so a buyer assesses assurance through Cato's public Trust Center rather than a standalone Aim page.

That Trust Center presents company-level assurance, and it is substantial. The rendered page lists SOC 2 Type II, SOC 3, ISO 27001:2022, ISO 27017, ISO 27018, ISO 27701, PCI DSS, a NIST SP 800-53 attestation, HIPAA, TISAX, and GDPR, and it exposes downloadable reports and a security questionnaire. A procurement reviewer finds named attestations rather than a blank page, but the page does not prove the certificates scope the AI Security line rather than the network platform around it, so confirming report scope is a step the buyer must take.

The research record adds to that assurance. The EchoLeak disclosure against a production AI assistant is public evidence the team understands the attacks the product defends, an in-domain signal a buyer can weigh alongside the inherited Cato attestations.

Aim Security was built to be the runtime control point an enterprise placed over the AI it adopted, spanning employee tools, private applications and agents, and the development lifecycle from one engine. That breadth across three surfaces on a unified engine was the platform claim, a single layer rather than a point tool.

Outward, the company reached buyers across several named assistants, agent frameworks, and model platforms rather than tying to one model vendor. By covering public assistants such as Microsoft Copilot, coding agents such as Cursor, and local agents using Model Context Protocol servers, Aim worked across multiple vendors' AI tools rather than tying to one model vendor.

Inward, that neutrality is what the acquisition puts in tension. The product now belongs to one network-platform vendor whose pitch is converging security into a single-vendor SASE subscription, so the acquisition sets the firewall's vendor-neutrality against Cato's single-vendor pitch, a fit a buyer committed to a different network platform would weigh.

The founding team pairs Israeli intelligence pedigree with strong investor validation. Co-founders Matan Getz, the chief executive, and Adir Gruss, the chief technology officer, are alumni of the IDF's Unit 8200, and CTech reports the company drew angel investment from some founders of Wiz and executives from Google and Palo Alto Networks.

The research record is the team's strongest public signal. Aim Labs published EchoLeak, an in-domain disclosure against a production AI assistant credited with CVE-2025-32711, which NIST cataloged, research in the company's own product category rather than a single unrelated finding. The cited record contains one Aim Labs disclosure, EchoLeak, rather than evidence of a sustained research record.

The funding record is harder to read than it first appears. The June 2024 Series A announcement, carried on Dark Reading as a Business Wire press release rather than as independent reporting, dates the 18 million dollar round to 2024, where SecurityWeek dates the same round to June 2025. The founders sold the company within about three years of its 2022 founding, backed by cybersecurity founders and industry executives.