Anjuna Security

• AWS, Microsoft or Google could extend its own confidential-computing tooling to cover the unchanged-application case Anjuna sells, removing the reason to buy a separate runtime on that cloud.
• Anjuna could reach three years without a disclosed round, having last raised a $25 million Series B extension in August 2024, leaving it to fund three product lines on capital raised before two of them reached market.
• The three top 10 banks Anjuna counts could stay unnamed, leaving its largest traction claim something a prospect cannot check.
• Anjuna Overwatch could remain in the early-feedback phase it entered in June 2026, leaving the agent-governance line without a generally available product.
• Anjuna could go another year without publishing a SOC 2 report or an ISO 27001 certificate, leaving its own control evidence outside the public record while it sells to banks and a defense customer.

Anjuna sells to organizations that want sensitive work to run on infrastructure they do not own. Its answer is confidential computing, which Anjuna's own explainer describes as hardware-rooted trusted execution environments that isolate code, data and secrets at runtime, so that neither the host operating system, the hypervisor, nor a cloud provider's administrators can inspect what runs inside.

By August 2024 the obstacle Forbes described was software rather than hardware availability. Intel, Microsoft and ARM had already embedded these zones in their CPUs and GPUs, and the software each of them built to expose the feature was often not compatible with the others. Fast Company described the same fragmentation nine months earlier and framed Anjuna's answer as virtualizing those processors within a single software stack, so an application need not be recoded for each server platform and cloud.

The urgency stays qualitative. No source in the reviewed record puts a number on what exposure during processing costs a bank or a defense agency, so a buyer decides on confidentiality and compliance arguments rather than on a measured loss. [s1, s11, s12, s2]

Anjuna Seaglass is the platform that carries the rest of the portfolio. Anjuna says it turns a container application into what it calls a Confidential Container, an enclave-ready hardened image that deploys with one command across AWS, Azure, Google Cloud and on-premises hardware. The Anjuna Policy Manager then releases secrets and configuration to that image only after hardware-based attestation succeeds.

Anjuna's own AWS manual states what the product removes more plainly than its marketing does. An AWS Nitro Enclave gives an application a single socket to another virtual machine instance rather than an internet-connected network interface. Developers must therefore design a protocol to pass data in and out of the enclave and update their applications to use it. The manual calls that a significant engineering effort and says it can even be impossible for closed-source applications. The Anjuna Nitro Runtime runs the application inside the enclave without those changes.

Two products build on that base. Anjuna Northstar, generally available since December 2024, is a clean room where several parties merge data and AI models and no party sees another's raw inputs. Anjuna Overwatch, announced in June 2026, runs and is attested inside an enclave, and it sees every LLM message and tool call an agent makes. It validates the tool calls and data requests against a policy manifest, and it holds the agent's API keys and tokens so the agent never carries them itself.

Anjuna documents the platform in detail: five documentation sets covering AWS Nitro, AMD SEV, Kubernetes on SEV, Intel SGX and the Policy Manager, with the Nitro manual carrying its own command-line reference. What the reviewed record does not contain is an outside assessment of it. No source code implementing the runtime appears there, and neither does a third-party technical evaluation. [s2, s15, s16, s3, s4, s23, s1, s8]

CB Insights lists nine top competitors for Anjuna. Its named comparisons include Opaque, Cysec, Repello AI, Phala, Enveil, Edgeless Systems and Fortanix.

Anjuna's own suppliers pose the harder competitive question. Microsoft's own documentation describes Anjuna as software that lets you run applications on Azure confidential computing instances powered by AMD SEV-SNP or Intel SGX processors. That is an accurate description of a supplier relationship, and of an exposure: the party selling the enclave can also sell the tooling around it. Anjuna's chief executive stated the boundary himself, telling Forbes the company did not invent confidential computing and is there to make it extremely easy.

Sameness across clouds is what Anjuna offers against that. Anjuna documents one operational model across AWS, Azure and Google Cloud, with attestation-gated secret release on each, which is what a buyer gives up by taking a single provider's native tooling instead. [s22, s13, s11, s1, s2]

Anjuna's largest traction claims arrive as counts. A June 2025 announcement says a new top five bank brought its total to three of the world's top 10 banks, that it also serves five payment companies and the U.S. Navy, and that the headcount of its customers now exceeds one million. It names none of the banks, and its two bank case studies are titled for an international bank and a global bank.

The named references are narrower than the counts imply. Parfin, a digital-asset custody firm, appears with its co-founder quoted about protecting distributed key shares inside secure enclaves. The U.S. Navy appears in a case study and in the August 2024 funding announcement, which describes it testing Llama 3 models on confidential NVIDIA H100 GPUs through NVIDIA LaunchPad. JUMO and Ascendo AI arrived in December 2024 as Northstar design partners, with the announcement describing JUMO using Northstar in its credit-risk workflow.

Outside corroboration is old and general. Fast Company wrote in November 2023 that the approach had helped Anjuna find customers in banking, defense and blockchain, and nothing more recent in the reviewed record confirms traction from a source other than Anjuna.

Anjuna publishes partner pages for AWS Nitro Enclaves and for Microsoft Azure confidential computing, and Microsoft's own partner page routes buyers to an Azure Marketplace SaaS offering and a managed application. The free trial is not self-service: a prospect submits a form and Anjuna responds within two business days with access, and the page asks for comfort working from the shell and with Docker containers. [s7, s17, s1, s6, s23, s12, s18, s13]

The founders' backgrounds are the most independently corroborated asset in the record. Forbes reports that Ayal Yogev served in Israel's Unit 8200, studied electrical engineering and computer science at Tel Aviv University, took an MBA at Berkeley, and founded Anjuna in 2018 with Yan Michalevsky while Michalevsky was finishing a doctorate at Stanford. Fast Company separately describes the company as founded by Unit 8200 veterans.

The commercial record behind that is in the same domain Anjuna now sells into. Anjuna's team page records that Yogev led the Umbrella product management team at OpenDNS, which Cisco acquired in 2015 for $635 million, was part of Imperva's 2011 IPO, and was most recently VP of product management at SafeBreach. Mark Bower headed product and business strategy for Voltage Security, acquired by HPE, and the Atalla hardware-security-module business there. Steve Van Lare was VP of engineering at Automation Anywhere and at the fraud-detection company 41st Parameter.

The board and advisors add recognized cryptography and national-security experience. Anjuna's team page carries Stanford cryptographer Dan Boneh, who heads the university's applied cryptography group, and the August 2024 funding announcement records that SineWave's Patricia Muoio, a former senior executive at the National Security Agency, joined the board. [s11, s12, s5, s6]

No security attestation of Anjuna's own appears in the reviewed public record. No SOC 2 report, ISO 27001 certificate, FedRAMP authorization or third-party trust portal appears on the probed surfaces or anywhere in the sources reviewed.

A bank or a defense customer that wants Anjuna's own control evidence will not find it in the reviewed sources.

The compliance language Anjuna does publish belongs to the product rather than to the company. Anjuna Overwatch maps agent actions to frameworks such as NIST 800-53 and PCI DSS for reporting to security teams, which serves a customer's compliance posture and says nothing about Anjuna's own.

The adversarial record is quiet. The National Vulnerability Database returns no CVE naming Anjuna, and no breach, enforcement action or critical technical write-up about the company appears in the reviewed sources. [s21, s20, s4, s7]

Add analyzed competitors to compare them side by side with Anjuna Security.

Anjuna sells to organizations whose sensitive work has to run on infrastructure they do not control, and the published examples include financial services, government, healthcare, SaaS and blockchain. The August 2024 funding announcement puts it plainly: Anjuna works with enterprises in financial services, government and blockchain.

Financial services is where the record is thickest. A June 2025 announcement claims three of the world's top 10 banks, five payment companies and a combined customer headcount above one million. The public evidence for government adoption is concentrated in the single U.S. Navy reference.

The segmentation shifted with the products. Seaglass addresses an infrastructure team moving existing applications. Northstar addresses data scientists and AI operations teams who need several parties to pool data. Overwatch addresses a security team that has to govern autonomous agents. Those are three different technical audiences for one platform.

Anjuna says Seaglass turns a container application into an enclave-ready hardened image and deploys it with one command across AWS, Azure, Google Cloud, on-premises hardware and Kubernetes. The Anjuna Policy Manager then releases secrets to that image only after hardware-based attestation succeeds. The vendor's own claim for the result is a 90 percent reduction in time to success on container applications.

What the platform is doing is best read from Anjuna's AWS manual rather than its marketing. An AWS Nitro Enclave gives an application a single socket to another virtual machine instance rather than an internet-connected network interface. Developers must therefore design a protocol to pass data in and out and update their applications to use it. The manual calls that a significant engineering effort and says it can even be impossible for closed-source applications. The Anjuna Nitro Runtime removes that work by running the application inside the enclave unchanged. Microsoft's own partner documentation describes the same relationship on Azure: Anjuna runs applications on Azure confidential computing instances powered by AMD SEV-SNP or Intel SGX processors.

The two AI products build on that runtime. Anjuna Northstar, generally available since December 2024, creates clean rooms where several parties merge datasets and AI models, work with them in ordinary Jupyter notebooks, and see only their own inputs. Anjuna Overwatch, announced in June 2026, runs attested inside an enclave and sees every model message and tool call an agent makes. It validates the tool calls and data requests against a policy manifest that covers MCP server access. It brokers the agent's API keys and tokens so the agent never holds them, and it redacts personal data and secrets before they reach models, logs or memory stores.

Anjuna documents the platform in detail. It publishes five documentation sets, covering AWS Nitro, AMD SEV, Kubernetes on SEV, Intel SGX and the Policy Manager, and its AWS Nitro manual documents the architecture and includes a command-line reference. No source code implementing the runtime appears in the reviewed sources, and no third-party technical evaluation of it does either, so every quantitative performance claim traces back to Anjuna itself. Microsoft's partner page, SecurityWeek and Fast Company all describe the software from outside, but none of them is a technical evaluation of it.

The motion is enterprise sales with a gated trial at the front. The free-trial page offers all Seaglass features for 30 days, but a prospect submits a form and Anjuna answers within two business days with access, and the page asks for comfort working from the shell. That is approval-gated rather than self-service, and the same page asks for comfort working with Docker containers, so the trial is aimed at a platform engineer rather than at a casual evaluator.

Anjuna's published partnerships are with the companies that supply the hardware it runs on. Anjuna publishes partner pages for AWS Nitro Enclaves and for Microsoft Azure confidential computing, Microsoft's own partner page routes buyers to an Azure Marketplace listing, and the NVIDIA relationship is the one with a named outcome behind it: the U.S. Navy tested Llama 3 models on confidential NVIDIA H100 GPUs using Seaglass through NVIDIA LaunchPad.

Proof arrives mostly as counts Anjuna states itself. Three of the world's top 10 banks, five payment companies, a customer headcount above one million, and bookings and customer base more than doubling year over year in the 2024 announcement are all first-party. The named references are Parfin, quoted on protecting distributed key shares, and the U.S. Navy. JUMO and Ascendo AI arrived as Northstar design partners, with the December 2024 announcement describing JUMO using Northstar in its credit-risk workflow. Fast Company's 2023 note that the approach had found customers in banking, defense and blockchain is the outside corroboration on the record, and nothing more recent joins it.

Nothing in the reviewed sources states a list rate, a packaging tier or a charging unit for any of the three products. On Anjuna's own site a prospect can request a demo, contact sales or apply for the gated 30-day trial, and Microsoft's partner page adds two more routes, an Azure Marketplace SaaS offering and a managed application.

The trial is scoped to one cloud platform the prospect picks from AWS with Nitro Enclaves, Azure with AMD SEV or Google Cloud with AMD SEV. Anjuna's documentation includes a licensing step for the Nitro runtime, and the reviewed sources say nothing about how a production license is counted or enforced.

Two consequences follow for a buyer. No rate appears in the reviewed sources, so a prospect cannot size a deal from the reviewed sources. And the vendor's published economics claim, that customers saw a 12 percent reduction in security spending, is a return argument rather than a price, so it cannot be checked against a rate card.

The customer runs the deployment Anjuna documents. Seaglass builds an enclave-ready image from the customer's own container, deploys it with one command into the customer's cloud account or data center, and runs there. The Policy Manager releases secrets to it only once hardware-based attestation succeeds. Microsoft's partner page also routes buyers to an Azure Marketplace SaaS offering and a managed application, and the reviewed record does not say who operates those.

That places the operational burden on the buyer's platform team, and Anjuna's documentation reflects it: documentation sets for AWS Nitro, AMD SEV, Kubernetes on SEV and Intel SGX, Kubernetes pod specifications, performance and resource guidelines, a troubleshooting guide and a command reference. The trial page asks for exactly the skills those manuals assume.

Portability is the operational selling point. One operational model across AWS, Azure, Google Cloud and on-premises, and the ability to run Overwatch from cloud to air-gapped environments, means a platform team learns the tooling once rather than once per provider.

No security attestation of Anjuna's own appears in the reviewed public record. No SOC 2 report, ISO 27001 certificate, FedRAMP authorization or third-party trust portal appears on the probed surfaces or anywhere in the sources reviewed, which is a gap against the buyers the company names.

The compliance material Anjuna does publish belongs to the product. Overwatch maps agent actions to frameworks such as NIST 800-53 and PCI DSS and reports them to security teams. Anjuna's NVIDIA partner page says the joint solution lets enterprises validate the integrity and trustworthiness of large language models through remote attestation, simplifying regulatory compliance. Both serve a customer's obligations. Neither is a statement about Anjuna's own controls.

The product's assurance is cryptographic. Attestation is the mechanism: the Policy Manager releases secrets to a workload only after hardware-based proof that the expected code is running in a genuine enclave. That answers nothing about how Anjuna runs its own business.

The adversarial record is quiet. The National Vulnerability Database returns no CVE naming Anjuna, and no breach, enforcement action or critical technical write-up about the company appears in the reviewed sources.

Anjuna is building a platform in the literal sense: Seaglass is the base, and both Northstar and Overwatch run on it. Overwatch is attested inside a trusted execution environment powered by Seaglass, and Northstar is described as powered by Seaglass, so all three products build on one engineering effort.

Its ecosystem position is dependent by construction. The enclaves come from Intel, AMD and the cloud providers, and Anjuna's own partner pages cover those same suppliers plus NVIDIA, whose Blackwell and Hopper GPUs it pairs with Seaglass for confidential AI. The enclave technology comes from those suppliers. Microsoft documents its own confidential-computing instances and routes buyers to a marketplace listing, so Anjuna's contribution is sameness across clouds.

The agentic-AI line is the newest bet on the platform. Anjuna's solution page divides the work explicitly, with Seaglass providing hardware-rooted identity, runtime attestation and encrypted execution for agents and MCP servers, Northstar governing MCP access and isolating shared data, and Overwatch supervising behavior at runtime. Overwatch entered an early-feedback phase in June 2026, and the reviewed record names no production customer for it.

The founding story is corroborated from outside. Forbes reports that Ayal Yogev served in Israel's Unit 8200, studied electrical engineering and computer science at Tel Aviv University, took an MBA at Berkeley, and founded Anjuna in 2018 with Yan Michalevsky while Michalevsky was completing a doctorate at Stanford. Fast Company separately describes the company as founded by Unit 8200 veterans.

The executive record is in the domain Anjuna sells into. Yogev led the Umbrella product management team at OpenDNS, which Cisco acquired in 2015 for $635 million, was part of Imperva's 2011 IPO, and was VP of product management at SafeBreach. Mark Bower headed product and business strategy for Voltage Security, acquired by HPE, and the Atalla hardware-security-module business there, and most recently led product management for Amazon's Payment Cryptography business. Steve Van Lare was VP of engineering at Automation Anywhere and at the fraud-detection company 41st Parameter.

The advisory roster carries recognized academic cryptography. Anjuna's team page carries Stanford cryptographer Dan Boneh, who heads the university's applied cryptography group, and Chia-Che Tsai, the main developer of the Graphene library operating system for isolating Linux applications on Intel SGX. The August 2024 announcement records that SineWave's Patricia Muoio, formerly a senior executive at the National Security Agency, joined the board alongside M Ventures' Ilja Aizenberg.