Helmet Security

• The operators of AWS Bedrock and Azure APIM could fold MCP policy enforcement into the gateways Helmet pushes policy into, absorbing its enforcement layer.
• If named reference customers do not appear as the team scales from three to ten people, enterprise shortlists will favor rivals that already show logos.
• Rivals pursuing the same MCP lifecycle surface could replicate Helmet's features quickly, a risk its own couple-of-months AI-assisted build makes plausible.
• The SOC 2 Type II audit could slip past Summer 2026, leaving a vendor that sells audit evidence without its own completed attestation.
• The Agentic AI Foundation or Anthropic could build registry and policy controls into the MCP standard itself, shrinking the third-party governance market.

Enterprises are wiring AI agents into their software faster than security teams can see it, and Helmet Security sells the missing visibility and control. The Model Context Protocol, an open standard created by Anthropic, lets AI tools read data and take actions inside company systems. Helmet's pitch is that these connections multiply outside security's view, and its platform finds them, watches them, and polices them (s7, s8).

The pain is vendor-argued rather than independently measured. Kneip frames the problem as a practitioner's fear, not knowing what is running, and press coverage of the launch repeats that framing (s9). No analyst report, survey, or incident study in the reviewed sources quantifies how much unmonitored MCP traffic enterprises actually carry.

The buyer is clear even where the numbers are not. Helmet addresses the security chief who must approve agent deployments, and it courts the developers who build them with a promise of speed kept, an adoption argument Kneip makes explicitly (s9). [s7, s8, s9]

Helmet covers the lifecycle of an enterprise's agent connections in three phases. Discovery is agentless, reading signals from the EDR, identity, network, and SaaS tools a company already runs, with an optional endpoint agent for deeper coverage (s2). A verified registry imports MCP servers from GitHub or OpenAPI specs and scans them, including secret scanning and static and dynamic analysis, to catch drift and swapped behavior before it ships (s2). Enforcement runs through native agent hooks and an MCP gateway offered hosted, self-hosted, or pushed into AWS Bedrock and Azure APIM, with real-time blocking of prompt injection and data leakage and an audit trail mapped to SOC 2, ISO 27001, and the OWASP AI Top 10 (s1).

The depth of these claims rests entirely on the vendor's marketing pages. Helmet publishes no documentation portal, no demo, and no open code, its GitHub organization holds zero public repositories, and the product sits behind an early-access contact form (s1, s10). The company's own origin story is candid about the pace: the platform grew out of a scanner side project, and the CTO assembled it in a couple of months using AI tooling (s5, s9). [s1, s2, s5, s9, s10]

Helmet positions breadth against a field of narrower tools. Kneip acknowledges the AI-security market is saturated and argues most rivals cover one slice, permissions here, guardrails there, while Helmet spans discovery, vetting, and enforcement in one platform (s9, s5). Its investor makes the adoption-cost argument: an immediate, installation-free view into where MCP is operating, because discovery rides tools the customer already owns (s8).

The same design choices mark the absorption risk. Discovery depends on other vendors' security products for its signals, and enforcement can run inside AWS Bedrock and Azure APIM, gateways whose operators could ship MCP governance as a native feature (s1, s2). Helmet is a late-2025 entrant differentiating on claimed lifecycle breadth in a market its own founder describes as saturated (s9). [s9, s5, s8, s1, s2]

Traction is early, real by the founder's account, and entirely unnamed. At the December 2025 stealth exit Kneip reported about 10 customers with 30 more onboarding, a mix of commercial firms and government agencies, and declined to name any (s9). The product is sold through an early-access contact form with no published pricing (s1).

The distribution levers are relationships rather than channels. Helmet's investors, SYN Ventures and WhiteRabbit Ventures, connect the company to prospective customers, and its Agentic AI Foundation membership places it inside the Linux Foundation body that stewards the protocols it secures (s9, s6). The funding round exists partly to build the go-to-market: the raise expands the team from 3 to 10 people, with customer management among the early hires (s9). [s9, s1, s6, s7]

The team's credibility concentrates in one verifiable record. CEO Fred Kneip founded CyberGRX, raised 100 million dollars for it, and sold it to Marlin Equity Partners / ProcessUnity, a prior build and exit in the cyber-risk market Helmet now sells governance into (s7). The vendor's own pages describe him as a former CISO and GRC founder (s4).

CTO Kaushik Shanadi is the product's creator, and his background is self-described rather than independently documented. The founder story presents him as a security engineer with startup and enterprise experience who built Helmet from a side project (s4, s5). The company runs deliberately small, three people expanding to ten, with AI tooling standing in for early hires (s9). [s7, s4, s5, s9]

Helmet holds no completed security attestation. Its security page states a SOC 2 Type II audit is scheduled for Summer 2026 and a Vanta-powered trust center is coming, and a probe on July 3, 2026 found no trust or security subdomain and no attestation badges in the site footer (s3). The page describes standard practices, encryption in transit and at rest, role-based access with SSO and multi-factor authentication, code review and dependency scanning, and a responsible-disclosure contact (s3).

The gap is sharper for this vendor than for most young companies. Helmet sells audit-ready evidence of agent activity mapped to SOC 2 and ISO 27001 while its own audit is months away (s1, s3). Enterprise and government buyers, the mix Kneip says Helmet already serves, typically ask for the vendor's own report early in procurement (s9). [s3, s1, s9]

Add analyzed competitors to compare them side by side with Helmet Security.

Helmet sells to the enterprise security organization, with the developer as the constituency it must not slow down. Kneip names the security practitioner's fear, not knowing what is running, as the problem, and frames the product as a way to give developers guardrails without taking away speed (s9, s7). The reported customer base is a mix of commercial firms and government agencies, which suggests a segment defined by agent adoption rather than by industry (s9).

The segment is early by construction. Buyers must already run AI agents over MCP connections at enough scale to need discovery and policy, a population that began forming only after the protocol spread through enterprises. Helmet's bet is that this population grows into a standard budget line before incumbents claim it.

Helmet's differentiating claim is lifecycle breadth, not a smarter model. The platform spans discovery of agents and MCP servers through signals from EDR, identity, network, and SaaS tools, a verified registry that imports and scans server code, and runtime enforcement through agent hooks and a gateway (s2, s1). The founder story is explicit that breadth is the thesis: Shanadi began with a scanner and decided to manage the whole lifecycle instead (s5).

The claims lack an external validation point. Helmet publishes no documentation portal or demo, its GitHub organization holds zero public repositories, and no third-party technical evaluation of the product appears in the reviewed sources (s10). The engineering is also, by the company's own account, quick to produce: the platform came together in a couple of months of AI-assisted work (s9). What a buyer can verify today is the vendor's description, not the depth beneath it.

Helmet sells founder-led and relationship-driven. Kneip fronts the company's public selling, the product sits behind an early-access contact form, and the investors, SYN Ventures and WhiteRabbit Ventures, open doors to prospective customers (s9, s1). That motion matches the stage: at the December 2025 raise, about 10 customers with 30 more onboarding, all unnamed, and a hiring plan that adds customer management next (s9).

The proof gap is the missing named reference. A mix of commercial and government customers is a claim a buyer cannot check, and in a category where rivals already name enterprise logos, the anonymous roster is what a shortlist would probe. The Agentic AI Foundation membership adds standards-body visibility rather than customer proof (s6).

Helmet publishes no pricing. Access runs through a contact form for early access, the pattern of negotiated, sales-led deals, and no pricing unit, seat, server, or traffic volume, appears anywhere in the reviewed sources (s1).

The unpriced posture fits a product still finding its packaging. With deployment options spanning a managed cloud, self-hosted proxies, and policy pushed into AWS Bedrock and Azure APIM, the value metric could reasonably attach to servers governed, actions enforced, or seats, and the company has published nothing that commits it to any of them (s2).

Delivery flexes across three models. Buyers can take the gateway as a managed service in Helmet Cloud, run it themselves in their own VPC or as a local endpoint proxy so data never leaves their environment, or push policy into gateways they already operate, AWS Bedrock and Azure APIM among them (s2). Discovery is agentless, riding the customer's existing security stack, with an optional endpoint agent for deeper coverage (s2).

Operations are deliberately thin. Three people run the company, AI tooling substitutes for early hires in engineering and back-office work, and the funding round exists partly to grow the team to ten (s9). That leanness keeps burn low, and it also means enterprise and government customers are being served by a very small operations bench.

Helmet's own trust posture trails what it sells. The product promises audit-ready evidence mapped to SOC 2, ISO 27001, and the OWASP AI Top 10, while the company's security page states its SOC 2 Type II audit is scheduled for Summer 2026 and its Vanta trust center is still being built (s1, s3). A probe on July 3, 2026 found no trust or security subdomain and no attestation badges in the site footer, so no completed attestation was found in the public record as of that date (s3).

The interim posture is described practices plus disclosure. The security page commits to encryption in transit and at rest, role-based access with SSO and multi-factor authentication, code review and dependency scanning, and a responsible-disclosure contact at a security mailbox (s3). For the government-inclusive customer mix Kneip describes, the completed report will matter earlier than for most seed-stage vendors (s9).

Helmet positions itself inside other vendors' surfaces rather than beside them. Discovery consumes signals from EDR, identity, network, and SaaS products the customer already owns, enforcement can live inside AWS Bedrock and Azure APIM, and findings export to the customer's SIEM (s2, s1). The investor pitch makes this the differentiator: an installation-free view of MCP activity (s8).

The company also bought a seat in the standards body. Helmet joined the Agentic AI Foundation, the Linux Foundation home that stewards MCP and related agent protocols, as a Silver Member in March 2026 (s6). The dependency cuts both ways: the platforms Helmet embeds into, and the foundation governing the protocol it polices, could each absorb parts of its role.

The team is two founders with one verifiable track record between them. Fred Kneip founded CyberGRX, raised 100 million dollars, and sold it to Marlin Equity Partners / ProcessUnity, and Helmet's pages describe him as a former CISO and GRC founder (s7, s4). Kaushik Shanadi, the CTO, created the product, and his security-engineering background is self-described rather than independently documented (s4, s5).

Beyond the founders, the bench is aspiration. The company is three people expanding to ten, positions itself as a team of security engineers and GRC experts, and relies on AI tooling in place of early hires (s9, s4).