HiddenLayer

• Palo Alto Networks and Check Point could fold model scanning and runtime AI defense into enterprise platform agreements, undercutting standalone purchases of the HiddenLayer platform.
• Microsoft, an investor through M12, could ship native equivalents across Azure AI services and absorb the commercial segment before HiddenLayer builds named-reference proof.
• SHIELD obligated no base funding and now holds more than 2,100 awardees, so federal revenue depends on task orders HiddenLayer has not been shown to win at scale.
• The 50 million dollar Series A outruns the modest federal contract revenue in the public record, and a capital-intensive fight against bundled rivals could force a raise on weak terms or a sale.
• HiddenLayer names no commercial customer publicly, and buyers who demand current named references could stall enterprise deals.
• Cloud providers and model marketplaces could ship free native model scanning, commoditizing the supply-chain module that anchors the platform's lifecycle story.

HiddenLayer treats AI models, prompts, and agents as assets that attackers target directly, and sells a platform to defend them. The founders frame the problem from lived experience. Ten Eleven Ventures, an early investor, writes that they built the machine-learning IP behind Cylance's endpoint product and then defended it against adversaries who attacked Cylance's ML algorithms.

Non-vendor parties corroborate the problem at scale. A judging panel named HiddenLayer the winner of the RSA Conference 2023 Innovation Sandbox contest for safeguarding the machine-learning models behind critical products. Independent records now document the attack class the platform addresses: the National Vulnerability Database lists the ChromaDB pre-authentication remote-code-execution flaw the company disclosed and displays a maximum 10.0 CVSS score, with the MLflow deserialization flaw at 8.8, both in the AI tooling the supply-chain module scans.

The buyer spans two motions. HiddenLayer pitches CISOs and AI leaders at large enterprises commercially, with solution pages for financial services and application developers. The federal motion addresses Department of Defense and intelligence-community programs that run models in classified, disconnected environments, served by an airgapped edition of the platform. [s20, s18, s26, s27, s14]

The HiddenLayer AI Security Platform ships four documented modules under one console. AI Supply Chain Security scans model files for malware, tampering, and backdoors and produces an AI bill of materials, and the same module documents model signing as a complementary integrity layer. AI Runtime Security enforces guardrails and blocks malicious prompts against deployed AI applications. AI Attack Simulation runs automated testing through two evaluation types, System Prompt Evaluation and Red Team Evaluation. AI Discovery inventories models, agents, and AI workflows across cloud providers and surfaces shadow AI.

Public documentation backs the capability claims. The docs portal describes each module, the console, integration guides, an airgapped deployment option, and release notes without requiring a customer login. The vendor states that the airgapped platform deploys locally in classified, disconnected environments, and company officials said HiddenLayer was selected for the Missile Defense Agency vehicle on the strength of that platform.

The research program is now independently validated rather than only self-published. SAI advisories document vulnerabilities in AI development tooling, and the National Vulnerability Database lists the ChromaDB and MLflow remote-code-execution flaws the team disclosed, displays critical and high severity ratings, and references HiddenLayer's advisories. SecurityWeek separately reported that HiddenLayer tested its Policy Puppetry prompt-injection technique against models from eight major providers, evidence of adversarial-AI craft in the same artifacts the product defends. [s3, s5, s6, s7, s8, s26, s27, s28, s31]

HiddenLayer now competes mostly against platform giants rather than independent peers. Palo Alto Networks completed its acquisition of Protect AI, the closest module-for-module rival, in July 2025, and Check Point announced its acquisition of Lakera that September. CyberScoop framed the Lakera deal as entrenched cybersecurity companies expanding to match the generative AI boom.

Against the bundles, HiddenLayer's visible differentiators are breadth and classified-environment deployment. Four modules span the model lifecycle from supply chain to runtime, and the airgapped edition reaches networks that cloud-delivered platform offerings do not serve. An AWS marketplace listing for the intelligence community is a channel a commercial bundle cannot enter quickly. The SHIELD position is real but not exclusive, as GovCon Wire reports the pool now exceeds 2,100 awardees.

Independent specialists still contest each module, among them Noma Security and Mindgard. Microsoft is both a potential absorber and an investor through M12, which cuts in two directions for HiddenLayer's commercial segment. [s23, s24, s30, s16, s14]

Federal traction is the clearest public proof, and it is now independently verified rather than vendor-claimed. USAspending records obligated Air Force contracts to HiddenLayer Inc, including a 1.8 million dollar award for a machine-learning-security red-teaming workbench and a 1.25 million dollar award for machine-learning detection and response against adversarial attacks. The Missile Defense Agency also placed HiddenLayer on the SHIELD vehicle, reported by defense trade press in early 2026, though GovCon Wire reports SHIELD obligated no funding at the base level and now holds more than 2,100 awardees, so task-order wins, not the vehicle position, will determine federal revenue.

Commercial proof is thinner and mostly anonymous. TechCrunch relayed in 2023 the company's claim of Fortune 100 customers in finance and cybersecurity, and SiliconANGLE separately reported that HiddenLayer had nearly quadrupled its headcount over the prior year. The published case study describes a red-teaming engagement for an unnamed payments customer with over 50 million users. No named commercial customer case study appears in reviewed pages.

Ecosystem motion runs through cloud and data-platform partners. HiddenLayer ships expanded AWS integrations covering Amazon Bedrock, Bedrock AgentCore, and SageMaker, and a Databricks integration that scans new model versions in Unity Catalog, alongside advisory, resale, and technology-alliance programs. [s25, s33, s30, s14, s17, s32, s12, s13, s10]

The founding team's domain pedigree is press-verified. Chris Sestito led threat research at Cylance before co-founding HiddenLayer with Jim Ballard and Tanner Burns, and Ten Eleven Ventures writes that the three developed the critical IP behind Cylance's competitive advantage. The founders still run the company: Sestito chairs the board and serves as CEO, Ballard is CIO, and Burns is Chief Scientist.

The company has built out a senior bench around the founders. The about page lists Jacob Rideout as Chief Technology Officer, Malcolm Harkins as Chief Security and Trust Officer, and Mike Bruchanski as Chief Product Officer, and the newsroom records the July 2025 appointment of Chelsea Strong as Chief Revenue Officer. This is a scaling executive team rather than a founder-only operation.

The research organization gives the team a sustained, independently validated record. The National Vulnerability Database credits HiddenLayer's advisories for the ChromaDB and MLflow remote-code-execution flaws, and SecurityWeek covered its cross-model prompt-injection research, a multi-year publication pattern in the company's own product domain rather than a single covered event. [s2, s20, s26, s28, s11]

HiddenLayer publishes the trust artifacts a security buyer checks first. The security page states that HiddenLayer, Inc. and its Machine Learning Detection and Response system met SOC 2 Type II standards for security, availability, and confidentiality, and details encryption at rest and TLS 1.2 or higher in transit. A vulnerability disclosure policy and a disclosure contact address appear on the same page.

Classified-environment posture is the differentiated trust claim, and it is now backed by a federal record. The vendor states that the airgapped platform deploys locally so customer data stays in user-controlled environments, and USAspending confirms the Air Force contracts that establish the past performance HiddenLayer cites for its Missile Defense Agency selection. FedRAMP authorization does not appear in reviewed pages, which leaves the civilian-agency procurement path undocumented. [s22, s25, s14]

Add analyzed competitors to compare them side by side with HiddenLayer.

HiddenLayer treats the AI models, prompts, and agents an organization runs as assets attackers target directly, and sells a platform to defend them across the lifecycle. The homepage frames the buyer as the enterprise securing agentic, generative, and predictive AI at scale, and the founding story grounds the pitch: Ten Eleven Ventures, an early investor, writes that the founders built the machine-learning IP behind Cylance and then had to defend it from adversaries who attacked Cylance's ML algorithms.

The buyer splits into two motions, and the federal one is where the named evidence concentrates. Commercially, HiddenLayer pitches CISOs and AI leaders at large enterprises, with role and industry pages for application developers and financial services. The federal motion serves Department of Defense and intelligence-community programs that run models in classified, disconnected environments, addressed by a dedicated airgapped edition of the platform.

Non-vendor sources confirm category recognition and access to federal procurement. An RSA Conference 2023 judging panel named HiddenLayer Most Innovative Startup for safeguarding machine-learning models, and the Missile Defense Agency later placed the company on the SHIELD missile-defense vehicle, while the obligated Air Force awards, not the unfunded SHIELD base, show defense money reaching machine-learning security.

The HiddenLayer AI Security Platform ships four documented modules under one console. AI Supply Chain Security scans machine-learning models for malware, tampering, and backdoors and produces an AI bill of materials with model genealogy and integrity checks. AI Runtime Security is a real-time input and output monitor for hosted or custom LLMs that detects malicious prompts and undesired output and can block content. AI Attack Simulation runs automated testing through System Prompt Evaluation and Red Team Evaluation. AI Discovery inventories models, applications, and datasets across cloud providers and surfaces shadow AI.

The depth is documented rather than asserted, and the research behind it is now independently corroborated. A public docs portal describes each module, the console, integration guides, and an airgapped deployment option without a customer login. The documentation describes the supply-chain module as scanning models for malware, tampering, backdoors, and vulnerabilities. Separately, HiddenLayer's own research demonstrated ShadowLogic, a no-code computational-graph backdoor, which evidences in-domain craft rather than a documented module capability. The National Vulnerability Database lists remote-code-execution flaws the team disclosed in ChromaDB and MLflow and references HiddenLayer's advisories, which is research output rather than documented module scope.

What the platform does not have is the differentiating data asset its acquisition-target rivals carried. HiddenLayer's public research is a record of CVE advisories in AI tooling, evidence of in-domain craft but a stream of public disclosures rather than a proprietary corpus that trains its detectors. The capability advantage is the span of the four modules working together, not an accumulated dataset a copycat cannot assemble.

Federal procurement is HiddenLayer's clearest and most current public traction, and it is now independently verified rather than vendor-claimed. USAspending records obligated Air Force contracts to HiddenLayer Inc, including a 1.8 million dollar award for a machine-learning-security red-teaming workbench and a 1.25 million dollar award for machine-learning detection and response against adversarial attacks. The Missile Defense Agency placed the company on the SHIELD indefinite-delivery vehicle, reported by defense trade press in early 2026, though GovCon Wire reports SHIELD obligated no funding at the base level and now holds more than 2,100 awardees, so task-order wins will determine federal revenue.

Commercial proof is thinner and mostly anonymous. TechCrunch relayed in 2023 the company's claim of Fortune 100 customers across finance, government, defense, and cybersecurity, and SiliconANGLE separately reported that HiddenLayer had nearly quadrupled its headcount over the prior year. No commercial customer speaks in its own voice describing a paid deployment in the reviewed pages.

The selling motion is funded for the federal and enterprise push but light on disclosed revenue. The 50 million dollar Series A in September 2023, co-led by M12 and Moore Strategic Ventures with Booz Allen, IBM, Capital One, and Ten Eleven, brought the total raised to 56 million dollars, and the reviewed record shows no follow-on round since, even as the company added federal contract positions.

No platform price appears on the reviewed public pages, which signals a negotiated enterprise and federal motion rather than self-serve buyers. The site routes prospective buyers to a demo request, consistent with a vendor selling four-module platform deals into large enterprises and government programs through direct conversations.

The reviewed pages do not state the metering unit, so the basis of the bill is not publicly answerable from the fetched record. Because the platform spans build-time model scanning, runtime inspection, red-team simulation, and discovery, cost would plausibly track the size of the AI estate under protection, but that is inference rather than a published unit.

The absence of a published price on those pages fits the named buyer and raises a barrier for smaller teams. HiddenLayer likely negotiates enterprise and government contracts case by case, while a developer evaluating the platform has no transparent entry point.

HiddenLayer delivers as software the customer integrates and operates, with a runtime path that sits inline. AI Runtime Security monitors model input and output in real time and can block content before it reaches the LLM or the user, and HiddenLayer documents the supply-chain scanning CLI as carrying runtime options that make it suitable for integrating with common CI/CD workflows, so model verification can become a standard part of deployment. The documented integration work sits with the customer, which runs the supply-chain scanner from its own command line or orchestration system and wires the runtime controls into its request flow.

The differentiated delivery option is the airgapped edition. The platform installs within customer-managed infrastructure in classified, disconnected environments, which the vendor states meets federal security requirements while offering detection, scanning, and response without sending data to a vendor cloud. Army Technology reports that edition is the core of HiddenLayer's classified Department of War and intelligence-community solution, and USAspending records separately confirm the obligated Air Force contracts.

The heavier operational question the reviewed pages leave open is the inline runtime path. Because AI Runtime Security inspects production model traffic and can block it, a careful buyer would examine its latency, failure modes, and where inspection occurs, evidence the product pages describe at a capability level rather than with a published operational benchmark.

HiddenLayer publishes the trust artifacts an enterprise security buyer checks first. The security page states that HiddenLayer, Inc. and its Machine Learning Detection and Response system met SOC 2 Type II standards for security, availability, and confidentiality, documents encryption of data at rest and in transit, and carries a vulnerability disclosure policy and contact. SOC 2 Type II is completed third-party assurance rather than an in-process claim.

Classified-environment posture is the differentiated trust claim, and the SHIELD placement plus verified Air Force awards sit alongside the vendor's own deployment statements. The airgapped platform installs inside customer-managed infrastructure so data stays in user-controlled environments, Army Technology reports it meets federal security requirements as the core of HiddenLayer's classified solution, and USAspending separately verifies the obligated Air Force contracts.

The gap is published efficacy and a downloadable trust portal. No independent benchmark of detection quality and no FedRAMP authorization appear in the reviewed pages, so a civilian-agency procurement path is undocumented and the protection claims rest on vendor description rather than third-party evaluation.

HiddenLayer is built as a single platform spanning the AI lifecycle rather than a point tool. The documentation frames four modules, supply chain, runtime, attack simulation, and discovery, under one console, and the homepage positions the platform as covering the model lifecycle from build-time ingest through production runtime, so the modules share a common spine rather than standing alone.

Outward reach runs through cloud and data-platform integrations rather than an external builder ecosystem. AI Discovery inventories models, applications, and datasets across cloud providers, and the documentation carries integration guides for wiring the platform into those environments, but no third-party developer marketplace or partner-built integration catalog with a network effect appeared in the reviewed pages, so the platform claim sits on internal module consolidation and integration breadth.

Inward, the breadth is the strategy, since each module reinforces the others, but it is also the exposure. The same module breadth that lets a buyer consolidate is what a well-funded platform vendor can assemble. Two adjacent vendors have been taken up by larger platform owners, Protect AI absorbed by Palo Alto Networks and Lakera the subject of Check Point's announced purchase, which increases competition from that direction.

The founding team's domain pedigree is documented by investor Ten Eleven Ventures, which writes that founders Tito Sestito, Jim Ballard, and Tanner Burns developed the critical IP behind Cylance's competitive advantage and then defended it from adversaries who attacked Cylance's ML algorithms, the exact problem HiddenLayer now productizes. The founders still run the company, with Sestito as chairman and CEO, Ballard as CIO, and Burns as Chief Scientist.

The company has built a senior bench around the founders rather than staying founder-only. The about page lists Jacob Rideout as Chief Technology Officer, Malcolm Harkins as Chief Security and Trust Officer, and Mike Bruchanski as Chief Product Officer, and the newsroom announced in July 2025 that HiddenLayer had appointed Chelsea Strong as Chief Revenue Officer, a dated release read in the June 29, 2026 capture of that page rather than a statement about the current roster.

The research organization gives the team a sustained, independently validated record. The National Vulnerability Database credits HiddenLayer's advisories for the ChromaDB and MLflow remote-code-execution flaws, and SecurityWeek covered its cross-model prompt-injection research, a multi-year pattern in the company's own product domain rather than a single covered event.