Operant AI

• Cloud-security platforms such as Wiz, Palo Alto Networks, or Sysdig could add AI and MCP runtime protection to suites enterprises already buy, removing the third-party budget line for Operant's AI Gatekeeper line, the same absorption that took Lakera into Check Point and Prompt Security into SentinelOne off the board as independents in 2025.
• The public traction record rests on vendor-displayed testimonials from Juniper, Chargebee, Cohere, and ClickHouse leaders with no named customer speaking independently, so a procurement team could pick a rival on equal footing within a year.
• Operant leads its messaging with the crowded AI and MCP line rather than its harder-to-copy cloud-runtime base, so if AI-security marketing fails to convert it could dilute the clearer cloud-runtime story without winning the AI budget.
• With a single 2024 Series A of 10 million dollars, a better-funded rival could outspend Operant on enterprise sales, and the company has disclosed no follow-on raise to match an enterprise go-to-market.
• Capability claims rest largely on Operant's own pages, so an independent benchmark showing weaker runtime detection than the marketing implies would undercut the positioning.

Operant AI treats the live, running cloud application as the asset under attack, including the AI agents and MCP tools now woven into it. The company sells runtime defense for two layers at once: ordinary cloud workloads on Kubernetes and APIs, and the newer AI agents, models, and Model Context Protocol connections that enterprises are wiring into those workloads. SecurityWeek frames the buyer's pain as the limit of static pre-deployment security, which checks code before it ships but cannot see attacks against applications already in production.

The threat taxonomy maps to recognized frameworks rather than vendor invention. Operant's open-source Woodpecker tool tests against the OWASP Top 10 for Kubernetes, APIs, and AI, alongside MITRE ATLAS and NIST, which grounds the pain in catalogs security teams already track. The specific AI risks Operant names, prompt injection, data leakage, rogue agents, and MCP tool poisoning, are entries those frameworks recognize.

Buyer-side demand is visible beyond Operant's own claims. The company cites a 2025 Gartner Innovation Insight on MCP gateways, evidence that analysts are organizing a category around the runtime AI problem Operant sells against, though the depth of that demand for a standalone tool is not yet established in the public record. [s5, s8, s4]

Operant runs one methodology, Discovery, Detection, and Defense, across several product lines rather than a single point feature. The 3D Runtime Defense base secures cloud workloads on Kubernetes, APIs, and services, blocking common runtime attacks without code changes. AI Gatekeeper extends that defense to live AI applications, agents, and agentic workflows across public, private, hybrid, and edge environments, with trust scoring, agentic access controls, and threat blocking for MCP servers, clients, and Non-Human Identities.

The company ships the offensive side as open source. Woodpecker is an automated red-teaming engine, covered by SiliconANGLE at its May 2025 launch, that simulates attacks across Kubernetes, APIs, and AI models and agents, including prompt injection, jailbreaks, and model theft. Releasing it free buys distribution and developer goodwill that a closed tool would not, and any feedback of that threat knowledge into Operant's defensive products remains a possibility that public sources do not document.

Public technical depth is mixed. The open-source Woodpecker code and the technical blogs on MCP tool poisoning give a buyer more to assess than marketing pages alone, but the commercial products are described in product-page terms, and no third-party benchmark or independent evaluation of detection efficacy was observed in the pages reviewed. [s7, s8, s2]

Operant competes on two fronts that consolidate differently. The cloud-native runtime base contends with CNAPP and cloud-security platforms such as Wiz, Palo Alto Networks, and Sysdig, while the AI Gatekeeper line contends with AI-security entrants and the same platforms as they add AI controls. The harder-to-copy ground is the cloud-runtime base, because live protection for Kubernetes and APIs is slower to replicate than AI guardrails a platform can bolt on.

Operant's messaging now leads with the AI and MCP story. That is the louder market, but it is also the one larger platforms keep absorbing. Three AI-security independents close to Operant's AI line were each bought inside about six weeks in 2025: Cato Networks acquired Aim Security in September, SentinelOne agreed to buy Prompt Security in August, and Check Point acquired Lakera in September. AI runtime protection has repeatedly arrived bundled into a larger platform rather than standalone.

The structural question is whether Operant's dual footprint helps or splits it. Selling cloud-runtime and AI-runtime together lets one engine cover both, which is a real efficiency, but it also asks buyers to place a vendor in two budget lines at once, and the clearer of those two stories risks being overshadowed by the more crowded one. [s4, s2, s8, s12, s13, s14]

Operant's clearest proof points sit on its own pages. The homepage carries endorsements from leaders at Juniper Networks, Chargebee, Cohere, and ClickHouse praising the runtime approach, but these appear as vendor-curated testimonials rather than customers speaking in independent reporting. No customer count, revenue figure, or marketplace distribution motion is disclosed in the public record reviewed.

The strongest outside signals are press coverage and analyst mentions. SiliconANGLE covered the Woodpecker launch, SecurityWeek and GlobeNewswire reported the Series A, and Operant cites inclusion in 2025 Gartner AI-security reports, which together show the demand-generation channel works. These mark visibility and momentum rather than verified commercial scale.

Commercial proof is otherwise thin for the stage. Operant discloses no customer count or revenue, consistent with an early enterprise motion on a single Series A, and the most important readiness gap is the absence of one named reference customer willing to speak on the record. [s1, s7, s5]

Operant's founders pair deep infrastructure engineering with security systems work. Co-founder and CEO Vrajesh Bhavsar built core iOS and macOS technologies at Apple, including Data Protection and Secure Enclave, then ran the ML and AI business unit at Arm, and he holds eight patents in distributed systems, data, and security. That is platform-scale systems experience rather than a security-product sales background.

Co-founder and CTO Priyanka Tembey brings cloud-native depth. She earned a computer science PhD from Georgia Tech and was a foundational engineer who helped build out VMware's hybrid-cloud product, which maps directly to the runtime enforcement Operant now sells. Co-founder and COO Ashley Roof adds go-to-market experience from Google and a prior CMO role at Transposit.

The board and investor signal reinforces the pedigree. Operant's Series A added Patricia Muoio of SineWave Ventures, a former NSA and DoD leader, and Nancy Wang of Felicis, formerly the data-protection general manager at AWS, to its board. What is absent is a prior security exit or a sustained public research record of the kind that lifts the strongest teams in this category. [s3, s10, s5]

Operant states on its security page, linked from the site footer, that it is SOC 2 Type II compliant, and the same page documents vulnerability scanning of code and containers, third-party vendor assessment, encryption at rest and in transit, least-privilege access, and a responsible-disclosure channel. The page names no ISO 27001 certification and offers no downloadable report or self-service trust portal, so the audit itself reaches buyers through procurement rather than open download. Because the product inspects an organization's runtime traffic, AI workloads, agent behavior, and MCP connections, that access still invites detailed data-handling scrutiny the public page does not fully answer.

The deployment model favors fast adoption over heavy assurance. Operant markets single-step deployment and a 7-day free trial with most teams seeing an AI inventory within a day, which lowers the barrier to trying the product but does not substitute for the report-level evidence enterprise procurement expects. For a company at this stage, exposing the SOC 2 report and data-handling terms in a verifiable form is the readiness item most likely to surface in procurement. [s11, s2, s9]

Add analyzed competitors to compare them side by side with Operant AI.

Operant AI targets the enterprise security and platform team that runs live AI and cloud workloads and needs to defend them in production. The product line addresses runtime attacks on Kubernetes, APIs, and services, then extends the same defense to AI applications, agents, and Model Context Protocol tooling that teams are wiring into those workloads. SecurityWeek frames the buyer's pain as the limit of static pre-deployment security, which checks code before it ships but cannot see attacks against applications already running.

The four product surfaces widen the segment under one methodology. AI Gatekeeper covers live AI apps and agents, 3D Runtime Defense covers cloud workloads, Woodpecker offers free offensive testing, and Endpoint Protector now reaches the employee laptop where shadow AI tools and coding agents run. That spread lets Operant sell to the platform team, the application security team, and the workforce security team, and the live homepage as of July 2026 also markets Agent Protector and an MCP Gateway, entries beyond the four surfaces this snapshot assesses.

Public demand evidence is stronger on analyst mentions than on independently reported customer deployments. Operant presents itself as a Gartner featured vendor across five AI security reports including the 2025 AI TRiSM Market Guide, which shows analysts organizing a category around the runtime AI problem. Vendor-displayed testimonials from leaders at Chargebee, Juniper Networks, Cohere, and ClickHouse exist on the homepage but do not establish commercial scale, and the public record still lacks a named customer describing the segment fit in independent reporting.

The claimed advantage is enforcement in the live traffic flow rather than scoring after an alert. Operant blocks prompt injection and data exfiltration as data flows through the running stack and applies in-line auto-redaction, obfuscation, and blocking of sensitive data, with intelligent quarantine of suspicious containers and AI models and token-level rate limits. SecurityWeek reports the product claims to block more than 80% of common runtime attacks including the OWASP Top 10 without significant code changes.

The agent-specific work centers on MCP and non-human identity. AI Gatekeeper adds detection and access control for Model Context Protocol tooling and AI Non-Human Identities across the runtime and API access layers, with fine-grained identity-aware enforcement for autonomous agents. The same 3D methodology of discovery, detection, and defense runs across the cluster, the API, the agent, and the device.

The footprint is publicly verifiable, with the open-source Woodpecker engine giving outside engineers a way to inspect the offensive testing. What holds up, though, is engineering craft rather than data, because the detection rests on the company's own expertise and the runtime enforcement is a capability a funded rival can build against the same MCP and agent primitives.

Operant pairs free tooling with analyst visibility. Releasing Woodpecker as an open-source red-teaming engine gives Operant a public distribution surface, and both developer conversion into paid sales and any feedback of threat knowledge into the paid products remain possibilities the public sources do not document. SiliconANGLE covered the launch and framed Operant as a runtime application protection platform, outside coverage of the offensive side.

Named traction is thin and vendor-curated. The homepage carries praise from Juniper Networks, Chargebee, Cohere, and ClickHouse leaders, but these appear only on Operant's own pages rather than in independent reporting, and no customer count or revenue figure is disclosed. The readiness gap is one named reference account willing to speak on the record.

The analyst mentions are vendor-reported. Operant's own homepage presents Gartner featured-vendor placements across five AI security reports, with YourStory independently corroborating the AI TRiSM representative-vendor mention, and press from SecurityWeek and SiliconANGLE shows the company earns coverage. These mark visibility and momentum rather than verified commercial scale.

No price appears on the fetched pages, so the charged unit and list price stay outside the reviewed record. Selling through demos and sales conversations fits a product that inspects an organization's runtime traffic, agents, and identities, and the absence withholds the budget-anchoring signal some peers publish.

The four surfaces imply more than one value meter. The cluster and API defense reads as a platform subscription, the endpoint app reads as a per-device or per-seat workforce spend, and Woodpecker is free, so what each paid line charges by, whether workloads, agents, devices, or telemetry volume, is not stated publicly.

The inferable belief is that buyers pay for runtime coverage of the live application and agent surface rather than for discrete features. The unit and any consumption caps cannot be confirmed from the fetched pages, which route buyers toward demos.

Operant deploys in the runtime path with light integration across several surfaces. The platform blocks common runtime attacks on Kubernetes, APIs, and services without significant code changes, and the Endpoint Protector client runs on macOS, Windows, and Linux with a lightweight footprint and no kernel extensions required, which lowers the integration barrier for both the cluster and the laptop.

The public materials emphasize customer-deployed software rather than a managed service. Operant ships endpoint software and the open-source Woodpecker engine, and markets runtime and agent protection deployed into customer environments, with the in-line auto-redaction and adaptive enforcement running automatically once installed and no analyst-staffed service surfacing in the fetched pages. Operational collateral such as published uptime or support SLAs does not surface either.

The deployment posture favors fast adoption over heavy assurance. The endpoint client advertises sixty-second installation, and free offensive testing makes the line easy to try, but because the product sits in the live data path and reads prompts, tool calls, and identities, a buyer should resolve data-handling and retention terms in a formal review.

Operant states on its security page, linked from the site footer, that it is SOC 2 Type II compliant, and the page documents secure-by-default policies, least-privilege access enforced from infrastructure to the product layer, and policy-as-code baked into CI/CD. That is meaningful procurement assurance for an autonomous tool that reads privileged runtime traffic, though the page offers no openly downloadable report.

The product handles sensitive signal, which raises the assurance bar. Because the line inspects prompts, tool calls, agent loops, identities, and data in use across the live stack, a buyer carries data-handling and model-provider questions the published page does not fully answer. Operant frames in-line auto-redaction as keeping sensitive data inside the native application environment, which is part of the trust case.

The attestation is enterprise-grade but table-stakes rather than a moat. The cited record identifies no regulation mandating this product class, the page exposes no self-service report portal, and it names no ISO 27001 certification, so the attestation eases a purchase without blocking a substitute.

Operant positions itself as a single runtime-defense layer across the cluster, the API, the agent, and the device rather than a point tool. One 3D methodology of discovery, detection, and defense runs across all four surfaces, so the platform claim rests on covering the full live application and agent stack from one methodology rather than on owning a data asset other software depends on.

That breadth is a real efficiency and a real exposure. Covering four surfaces from one methodology lets Operant meet a buyer at the cluster, the API gateway, or the laptop, but every surface is a control layer beside the workload rather than infrastructure the workload cannot run without, and the line still ingests from the source tools and identities it does not own.

The ecosystem play leans on open source for reach. Woodpecker maps offensive testing to recognized frameworks, which builds developer goodwill, but it is published code a rival can study and reuse, so it strengthens distribution more than it strengthens lock-in.

Operant has three co-founders, and its technical credibility comes from the two who build the infrastructure. SecurityWeek independently names co-founders Vrajesh Bhavsar and Priyanka Tembey as veteran software engineers, and Operant's own record describes Bhavsar building Data Protection and Secure Enclave at Apple and Tembey as a foundational engineer on VMware's hybrid-cloud product. The third co-founder, Ashley Roof, is COO and carries the go-to-market track record rather than the systems one, having led sales and marketing from Google through a CMO role at Transposit. That pairing gives Operant platform-scale systems experience that maps onto runtime enforcement alongside a dedicated commercial leader.

The backing reinforces the founder signal. SecurityWeek reports the Series A investment was provided by SineWave Ventures, Felicis, Alumni Ventures, Massive, Calm Ventures, and Gaingels, bringing total funding to 13.5 million dollars since the April 2023 public launch. That is an early-stage round sized to an early enterprise motion rather than a late-stage war chest.

The verifiable strength is the founders' domain track record. What is absent from the fetched record is a prior security-company exit or a sustained public research record of the kind that lifts the strongest teams in this category, leaving depth below the principals the open question.