Operant AI

• A network or cloud security platform could bundle AI-agent protection into its suite, reducing demand for Operant’s products. Cato Networks acquired Aim Security to add AI-agent and application security to its SASE platform.
• The cited sources include no independently reported deployment, so a procurement team that asks for an independently reported reference account could choose a rival that can supply one.
• Operant’s last disclosed raise is a 2024 Series A of $10 million, so a rival with a larger round could outspend it on the enterprise sales and channel programs Operant launched in 2026.
• Operant pitches Semantic Firewall to enterprises that want agent controls inside their own perimeter rather than relying on model providers’ safeguards, so if the providers’ own controls satisfy buyers within three to five years, fewer enterprises would buy that separate layer.

Operant AI sells runtime security for software that is already running: AI agents, the Model Context Protocol (MCP) connections that link agents to tools and data, AI tools on employee laptops, and the Kubernetes and API workloads underneath. SecurityWeek describes the company and its investors as betting on runtime protection replacing static checks that analyze code before deployment, which frames the buyer’s problem as attacks on software after it ships.

The agent threat Operant sells against is documented outside its own pages, though that documentation traces back to Operant’s research. A GBHackers article from October 2025 says Operant’s security research team uncovered Shadow Escape, a zero-click attack that abuses MCP to pull sensitive data through AI assistants, and that Operant reported it to OpenAI and filed a CVE.

On its homepage, Operant lists Gartner reports that feature Operant, which signals analyst attention to the problem without sizing it. [s10, s4, s5, s6, s28, s3, s1]

Operant sells a platform of runtime controls built around one Discover, Detect and Defend method. 3D Runtime Defense redacts and blocks sensitive data flows and quarantines suspicious containers and models, AI Gatekeeper blocks unauthorized AI behavior and controls access for MCP tools and non-human identities, and the MCP Gateway catalogs MCP tools and blocks untrusted servers.

The newer products move those controls to agents and people. Agent Protector inventories managed and unmanaged agents and blocks actions outside an agent’s established patterns. Endpoint Protector, now generally available, inspects AI tools on macOS, Windows and Linux devices, and Semantic Firewall reads the intent behind each agent action and returns an allow, block or redact decision inline, with policies written in plain language.

Two public artifacts let outsiders inspect part of the technology. The open-source Woodpecker red-teaming engine publishes its code under an Apache 2.0 license, and a US patent, granted in May 2026 and assigned to Operant, describes a control plane that gathers microservice telemetry to recommend and enforce micro-segmentation. The cited sources include no third-party benchmark of Operant’s detection accuracy. [s1, s3, s2, s6, s5, s4, s20, s9, s31]

Operant competes on two fronts. CB Insights lists WitnessAI, Virtue AI, RAD Security and Lacework among its competitors, and Operant’s own pricing page positions its gateway products against Cloudflare AI Gateway, Portkey and Kong, which it describes as strong at observability and routing.

Platform vendors are also moving into AI security. Cato Networks announced that it had acquired Aim Security to extend its SASE platform to enterprise AI agents and applications, one sourced case of an AI-security product moving inside a larger vendor’s suite.

On its pricing page, Operant presents four products on one platform. CB Insights describes RAD Security, one of the listed rivals, as a cloud-native threat detection company, so Operant meets cloud-security rivals as well as AI-security ones depending on which product a buyer starts with. [s16, s21, s17]

Operant’s named proof points are on its own site. Operant publishes a Juniper Networks CTO endorsement and AI-security statements from Cohere and ClickHouse leaders on its homepage. It also identifies a former NIST cybersecurity chief and a CoSAI board member. The cited sources disclose no customer count or revenue.

The partner motion is the clearer commercial signal. Operant sells through AWS Marketplace, where its seller page lists two products, its partner page names resellers Trace3 and AHEAD plus integrations with Okta, n8n, Tenstorrent and Cerebras, and a LangChain partnership connects Agent Protector to LangChain agents. A Channel Insider article covered the February 2026 launch of Operant’s channel partner program, and CRN’s list of the hottest AI security startups of 2026 includes Operant, citing its program to embed security in AI inference infrastructure.

Those press items report programs Operant announced, so they show the programs exist rather than what they sell. No independently reported customer describes a deployment in the cited sources. [s1, s30, s25, s24, s29, s26]

Operant’s three co-founders pair systems engineering with go-to-market experience. Operant’s About page says CEO Vrajesh Bhavsar built Data Protection and Secure Enclave for iOS and macOS at Apple and later built Arm’s ML and AI business unit. It says CTO Priyanka Tembey was a foundational engineer on VMware’s hybrid cloud product, and COO Ashley Roof most recently served as CMO of Transposit.

Outside sources confirm part of that picture. SecurityWeek describes Bhavsar and Tembey as veteran software engineers, CRN names Bhavsar as CEO, and the Google Patents record lists all three founders as inventors on the micro-segmentation patent granted to Operant in May 2026. Operant’s Series A announcement added Patricia Muoio of SineWave Ventures, a former NSA and DoD leader, and Nancy Wang of Felicis, a former AWS data-protection leader, to the board.

The Apple, Arm and VMware builds rest on Operant’s own account, and the cited sources show no prior security-company exit or sustained research publication record. The team is verified as experienced in systems and security engineering rather than independently recognized for prior products in this category. [s7, s10, s26, s31, s11]

Operant’s site footer states that the company is SOC 2 Type II compliant, and its security page describes secure-by-default policies, encryption of customer data at rest, daily encrypted backups, periodic vulnerability scanning of code and packages, and deletion of customer data on request.

Deployment options reach toward regulated buyers. The Enterprise plan offers VPC, on-premise and air-gapped deployment, and Operant says most regulated and government deployments use that option, while Semantic Firewall enforces policy inside the customer’s own environment. Because the products read prompts, tool calls and data in use, a buyer will want data-handling and retention terms in the contract, which the cited security page cover only in general terms. [s1, s8, s21, s20]

Add analyzed competitors to compare them side by side with Operant AI.

Operant AI sells to enterprise security and platform teams that run AI agents, MCP connections and cloud workloads in production. Operant organizes its products by where the risk is. Agent Protector covers agents in cloud and SaaS environments, Endpoint Protector covers AI tools and coding agents on employee devices, the MCP Gateway and AI Gatekeeper cover traffic between agents, tools and models, and 3D Runtime Defense covers Kubernetes and APIs.

The pricing page sorts buyers by the size of their AI footprint, with three plans running from a first production deployment to enterprise-wide rollout. Operant says most regulated and government deployments use its Enterprise VPC, on-premise and air-gapped options. No regulated customer appears by name in the cited sources.

Operant’s claimed advantage is enforcement on the live action before it executes. Semantic Firewall reads the intent behind each prompt, tool call and code action and returns an allow, block or redact decision inline. Agent Protector blocks actions outside an agent’s established patterns. 3D Runtime Defense redacts sensitive data flows and quarantines suspicious containers and models. SecurityWeek relays Operant’s claim that it blocks more than 80% of common runtime attacks without significant code changes, a vendor figure that the cited sources do not test.

The research and IP behind the products are partly public. Operant’s research team disclosed the Shadow Escape MCP attack described in a GBHackers article. Woodpecker is open-source red-teaming code. A US patent describes collecting microservice telemetry through a local control plane and transmitting it to a central control plane. No independent benchmark of detection accuracy appears in the cited sources.

Operant pairs direct sales with a partner channel. It lists products on AWS Marketplace, names resellers including Trace3 and AHEAD, integrates with Okta, n8n and LangChain, runs on Tenstorrent’s inference infrastructure, and integrates with Cerebras’s inference cloud. A Channel Insider article covered the February 2026 launch of its channel partner program, and a CRN list of 2026 AI security startups includes Operant.

Juniper Networks’ CTO endorses Operant on its homepage. Operant also publishes AI-security statements from leaders at Cohere and ClickHouse. The cited sources include no customer count, revenue figure or independently reported deployment.

Operant publishes plan structure but not prices. The pricing page offers three plans that scale from a first production deployment to enterprise-wide rollout, and says pricing scales with endpoints under management, agents in production and the governance needed across MCP and AI applications.

The sales path runs from a free 7-day sandbox trial to paid pilots whose fee counts toward the subscription, and the AI Gatekeeper gateway is sold as an add-on on some plans. The charged units are named, but no list price is published, so buyers learn cost through a quote.

Operant delivers software that customers run themselves. The About page describes a single-step helm deployment for the cloud platform, the endpoint client runs on macOS, Windows and Linux without kernel extensions, and the Enterprise plan adds VPC, on-premise and air-gapped deployment. Telemetry forwards to Splunk, Datadog, Elastic and Chronicle, and identity policies come from Okta, Azure AD or Google Workspace.

Paid pilots include dedicated onboarding support and architecture guidance, which helps customers deploy rather than making Operant accountable for security outcomes. Because the products run in live traffic and read prompts, tool calls and sensitive data, the operational question for a buyer is how data is handled and retained, which the public security page answers only in general terms.

Operant’s site footer states SOC 2 Type II compliance, and its security page describes least-privilege access, encryption at rest, daily encrypted backups, periodic vulnerability scanning and deletion of customer data on request. The footer also names Operant as a contributing member of CNCF, the OWASP Foundation and the Coalition for Secure AI.

Operant describes Semantic Firewall policy enforcement inside the customer’s own environment. The SOC 2 attestation and deployment options ease procurement.

Operant presents itself as one platform across endpoints, agents, MCP and AI applications, and its pricing page describes four products on one platform, with the two gateway products sold as add-ons on some plans. Integrations reach the tools buyers already run: Okta for identity, n8n and LangChain for agent workflows, security tools for telemetry, and AWS Marketplace for procurement.

The ecosystem adds reach more than dependence. The open-source Woodpecker engine gives developers a free entry point, and inference partners such as Tenstorrent and Cerebras place Operant’s controls where models run. The AI Gatekeeper acts as an LLM gateway that applications route model traffic through, and Operant sells it as an add-on on some plans rather than as the core of every deployment.

Operant’s co-founders combine systems and security engineering with sales and marketing experience. The About page credits CEO Vrajesh Bhavsar with Data Protection and Secure Enclave work at Apple and with building Arm’s ML and AI business unit. It credits CTO Priyanka Tembey with foundational work on VMware’s hybrid cloud product, and COO Ashley Roof most recently served as CMO of Transposit. SecurityWeek independently calls Bhavsar and Tembey veteran software engineers.

The founders’ own IP is now on the public record. The Google Patents record lists all three as inventors on the telemetry-driven micro-segmentation patent, filed in January 2024 and granted to Operant in May 2026. The cited sources show no prior security-company exit.