Pillar Security

• Platform vendors such as Palo Alto Networks and Microsoft could fold agent discovery, red teaming, and runtime guardrails into suites enterprises already buy, undercutting a standalone Pillar purchase before it proves deployment depth at its named customers.
• Model providers could ship native security for the agents built on their own platforms, removing the third-party budget line Pillar depends on.
• Named customers exist but no deployment depth is published, so buyers who require evidenced production references or case studies could stall enterprise deals for a company still in its first funding round.
• Pillar has disclosed only a single $9 million seed, and a capital-heavy fight for enterprise runtime deployments could force a raise on weak terms or a sale before the motion proves out.
• The differentiation rests heavily on the team's offensive research output, so a slowdown in that disclosure stream or a key departure could erode the main reason a buyer chooses Pillar over a bundled competitor.
• A customer can cancel the runtime subscription and reabsorb the guardrail work into existing controls, which keeps switching cost low while the product is an overlay rather than embedded infrastructure.

Pillar Security treats the AI agents an enterprise runs as assets it cannot fully see or control, and sells a platform to inventory, test, and guard them. The platform page frames the problem as agents, models, and MCP servers spreading across code, cloud, SaaS, and endpoints faster than security teams can track, including shadow AI nobody approved. The buyer is the enterprise security team standing up agents inside core business processes.

Independent evidence corroborates the gap beyond vendor marketing. SiliconANGLE describes Pillar securing AI applications across the full lifecycle from development to production, and Palo Alto Unit 42 documented web-based indirect prompt injection against AI agents observed in the wild, which establishes agent compromise as a demonstrated risk rather than a projection.

The buyer-side concern is partly quantified. The Times of Israel cites a Deloitte survey of 1,200 chief information security officers in which 77 percent expressed concern about AI threats, a signal that the worry Pillar names is felt at the level it sells to, though that figure measures AI concern broadly rather than the unseen-agent problem specifically. [s2, s7, s14, s8]

The Pillar platform spans four modules rather than a single control point. The product page describes AI discovery and posture that inventories every agent, model, and MCP server, red teaming that tests multi-turn attacks and tool hijacking through real agent configurations, runtime guardrails that block prompt attacks and data egress, and governance that flags agents operating outside policy. The vendor positions adaptive guardrails that adjust per agent.

The runtime layer is where the product claims to act in production. Pillar describes taint analysis that traces PII and secrets from source to destination and blocks unauthorized egress in real time, plus behavior monitoring that logs tool invocations and decisions for audit. These are the controls a security buyer evaluating a runtime product would test against its own agents, though no third-party technical evaluation of the platform itself appears in the public record.

The team's research demonstrates depth in the same domain the product addresses. Pillar disclosed the Rules File Backdoor, in which attackers hide malicious instructions in the configuration files that Cursor and GitHub Copilot read so the assistants generate attacker-chosen code. A separate Cursor flaw that Pillar reported, cataloged by NIST as CVE-2026-22708 and fixed in Cursor 2.3, let prompt injection poison shell environment variables so that commands ran without appearing in the Auto-Run allowlist. In a third finding, Pillar chained prompt injection into remote code execution in Google's Antigravity, and Google accepted the report through its AI VRP and marked it fixed. That work validates the researchers' offensive craft more than the product a customer buys. [s2, s10, s11, s9]

Pillar competes in agentic AI security against both independents and the platforms building the same controls. Independent rivals sell into the same discovery, testing, and runtime stack for the enterprise AI buyer, and platform vendors could fold AI runtime security into the broader suites they already sell, a prospective bundling risk rather than a documented current offering in the cited record.

Pillar's visible differentiator is the offensive depth of its founders, shown through research. The team's attacks on the AI coding tools developers use every day give it a public profile larger than a company on a single seed round would otherwise hold. A bundled competitor cannot quickly reproduce that research brand, but a published finding is free to copy once it is out.

The structural risk is who owns the buyer. Model providers could secure the agents built on their own platforms, and platform vendors can fold agent security into deals an enterprise already signs. Pillar's independence is both its neutrality pitch and its exposure, because the buyer relationship sits with the vendors it works beside. [s2, s7, s9]

Research is Pillar's loudest go-to-market engine. The team's Rules File Backdoor finding drew coverage in The Hacker News, and the Antigravity finding is published vendor research, which together build inbound awareness and position the team as researchers worth following. That visibility plausibly feeds inbound enterprise interest, though this is an inference, and no public source documents how Pillar's deals actually originate.

Named customers now back that attention. The Times of Israel reports Similarweb, Eleos Health, and AvidXchange among Pillar's customers, the named-account proof that sits in independent press rather than vendor copy alone. Shield Capital led the seed and Golden Ventures and Ground Up Ventures joined, which is investor conviction layered on the buyer proof.

The depth behind the names is what the public record still lacks. Pillar routes prospects to a demo request, and no deployment metric, contract size, or customer case study is published, so the references read as logos rather than documented production use. Disclosure of how broadly these customers run Pillar would be the signal that the attention has converted into scale. [s9, s8, s1, s5]

The founders pair offensive-security craft with product-building experience. Co-founder Dor Sarig developed security products for Fortune 500 companies and worked with Israel's Ministry of Defense, Perimeter81, and Cymulate. Co-founder Ziv Karliner worked on financial cybercrime, cloud, and software supply-chain security at IBM Trusteer and Aqua Security after serving in the Israeli intelligence forces. The company site lists conflicting current executive titles for the two, so the settled public fact is their co-founder roles.

The research record is the team's strongest public signal. The Hacker News covered the Rules File Backdoor, in which hidden instructions in configuration files steer Cursor and GitHub Copilot into generating attacker-chosen code, and NIST cataloged a separate Cursor Auto-Run allowlist bypass that Pillar reported as CVE-2026-22708. A later finding chained prompt injection into remote code execution in Google's Antigravity. This is a sustained publication pattern in the company's own product domain rather than a single covered event.

The public record documents headcount only as of the seed coverage. In April 2025 the Times of Israel reported Pillar raising $9 million to triple its workforce from 10 to 30 employees by the end of that year, and no fetched source gives a later number. Research bylines on the company blog extend beyond the two founders, with the Antigravity disclosure credited to researcher Dan Lisichkin. The verifiable strength remains the founders' domain track record and the disclosure stream the team sustains. [s3, s9, s10, s11, s8, s4]

Pillar publishes a Scytale-powered Trust Center that lists SOC 2 Type II and ISO 27001:2022 entries. The portal names a Pillar Security SOC2 Type II 2025 report, a Pillar Security ISO27001 2026 report, and an external penetration testing report, each behind a request-access step rather than open download.

Runtime data handling backs the attestations. The product describes taint analysis and detection of PII and secrets that keep sensitive data from leaving the environment, which addresses the exposure question a buyer raises when a security product inspects proprietary AI traffic. For Fortune 500 and financial-services buyers, the two named attestations are the artifacts procurement requests first, though the reports stay gated. [s13, s2]

Add analyzed competitors to compare them side by side with Pillar Security.

Pillar Security sells to the enterprise security team standing up AI agents inside core business processes. The platform frames the buyer as defenders who cannot fully see the agents, models, and MCP servers spreading across code, cloud, SaaS, and endpoints, including the shadow AI nobody approved. SiliconANGLE describes the company securing AI applications across the full lifecycle from development to production.

The segment is the large enterprise reached through a sales-led motion rather than self-serve. The named customers point at sizable software buyers, Similarweb, Eleos Health, and AvidXchange, and the founder background centers on products built for Fortune 500 companies. No free tier or public price appears in fetched pages, which fits a negotiated enterprise sale.

The widening of the segment comes from covering the whole AI lifecycle on one platform rather than from reaching new buyers. By spanning discovery, testing, runtime guarding, and governance, Pillar addresses any enterprise adopting agents regardless of which models it runs, which broadens reach but places it against both AI-security independents and the platform vendors now shipping their own AI controls.

Pillar runs four modules across the AI lifecycle rather than a single control point. The platform page describes AI discovery and posture that inventories every agent, model, and MCP server, red teaming that tests multi-turn attacks and tool hijacking through real agent configurations, runtime guardrails that block prompt attacks and data egress, and governance that flags agents operating outside policy. The vendor positions adaptive guardrails that adjust per agent so controls match what each agent is meant to do.

The runtime layer is where the product claims to act in production. Pillar describes taint analysis that traces PII and secrets from source to destination and blocks unauthorized egress in real time, plus behavior monitoring that logs tool invocations and decisions for audit. These are the controls a buyer evaluating a runtime product tests against its own agents, though no third-party technical evaluation of the platform itself surfaces in fetched pages.

The team's research demonstrates depth in the same domain the product addresses. Pillar disclosed the Rules File Backdoor, in which attackers hide malicious instructions in the configuration files that Cursor and GitHub Copilot read so the assistants generate attacker-chosen code. A separate Cursor flaw that Pillar reported, cataloged by NIST as CVE-2026-22708 and fixed in Cursor 2.3, let prompt injection poison shell environment variables so that commands ran without appearing in the Auto-Run allowlist.

Pillar carried the same craft to Google's own tooling. It chained prompt injection into remote code execution in Google's Antigravity, and Google accepted the report through its AI VRP and marked it fixed. That adversarial work, covered independently, is the verifiable proof that the team finds the agent vulnerabilities the platform is built to catch, though it validates the researchers more than the product a customer buys.

Research is Pillar's loudest go-to-market engine. The Rules File Backdoor finding drew coverage in The Hacker News, with the company's CTO quoted directly, and the Antigravity disclosure ran through Google's AI VRP, both of which generate inbound awareness and position the founders as researchers worth following. That visibility plausibly feeds inbound enterprise interest, though this is an inference, and no fetched source documents how Pillar's deals actually originate.

Named customers now back that attention. The Times of Israel independently reports Similarweb, Eleos Health, and AvidXchange among Pillar's customers, the named-account proof that sits in press rather than vendor copy. Shield Capital led the seed and Golden Ventures and Ground Up Ventures joined, which is investor conviction layered on the buyer proof.

The depth behind the names is what the public record still lacks. Pillar routes prospects to a demo request, and no deployment metric, contract size, or customer case study appears in fetched sources, so the references read as logos rather than documented production use. Disclosure of how broadly these customers run Pillar would be the signal that the attention has converted into scale.

Pillar publishes no price in fetched sources, so the charged unit and list price stay private. The homepage and platform pages route every prospect to a demo request, the posture of a vendor selling large negotiated enterprise deals rather than a self-serve product. The absence withholds the budget-anchoring signal some peers publish.

One plausible value meter is the volume of AI traffic the product inspects, though that is inference rather than a stated unit. Because the runtime guardrails block threats in real time and log every prompt, response, and tool call, cost would plausibly track interaction volume or the number of agents and applications covered, but no fetched page names the meter.

The hidden-price posture signals the intended buying path. Confirming whether Pillar charges by seats, agents, telemetry volume, or a flat platform fee, and whether consumption is capped, would require a sales conversation, which is the route the demo-request funnel is built to force.

The reviewed pages present Pillar as a software platform rather than an analyst-staffed managed service. The product covers discovery, red teaming, runtime guardrails, and governance, and no managed-service operating model or outcome accountability is described in the cited pages, so the buyer appears to configure the policies and run the controls. The runtime guardrails block threats in production AI traffic in real time and log every prompt, response, and tool call for audit.

The runtime layer is the operationally heavy part of the offer. Pillar describes taint analysis and real-time blocking of unauthorized data egress, plus behavior monitoring across agentic workflows, so the operational job is enforcement that follows a moving attack surface rather than a static rule set. Published uptime figures or support SLAs do not surface in fetched pages.

The real-time enforcement role raises the dependency question a careful buyer examines. A guardrail that blocks unauthorized egress as agents run becomes an operational dependency for the AI it protects, and the fetched pages describe the capability without documenting how Pillar deploys into a customer's environment or an operational track record a buyer could weigh against it.

Pillar publishes a Scytale-powered Trust Center that names both SOC 2 Type II and ISO 27001:2022. The portal lists a Pillar Security SOC2 Type II 2025 report, a Pillar Security ISO27001 2026 report, and an external penetration testing report, each behind a request-access step rather than open download, alongside control summaries across product, access, data, and endpoint security.

Runtime data handling backs the attestations. The product describes taint analysis and detection of PII and secrets that keep sensitive data from leaving the environment, which addresses the exposure question a buyer raises when a security product inspects proprietary AI traffic. For Fortune 500 and financial-services buyers, the two named attestations are the artifacts procurement reviews commonly request.

The attestations are enterprise-grade but table-stakes rather than a moat. The certifications ease procurement without blocking a substitute, no regulation mandates this product class, and a determined rival could clear the same bars, so the trust posture removes friction from a sale rather than defending the position.

Pillar positions itself as the security control point an enterprise places over the AI it adopts. It inventories agents, models, and MCP servers, tests them, guards them at runtime, and governs them from one platform, so the platform claim rests on covering the whole AI lifecycle rather than a single point feature. Adaptive guardrails per agent are the runtime expression of that breadth.

Outward, the company reaches buyers as model-agnostic coverage that works regardless of which AI tools an enterprise runs. By spanning the coding assistants developers use, internal agents, and the MCP servers that connect them, Pillar pitches neutral coverage across the AI estate rather than a feature of one model vendor.

Inward, that neutrality is also the exposure. The platform runs beside the source tools and consoles it inspects and depends on the frontier models it does not own, and the structural risk is who owns the buyer, because platform vendors can bundle the same controls into deals an enterprise already signs and model providers can secure the agents built on their own platforms.

Pillar's two founders pair offensive-security craft with product-building experience. Dor Sarig and Ziv Karliner anchor the team, Sarig with offensive-security work for Fortune 500 companies alongside Israel's Ministry of Defense, Perimeter81, and Cymulate, and Karliner with financial cybercrime, cloud, and supply-chain security at IBM Trusteer and Aqua Security after the Israeli intelligence forces. The Israeli Companies Registry records the entity as incorporated in 2023.

The research record is the team's strongest public signal. The Hacker News covered the Rules File Backdoor, in which hidden instructions in configuration files steer Cursor and GitHub Copilot into generating attacker-chosen code, and NIST cataloged a separate Cursor Auto-Run allowlist bypass that Pillar reported as CVE-2026-22708. A later finding chained prompt injection into remote code execution in Google's Antigravity. This is a sustained publication pattern in the company's own product domain rather than a single covered event.

The public record documents headcount only as of the seed coverage. In April 2025 the Times of Israel reported Pillar raising $9 million to triple its workforce from 10 to 30 employees by the end of that year, and no fetched source gives a later number. Research bylines on the company blog extend beyond the two founders, with the Antigravity disclosure credited to researcher Dan Lisichkin. The verifiable strength remains the founders' domain track record and the disclosure stream the team sustains.