All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Protect AI, founded in 2022, sold software that scans AI models for malicious code, tests AI applications with simulated attacks and protects them while they run. GeekWire reported Fortune 500 customers in finance, healthcare and government. By April 2025 it had 110 employees and had raised $108.5 million, with Evolution Equity Partners leading its $60 million Series B. Palo Alto Networks bought Protect AI in 2025 for $634.5 million and sells that software in Prisma AIRS, its AI security platform. Palo Alto Networks credits huntr, Protect AI's bug bounty community for AI flaws, as a research source for Prisma AIRS. Rivals would need to match Protect AI's research community, attack library and a partnership in which Guardian, Protect AI's scanner, checks public model files on Hugging Face.
| Description | Protect AI built software that scans AI models for hidden threats, red teams AI applications, and protects them at runtime. Palo Alto Networks acquired it in 2025 and sells the capabilities in its Prisma AIRS platform. | [f1] |
|---|---|---|
| Acquisition | Palo Alto Networks, announced 2025-04-28 , now Prisma AIRS | [f2] |
| Founded | 2022 | [f3] |
| HQ | Seattle, WA | [f4] |
| Funding | $108.5M total | [f4] |
| Latest funding | Series B, $60M, led by Evolution Equity Partners (2024) | [f4] |
| Deployment | SaaS, Self-hosted | [f5] |
| Product | What it does |
|---|---|
| Protect AI | Model scanning, automated AI red teaming, and runtime protection for AI applications, now part of Palo Alto Networks' Prisma AIRS platform. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Protect AI scans AI models, red teams AI applications, and protects them at runtime, capabilities Palo Alto Networks now sells in Prisma AIRS. It is mapped to the AI Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Palo Alto Networks names the buyers as large enterprises and government organizations building AI ecosystems. It names the threats as model manipulation, data poisoning and prompt injection, which Calcalist's CTech also describes. GeekWire relays a HiddenLayer report that nearly three-fourths of companies say they had an AI-related breach in 2024. That figure comes from vendor research. No independent measurement of the problem's scale appears in the cited sources. [s2, s17, s10] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Palo Alto Networks documents the model scanning at 35-plus model file types and 25-plus threat categories, and Protect AI's scanning code is open to inspection in the ModelScan repository. Hugging Face states that it partnered with Protect AI and that Guardian scans the files in public repositories on its Hub, an outside deployment of the scanning capability. [s4, s9, s22] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | The enabler is business adoption of generative AI after ChatGPT's release in late November 2022, the year Protect AI was founded, as Strategy of Security recounts. The demand signals in the cited sources are the 2025 acquisition and Palo Alto Networks' own statements about its customers. Both are actions or statements of the buying platform, which is one kind of signal, and no independent buyer-side signal from the past year appears in the cited sources. [s23, s14, s3, s19] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | GeekWire reports that Ian Swanson co-founded Sometrics, which American Express bought, and DataScience, which Oracle acquired, and that he held AI leadership roles at AWS and Oracle. Protect AI was the third company he helped launch to be acquired. The CVE Program lists Protect AI (formerly huntr.dev) as a CVE Numbering Authority, an independent record of its vulnerability research standing. [s10, s21, s18] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Hugging Face confirms in its own documentation that it partnered with Protect AI to scan public repositories on its Hub. Palo Alto Networks calls Leidos a strategic partner to both companies. GeekWire reports Fortune 500 customers across finance, healthcare and government without naming them. The two partnerships, each confirmed by a party other than Protect AI, are verifiable partnership motion, and no cited independent source gives a customer count. [s22, s3, s10] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | Protect AI raised $108.5 million, according to BankInfoSecurity and SiliconANGLE, and grew to 110 employees while shipping model scanning, red teaming and runtime products. Palo Alto Networks' fiscal 2025 annual report records a purchase consideration of $634.5 million. That consideration exceeded the $108.5 million raised. No revenue or margin figure in the cited sources confirms operating efficiency. [s14, s11, s19] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | BankInfoSecurity places Protect AI among pure-play AI security vendors and describes that vendor landscape as in its infancy, with dozens of vendors. Strategy of Security writes that the market has no recognized pattern or product architecture to follow yet, so the category is recognizable but still forming. [s14, s23, s11] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Palo Alto Networks debuted Prisma AIRS on the day it announced the deal. SiliconANGLE notes the platform covers many of the same use cases, evidence that a platform vendor could absorb the capability. The friction Protect AI built is the huntr research community and the Hugging Face scanning partnership, short of an evidenced structural moat. [s11, s5, s22, s19] |
Protect AI sold security for the AI models and applications that enterprises build and run. Palo Alto Networks describes the buyers as large enterprises and government organizations building ecosystems of AI models, agents and tools. GeekWire reports Protect AI served Fortune 500 companies across finance, healthcare and government.
The threats are specific to AI. Palo Alto Networks names model manipulation, data poisoning and prompt injection, and Calcalist's CTech describes the same threats as growing more urgent as enterprises and government agencies integrate AI. Hugging Face notes that some model serialization formats allow arbitrary code execution, which makes sharing models potentially dangerous.
Nearly three-fourths of companies said they had an AI-related breach in 2024, according to vendor research by HiddenLayer that GeekWire cited. [s2, s10, s17, s22]
Protect AI built products for three stages of the AI lifecycle, covering model file scanning, red teaming of AI applications, and runtime protection. SiliconANGLE describes Recon testing a new AI workload before deployment with a library of 450 simulated cyberattacks. Hugging Face says Guardian scans the files in public repositories on its Hub.
Palo Alto Networks now sells these capabilities inside Prisma AIRS. Palo Alto Networks' completion release describes the combination as bringing together model scanning, posture management, AI red teaming, runtime protection and AI agent security. The Prisma AIRS model scanning page documents 35-plus model file types and 25-plus threat categories, with scans that run in the customer's environment.
Protect AI also published open-source code. ModelScan scans models for serialization attacks across H5, Pickle and SavedModel formats, and its repository is public on GitHub. The huntr bug bounty platform, which Protect AI bought in 2023, continues to run AI hacking challenges. [s11, s22, s3, s4, s9, s7, s14]
Protect AI competed as a pure-play AI security vendor before Palo Alto Networks bought it. BankInfoSecurity lists Lakera and HiddenLayer as notable pure-play vendors besides Protect AI, and CTech calls Protect AI a main competitor of Prompt Security, Lasso and Apex.
Palo Alto Networks moved the capability into its own platform portfolio through the acquisition. Palo Alto Networks debuted Prisma AIRS on the day it announced the deal. SiliconANGLE notes that the platform covers many of the same use cases as Protect AI's suite, so Protect AI's products now compete as part of a broader platform.
Protect AI brought a research community and a scanning partnership into that platform alongside its code. Palo Alto Networks credits huntr's more than 19,000 members as a research source for its red teaming, and Hugging Face runs Guardian as a scanner on its Hub. [s14, s17, s11, s5, s22]
Protect AI's documented commercial facts include two partnerships and its sale. Hugging Face says it partnered with Protect AI to scan public repositories, and Palo Alto Networks calls Leidos a strategic partner to both companies. GeekWire reports Fortune 500 customers across finance, healthcare and government without naming them.
Palo Alto Networks agreed to buy the company in April 2025 and completed the deal on July 22, 2025. Its fiscal 2025 annual report records the purchase consideration at $634.5 million. Palo Alto Networks attributes the goodwill mainly to the assembled workforce and expected synergies from integrating Protect AI technology.
Press estimates before the close ran from more than $500 million, per GeekWire's sources, to $650 million to $700 million, per Jefferies analysts cited by Network World. The filed $634.5 million is above GeekWire's floor and below the Jefferies range. No revenue figure for Protect AI appears in the cited sources. [s22, s3, s10, s2, s19, s16]
Protect AI's chief executive, Ian Swanson, had built and sold companies before. GeekWire reports he co-founded Sometrics, which American Express bought, and DataScience, which Oracle acquired, and held AI leadership roles at AWS and Oracle. Protect AI was the third company he helped launch to be acquired.
Protect AI built its in-domain standing through vulnerability research. The CVE Program lists Protect AI, formerly huntr.dev, as a CVE Numbering Authority, with a scope covering vulnerabilities reported by researchers collaborating with huntr.
The founders moved into Palo Alto Networks. GeekWire reported in 2025 that Swanson became vice president of AI security and that former president Daryan Dehghanpisheh became the company's go-to-market lead for AI security in North America. [s10, s21, s18]
Protect AI's products handle sensitive AI assets, since they scan an organization's models and inspect live AI traffic. Palo Alto Networks says on its model scanning page that scans run locally, so sensitive data stays in the customer's environment. It adds that validation results are retained to support audit and compliance workflows.
Protect AI's vulnerability disclosure role is a public trust signal of its own. Its CVE Numbering Authority status covers vulnerabilities in Protect AI products and those reported through huntr. [s4, s18]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| HiddenLayer | competes with | BankInfoSecurity lists HiddenLayer beside Protect AI among notable pure-play AI security vendors. | |
| Lakera | competes with | BankInfoSecurity lists Lakera beside Protect AI among notable pure-play AI security vendors. | |
| Prompt Security | competes with | Calcalist's CTech describes Protect AI as a main competitor of Prompt Security. | |
| Lasso Security | competes with | Calcalist's CTech describes Protect AI as a main competitor of Lasso. | |
| TrojAI | competes with | Competes for the same enterprise buyer of AI red teaming and runtime protection that Protect AI served. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Palo Alto Networks | adjacent | Acquired Protect AI in 2025 and sells its capabilities inside Prisma AIRS. | N/AWe scored these companies at different scopes, so the totals measure different things. |
Add analyzed competitors to compare them side by side with Protect AI.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Protect AI built specialized model-scanning engineering and an attack library fed by the huntr research community. Its scanners cover 35-plus model file types, and Palo Alto Networks now puts the huntr community at more than 19,000 members. Customers run the software inside their own build and deployment pipelines, so leaving means rewiring that integration work. Palo Alto Networks paid $634.5 million for the company in 2025 and sells the capability inside Prisma AIRS, its AI security platform.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers buy Protect AI's model scanning, red teaming and runtime protection as software. The Prisma AIRS pages describe embedding model scanning in build, test and deployment workflows and running it in the customer's environment, so the customer's team operates it and owns the outcomes. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Model scanning is embedded in customers' build, test and deployment workflows through an API and enforces risk-based policies on every model. Leaving means reconfiguring those integrations and policies, which is meaningful integration friction. The cited sources document no mechanism that sizes a migration beyond that work, so the exit cost is documented as integration friction only. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Palo Alto Networks says on its model scanning page that validation results are retained to support audit and compliance workflows, which serves a customer's own governance work. No authorization, mandate or retained liability that would block a replacement appears in the cited sources, and no attestation detail from the Protect AI trust center appears in them either. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Scanning 35-plus model file types for 25-plus threat categories is machine-learning security work. Red teaming that simulates attacks, and inspection of prompts and responses in live AI traffic, add real-time security work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | GeekWire reports Protect AI served Fortune 500 companies across finance, healthcare and government, which are regulated enterprise and government buyers. GovCon Wire reports the combined offering is intended to address government, finance, healthcare and manufacturing. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Model scanning runs as a step in customers' build and deployment workflows, red teaming tests applications before release, and runtime security inspects AI traffic as applications execute. No cited source documents other applications depending on these products to run, so they read as a platform with application features. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | SiliconANGLE describes Recon finding weak points with a library of 450 simulated cyberattacks. Palo Alto Networks says its red teaming draws on continuous threat research from huntr's more than 19,000 members, so the attack corpus is one the vendor retains and adds to. Hugging Face says Guardian benefits from reports sent in by huntr's bounty hunters. No cited source documents the library as published, and none documents it as impossible to rebuild with time and effort. |
Protect AI sold to enterprises and government organizations that build and run their own AI models and applications. GeekWire reports it served Fortune 500 companies across finance, healthcare and government. Palo Alto Networks describes the same buyers as large enterprises and government organizations building ecosystems of AI models, agents and tools.
Palo Alto Networks stated a wider target for the combined offering. GovCon Wire reports the combined offering is intended to address demand across government, finance, healthcare and manufacturing, which adds manufacturing to the sectors GeekWire named for Protect AI itself.
Protect AI also worked with a model hub and AI researchers outside the enterprise sale. Hugging Face partnered with Protect AI to scan public model repositories on its Hub, ModelScan is open-source code on GitHub, and huntr runs public hacking challenges for AI researchers.
Protect AI covered three stages of the AI lifecycle with separate products. SiliconANGLE describes Recon testing an AI workload before deployment with a library of 450 simulated cyberattacks. It describes Layer filtering malicious prompts once the workload is in production, and Hugging Face says Guardian scans the files in public repositories on its Hub.
Protect AI's model scanning checks model files for unsafe code without loading them. ModelScan reads a file one byte at a time, looking for unsafe code signatures. The Prisma AIRS model scanning page documents coverage of 35-plus model file types and 25-plus threat categories. Palo Alto Networks adds on that page that huntr insights help validate models across millions of scanned models.
Protect AI sourced attack research from its huntr community. Palo Alto Networks says its red teaming draws on continuous threat research from huntr's more than 19,000 members and the Unit 42 team. Hugging Face says Guardian benefits from reports sent in by huntr's bounty hunters.
Protect AI's go-to-market record includes partnerships, funding and its sale. Hugging Face runs Guardian on its Hub under a partnership with Protect AI, and Palo Alto Networks calls Leidos a strategic partner to both companies. GeekWire reports Fortune 500 customers without naming them.
The company raised $108.5 million, including a $60 million Series B led by Evolution Equity Partners, according to BankInfoSecurity. The same article reported headcount rising to 110 from 42 a year earlier. Palo Alto Networks' fiscal 2025 annual report records a purchase consideration of $634.5 million for the company.
Palo Alto Networks now sells the capabilities inside Prisma AIRS. It announced Prisma AIRS on the day it agreed to buy Protect AI, and SiliconANGLE notes the platform covers many of the same use cases as Protect AI's suite.
No Protect AI price list or pricing unit for its former products appears in the reviewed sources. The protectai.com homepage now redirects to Palo Alto Networks' Prisma AIRS page. That page lists token-based API licensing among recent Prisma AIRS product updates.
The open-source ModelScan is available to any team as public code on GitHub. The ModelScan repository describes Protect AI's enterprise-grade model scanning product as offering broader model support and automatic model format detection.
Protect AI delivered software that customers run in their own environments. The Prisma AIRS model scanning page describes API-first integration into build, test and deployment workflows, with scans that run locally so sensitive data stays under the customer's control.
The red teaming and runtime products connect to the customer's own AI systems. The red teaming product offers templates for major public AI platforms and integrations with private endpoints, and runtime security monitors prompts, responses and data flows as applications execute.
Palo Alto Networks sells the capabilities as parts of a larger platform. Its product pages describe model security, red teaming and runtime security as parts of Prisma AIRS, and its completion release describes the combination as spanning development through runtime.
Protect AI's products touch sensitive assets, since they scan an organization's models and inspect live AI traffic. Palo Alto Networks says on its model scanning page that scans run locally and that validation results are logged and retained to support audit and compliance workflows.
Protect AI holds a public role in vulnerability disclosure. The CVE Program lists Protect AI, formerly huntr.dev, as a CVE Numbering Authority whose scope covers Protect AI products and vulnerabilities reported by researchers working with huntr.
Protect AI extended its reach through a model hub, open-source code and a research community. Hugging Face lists Protect AI as a third-party scanner on its Hub, ModelScan is public on GitHub, and huntr runs public AI hacking challenges.
Hugging Face keeps its scanning partnership open to other providers. It invites other organizations to join its security partnership and provide scanning information on the Hub, so other model scanners can also appear there.
Palo Alto Networks now sells Protect AI's capabilities inside its Prisma AIRS platform. Palo Alto Networks describes the combination as bringing together model scanning, posture management, AI red teaming, runtime protection and AI agent security.
Protect AI's founders came from engineering and AI leadership at large technology companies. GeekWire reports they were former engineering leaders at Amazon and Oracle, and that chief executive Ian Swanson previously co-founded Sometrics and DataScience, both later acquired.
The company grew by acquisition as well as hiring. BankInfoSecurity reports Protect AI bought huntr in August 2023 and the attack simulation firm SydeLabs in July 2024, and reached 110 employees.
The founders moved into Palo Alto Networks after the deal. GeekWire reported in 2025 that Swanson became vice president of AI security and that Daryan Dehghanpisheh became the go-to-market lead for AI security in North America.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Palo Alto Networks: Completes Acquisition of Protect AI | official | 2026-09-23 |
| f2 | Palo Alto Networks Announces Intent to Acquire Protect AI | official | 2026-06-14 |
| f3 | BankInfoSecurity on Palo Alto Networks Protect AI bid | press | 2026-09-23 |
| f4 | Business Wire: Protect AI Raises $60M in Series B Financing | press | 2026-06-14 |
| f5 | AI Defense Matrix Catalog entry | other | 2026-06-07 |
| f6 | AI Defense Matrix Catalog mapping | other | 2026-09-23 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.