A $100 million funding round for an AI security company is not a sign that AI security is a solved problem. It is a sign that most of us building bots have been shipping something closer to an open door than a product. That is the uncomfortable read on HiddenLayer’s Series B, and I think it is the correct one.
The mainstream take goes something like this: enterprises are maturing, budgets are opening up, a serious vendor category is forming, everybody wins. Fine. But the money follows the pain, and the pain here is that agentic systems went into production faster than anyone built the guardrails for them. HiddenLayer raised $100 million because a lot of very large companies looked at what they had already deployed and got nervous.
What the round actually tells us
HiddenLayer builds tools that protect AI models, agents, and workflows from adversarial attacks, vulnerabilities, and malicious code injections. The Series B came from Delta-v Capital, Ten Eleven Ventures, Morgan Stanley, Microsoft’s M12, Booz Allen Hamilton, and others. That investor list is the interesting part. M12 means the biggest AI platform vendor sees a gap its own stack does not close. Booz Allen means government and defense buyers are asking questions that need answers today. Ten Eleven Ventures is a security specialist, and Morgan Stanley is not known for funding hobby projects.
When strategic money from a cloud platform, a defense integrator, and a security-focused fund lands in the same round, the read is that enterprise AI security is being treated as procurement, not research. Someone has a line item for this now.
The part that hits builders like us
Here is where I get to be self-critical, because I have written plenty of bots that would not survive a serious review. The threat categories HiddenLayer targets map almost perfectly onto the shortcuts we take when we are moving fast:
- Adversarial attacks. Every time I pipe user text straight into a prompt template, I am trusting a stranger to behave. Prompt injection is not exotic. It is the default outcome of concatenating untrusted input with instructions.
- Model vulnerabilities. How many of us pull a model artifact off a hub and load it without checking what format it is in or what it can execute on load? I have done it. Twice this month.
- Malicious code injection. This is the agentic one. The second your bot can call a shell, hit an internal API, or write to a database, a successful injection stops being embarrassing and starts being expensive.
The reason a company can raise nine figures to solve this is that the problem is not hypothetical. It is sitting in production at thousands of companies right now, wearing a friendly chat interface.
Why tooling caught up so late
Traditional application security assumes deterministic behavior. You define valid input, reject the rest, and test your way to confidence. AI systems break that assumption on purpose. The input space is natural language, which is to say infinite, and the same input can produce different outputs on different runs. You cannot write a regex for “convince the model to ignore its system prompt.”
So the security tooling had to be rebuilt around model behavior rather than code paths, and that took time. Meanwhile, everyone shipped anyway. The gap between deployment and defense is exactly the space a vendor raising $100 million steps into.
What I am changing in my own builds
You do not need an enterprise contract to close the most obvious holes. A few things I now treat as non-negotiable:
- Treat every model output as untrusted. If the model produces a command, a URL, or SQL, validate it before it touches anything real. Parameterized queries, allowlists for endpoints, no shelling out to a string.
- Scope your tools narrowly. An agent with one tool that reads three specific tables is safer than an agent with database access and good intentions.
- Log the full interaction chain. Prompt, retrieved context, tool calls, outputs. When something goes wrong, you need to see which link failed.
- Separate instructions from data structurally. Use whatever your framework gives you for role separation instead of gluing everything into one string.
- Verify model artifacts. Check the source, check the format, prefer formats that do not execute arbitrary code on load.
The takeaway
I read this round less as a milestone for the AI security market and more as a receipt. Enterprises rushed AI into production, discovered the attack surface afterward, and are now paying to patch it. Those of us building smaller bots have the same exposure at a smaller scale, minus the budget.
The good news is that most of the fixes are architectural rather than expensive. Narrow permissions, validated outputs, honest logging. Boring work. It is the boring work that keeps your bot from becoming somebody else’s tool.
🕒 Published: