The Perimeter Is Now a Prompt: Security After AI

Thesis: Security budgets don’t shrink, they reallocate — to AI-native defense

The last decade’s “cloud-first” security stack is colliding with an AI software cycle that generates new surfaces faster than humans can defend: agents calling other agents, LLM-connected apps, synthetic media, and crypto rails moving value in real time. The pattern across programs is clear: the next security leaders embed into developer workflows, automate compliance and triage with agents, and operate on top of data and identity planes — not just at the network edge. YC’s portfolio shows the arc: from early bot/fraud defense to API and confidential computing, and now to agentic SOCs and deepfake detection.

The landscape: real companies, real sub-patterns

• Cloud, APIs, and confidential compute are the new backbone. Salt Security maps APIs and AI-enabled workflows — down to agents and MCP servers — and enforces policy in production. Infisical unifies secrets, certs, and privileged access for developers and AI agents. Anjuna pushes data security into the runtime with confidential computing and private AI. Newer entries like Casco bring autonomous, year-round testing to web, API, infra, and AI systems, and Escape turns offensive security into an always-on, business-logic-aware capability.

W16

Salt Security

Protects organizations from getting breached through their APIs.

ActiveB2B200 ppl

W23

Infisical

Unified platform for secrets, certs, and privileged access management

ActiveB2B50 ppl

W18

Anjuna

Anjuna enabled organizations to trust any infrastructure

ActiveB2B55 ppl

• Agentic operations: the SOC runs on playbooks and autonomous workers. ContraForce orchestrates AI agents across Microsoft Sentinel/Defender tenants so MSPs/MSSPs can triage and respond without ballooning headcount. Agency positions AI agents as forward-deployed security and compliance engineers. On the endpoint, idemeum governs applications and privileges with AI to collapse ticket volume.

S21

ContraForce

Security Delivery Platform to orchestrate AI agents for Service…

ActiveB2B15 ppl

W22

Agency

Agency replaces traditional security and compliance headcount with AI.

ActiveB2B50 ppl

S21

idemeum

AI-powered Application Control

ActiveB2B10 ppl

• Trust, safety, and the synthetic media crisis. The generator–detector dynamic is fully here: D-ID accelerates creation of realistic AI personas and live avatars — a capability enterprises want for content but that also expands impersonation risk. Defenders answer in kind: Reality Defender brings enterprise deepfake detection via API, while Cinder provides agent-based moderation and abuse infrastructure for AI-powered platforms. Meanwhile, legacy in-app fraud stacks like Castle remain essential at the edge.

W22

Reality Defender

Enterprise Deepfake Detection

ActiveB2B54 ppl

W22

Cinder

Infrastructure to protect companies from AI abuse

ActiveB2B30 ppl

S17

D-ID

Enable creators and developers to generate realistic AI personas

ActiveB2B27 ppl

• Compliance, revenue enablement, and buying center expansion. The compliance wedge remains potent: Vanta industrialized continuous GRC; Oneleet and Feroot Security automate frameworks from SOC 2 to PCI/HIPAA. Deal acceleration tools like Skypher automate security questionnaires, while acquired SafeBase proved trust centers are a scalable way to offload customer security reviews.

W18

Vanta

Vanta—the proven leader in automated compliance helping startups…

ActiveB2B700 ppl

S22

Oneleet

YC's most popular security compliance platform (SOC 2, ISO 27001,…

ActiveB2B60 ppl

W20

Skypher

AI agent for Compliance Questionnaires Automation

ActiveB2B12 ppl

S20

SafeBase

Trust Center platform that scales customer security reviews

AcquiredB2B60 ppl

• Financial crime, crypto, and programmable trust. TRM Labs fuses blockchain intelligence with investigations and an emerging disruption network. Notabene coordinates Travel Rule compliance and counterparty verification for global, stablecoin-enabled payments. Quantstamp remains a keystone for Web3 security audits, while Variance applies AI agents to fraud investigations with full audit trails.

S19

TRM Labs

TRM is building a safer financial system for billions of people.

ActiveB2B250 ppl

S20

Notabene

The Notabene platform is the trust layer for global money movement.

ActiveB2B47 ppl

W18

Quantstamp

Security auditing for Web3

ActiveB2B80 ppl

W23

Variance

AI Agents for Fraud Review and Investigations

ActiveB2B12 ppl

• Devices, privacy, and human risk. AI-era device sprawl meets compliance via Swif.ai for unified MDM. Consumer privacy gets a power tool in Optery to remove personal data from brokers, and Malloc Inc detects spyware on mobile with an AI-driven approach. Workforce risk is durably human; Riot automates awareness and simulations to keep fast-growing teams out of the news.

W22

Optery

Opt out software that removes your private info from the internet

ActiveB2B55 ppl

S21

Malloc Inc

AI-driven mobile cybersecurity

ActiveB2B10 ppl

S20

Swif.ai

The guardrail for AI on every device

ActiveB2B20 ppl

W16

Castle

Block bots & bad behavior

ActiveB2B20 ppl

Physical and facility layers aren’t exempt: Ambient.ai unifies access control, monitoring, and incident response with an AI reasoning layer, while Munily centralizes building security and operations in LATAM — the same “always-on visibility” principle applied to the physical graph.

Batch cohorts: when the bet concentrated

• Winter 2018 was a fulcrum: Sqreen, Vanta, Anjuna, and Quantstamp together read as a deliberate bet on application security, continuous compliance, confidential compute, and crypto safety — a cohesive stack for cloud-first enterprises.
• Winter 2022 heated the AI abuse and privacy frontier: Reality Defender, Agency, Cinder, Optery, and Munily framed the “AI-as-attacker” era and the need for agentic defense and consumer privacy.
• Summer 2021 clustered agentic SOC and endpoint control: ContraForce, idemeum, and Malloc Inc all leaned into AI-driven response and endpoint autonomy.
• The early guardrails were laid in 2015–2016: Smyte, Cymmetria, ThinAir, Castle, and Salt Security — bots, deception, data, and APIs — forecasting today’s adversarial, app-centric world.
• Winter 2023 shows the offensive/identity synthesis: Infisical, Escape, and Variance. And the theme isn’t cooling: Summer 2024’s Clearly AI pushes automated security/privacy reviews deeper into the buyer’s workflow, while Spring 2025’s Casco makes autonomous testing year-round.

Shared characteristics of the emerging winners

• AI-native, not AI-bolted-on: platforms like Cyble, ContraForce, and Agency use agents to operate programs, not just analyze alerts.
• Developer-embedded distribution: Infisical, Escape, and even Termius meet engineers where they work — vaults, CI, and SSH — reducing procurement friction.
• Compliance as GTM wedge to revenue: Vanta, Oneleet, Feroot Security, and Skypher convert “checkbox costs” into revenue accelerants.
• Network effects in risk: TRM Labs and Notabene improve with every integration and case; Quantstamp compounds expertise across audits.

What’s working — and what isn’t

• Evidence of outcomes: acquisitions validated multiple approaches — Sqreen, SafeBase, Templarbit, Cymmetria, Smyte, and Clickfacts. These exits spanned appsec, trust center ops, deception, abuse, and ad-fraud — the market pays for reduced risk and faster sales.
• Casualties teach the edges: Datree (Kubernetes misconfiguration control) and ThinAir (data security) are inactive — signals that narrow controls without adjacent automation or distribution can stall.
• Adaptations matter: many contenders explicitly pivoted or renamed — Salt Security, Riot, Upfort, D-ID, Cyble, Canix, Swif.ai, Castle, Variance, Escape, Malloc Inc, Anjuna, and Agency. In security, evolution is a feature, not a bug.

Risks and tarpits

• Point-tool purgatory: buyers drown in vendors. Products without strong adjacent surfaces (identity, data, runtime) struggle.
• AI false positives and explainability: agentic SOCs like ContraForce and investigative tools like Variance win only if they’re auditable and enforce SOPs.
• Compliance commoditization: platforms such as Vanta, Oneleet, and Clearly AI must keep moving up-stack to risk, not just reports.
• Adversarial ML and synthetic media: detectors like Reality Defender fight a moving target as generators advance.
• Regulatory volatility on-chain: TRM Labs, Notabene, and Quantstamp must thread global policy shifts while scaling networks.

Why now — and the outlook

AI has collapsed attacker costs. The response must be software-speed defense: autonomous testing (Casco), runtime-embedded controls (Salt Security, Anjuna), identity-first protection (Infisical, idemeum), and agentic operations (Agency, ContraForce). Budget reallocation favors platforms that both reduce risk and unblock revenue — trust centers (SafeBase), questionnaire automation (Skypher), and continuous GRC (Vanta, Oneleet).

The next category leaders will unify three planes: identity (who and what is acting), data (what’s sensitive and where it flows), and automation (agents executing policy). YC’s cross-batch signal is that this unification is underway. In a world where the perimeter is a prompt, the durable moats will be agentic execution, developer-native distribution, and networks that get smarter with every event.