top of page
Business & Enterprise
Cybersecurity
Cybersecurity Software
Protect AI
Won an AI-security position by covering the full machine-learning lifecycle—model scanning, supply-chain research, LLM defense, and red teaming—then sold that breadth into Palo Alto Networks for about $700 million, despite Microsoft, Google, and Cisco entering AI security.
1
MODEL
BUSINESS MODEL
SaaS
- Founded in 2022 by Ian Swanson and Daryan Dehghanpisheh; positioned Protect AI as a purpose-built security platform for AI and machine-learning systems.
- Built Model Scan to detect unsafe serialized ML models and address supply-chain risk before deployment.
- Acquired Huntr in 2023, creating an AI/ML bug-bounty community with more than 17,000 security researchers and a proprietary vulnerability intelligence engine.
- Acquired Rebuff and Laiyer AI in early 2024 for prompt-injection and LLM firewall capabilities, then acquired SydeLabs in July 2024 for AI red teaming, rebranded as Recon.
- Packaged the capabilities into Guardian, Radar, and Recon; LLM Guard remained available as free, self-hosted open-source software to drive developer adoption.
- Raised $35 million Series A in 2023 and $60 million Series B in 2024 at a reported $400 million valuation, bringing total funding to $108.5 million before Palo Alto Networks acquired the company.
1. Identify a new technology layer that creates security, compliance, or operational risk before enterprises have internal expertise.
2. Start with the highest-risk, most measurable vulnerability—such as unsafe models, insecure dependencies, or exposed data.
3. Build a free developer tool or community asset that creates adoption and generates proprietary threat intelligence.
4. Expand into adjacent risks only when they share the same buyer, data model, and deployment workflow.
5. Package point capabilities into a lifecycle platform once each component proves standalone value.
6. Use acquisitions to buy specialized capability faster than building it, but integrate the data and workflow into one platform.
7. Avoid becoming a collection of disconnected security tools; the platform must produce one shared risk view. The common mis-build is acquiring capabilities without integrating their telemetry, policies, and workflows.
DISTRIBUTION MODEL
Protect AI began with AI and machine-learning supply-chain security, then expanded only where the same security buyer and lifecycle needed coverage: Huntr for vulnerability research, Rebuff and Laiyer for LLM defense, and SydeLabs for red teaming. This created a broader MLSecOps platform rather than a single point product. The strategy made Protect AI attractive to Palo Alto Networks, which agreed in April 2025 to acquire it for $700 million in cash and replacement awards; the deal closed in July 2025.
HOW THEY BUILT IT
HOW TO ARCHITECT IT
Product-Led Growth, Community-Led, Partnerships, Enterprise Sales
HOW THEY OPERATIONALIZED
HOW TO REPLICATE WHAT WORKED
dm
- LLM Guard’s free, self-hosted open-source toolkit reached AI developers and security engineers before enterprise purchase.
- Huntr attracted security researchers and generated vulnerability intelligence that strengthened Protect AI’s credibility with enterprises.
- Model Scan and Guardian integrations reached ML and platform teams responsible for deploying models.
- Hugging Face ran Guardian on its Hub through a partnership, giving Protect AI exposure to developers scanning models and datasets.
- Enterprise sales targeted CISOs, AI platform teams, and ML engineering leaders; Palo Alto Networks later provided enterprise security distribution.
What worked: Use a free developer tool and community research asset to build credibility, then convert that trust into an enterprise platform sale.
Trap if copied blindly: Community-led distribution fails if the free tool does not generate proprietary data, qualified enterprise demand, or a clear upgrade path; it becomes a support burden rather than an acquisition engine.
| PATTERNS OF THIS MODEL
PATTERNS IN EMERGING-RISK SECURITY PLATFORMS:
1. NEW TECHNOLOGY CREATES A SECURITY VACUUM. When enterprises adopt AI, cloud, or automation faster than they build controls, specialized vendors can define the risk category before incumbents respond.
2. COMMUNITY INTELLIGENCE BECOMES PROPRIETARY DATA. Bug bounties, researcher networks, and open-source telemetry create threat data that improves detection and enterprise credibility.
3. LIFECYCLE BREADTH INCREASES ACQUISITION VALUE. A vendor covering development, deployment, runtime, and adversarial testing is more strategic than a single scanner or firewall.
THE WEAKNESS: Security platforms can become acquisition-heavy and integration-poor; if products retain separate data models and workflows, the promised lifecycle view does not materialize.
What companies with this model reveal
| OPPORTUNITY INTELLIGENCE
GOLDMINE 1 — AGENTIC-AI SECURITY. Agents that browse, call tools, move money, and access systems need permission-aware guardrails, action audit trails, and containment; this remains less mature than prompt filtering.
GOLDMINE 2 — AI SUPPLY-CHAIN ASSURANCE. Enterprises need continuous verification of models, datasets, dependencies, and fine-tuning pipelines; point scans do not solve ongoing provenance and drift.
GOLDMINE 3 — SECURITY-AS-CODE FOR AI WORKFLOWS. The gap is policy-as-code that travels with an AI application from development through deployment and runtime, rather than a separate security review.
THE PIT — POINT-PRODUCT COMMODITIZATION. Prompt filters, model scanners, and red-teaming tools are rapidly becoming features of cloud providers, model vendors, and security platforms.
THE SECOND PIT — ACQUISITION WITHOUT INTEGRATION. Buying a scanner, firewall, and red-teaming tool does not create a platform unless telemetry, policies, and workflows converge.
MOVE WITH CAUTION — Do not build an AI-security company solely around today’s prompt-injection threat; model providers and cloud platforms can bundle that control, while agent, data, and supply-chain risk offer deeper, more durable problems.
Untapped Business Model / Gaps / Goldmines / Pits
Patterns & Insights
2
MARKET
mkt mt es
Protect AI entered when enterprises adopted AI and machine learning without a mature security category for models, datasets, pipelines, and LLM applications. Traditional application security focused on code and APIs; cloud security focused on infrastructure. Protect AI named and educated the market around MLSecOps, then expanded the frame to include LLM security and red teaming. This category creation gave it a distinct position before Palo Alto Networks acquired it.
MARKET TYPE
Emerging Market
ENTRY STRATEGY
Greenfield Entry
WHY THEY WON
AI security was an Emerging Market: demand was growing quickly, but buyer education, standards, and product boundaries were still forming. Protect AI exploited the gap between rapid AI adoption and immature security practice. It built category language around MLSecOps, acquired specialized capabilities, and used community research to establish credibility. The lesson is that an emerging market rewards the vendor that defines the risk taxonomy and assembles the full lifecycle before buyers default to incumbent security suites.
EXECUTION
Protect AI entered by creating a security category for AI and machine-learning systems rather than replacing an incumbent security product. It targeted enterprises deploying ML models and, later, generative-AI applications. The critical bet was that security teams would buy specialized AI risk coverage before general security platforms fully absorbed the need. The prerequisite was credible vulnerability research, developer trust, and a clear lifecycle view; the approach became vulnerable as Microsoft, Google, Cisco, and Palo Alto Networks added native AI-security capabilities.
FOOTHOLD STRATEGY
Beachhead Strategy
Protect AI’s initial beachhead was enterprises deploying machine-learning models that needed to identify unsafe models, dependencies, and supply-chain vulnerabilities. They were reachable through ML engineering, security, and open-source communities; they could pay because model supply-chain risk created compliance, IP, and operational exposure. Protect AI solved the job of scanning and securing models before deployment. The path outward was from model scanning to LLM defense, red teaming, and full AI-security governance.
GROWTH CAMPAIGN
CAMPAIGNS THAT WORKED
SO WHAT: Protect AI’s strongest campaign was community-led category education: Huntr and LLM Guard made the company credible to the practitioners who would later influence enterprise security purchases.
KEY LEARNING: In an emerging risk category, the vendor that teaches the market how to think about the risk often defines the buying criteria.
HOW TO USE: Publish a clear risk taxonomy, offer a free tool that exposes the risk, and use the resulting community and telemetry to establish enterprise credibility.
KEY LEARNING
THE STANDARD: In an Emerging Market, the entrant wins by defining the risk, educating buyers, and assembling a lifecycle solution before the category consolidates.
RULE 1 — NAME THE RISK PRECISELY: Buyers cannot purchase a category they cannot describe.
RULE 2 — BUILD EVIDENCE THROUGH COMMUNITY: Researchers, open-source users, and vulnerability data create credibility faster than advertising.
RULE 3 — ASSEMBLE THE LIFECYCLE: Development, deployment, runtime, and adversarial testing must converge into one risk view.
RULE 4 — FAILURE MODE: An emerging-market entrant fails if it remains a set of point tools while cloud and security incumbents bundle adequate controls.
MARKET TYPE: Emerging Market (category).
gc
Market Context
| MARKET INTELLIGENCE
PATTERNS IN COMMUNITY-LED SECURITY DISTRIBUTION:
1. OPEN-SOURCE TOOLS CREATE PRACTITIONER TRUST. Developers adopt the free control first, then influence the enterprise purchase.
2. RESEARCHER COMMUNITIES GENERATE PROPRIETARY SIGNAL. Bug bounties and vulnerability reports create threat intelligence and credibility.
3. PLATFORM PARTNERSHIPS EXTEND REACH. Integrations with hubs, clouds, and security platforms place the product inside existing workflows.
4. THE WEAKNESS: Community-led security distribution can attract researchers and hobbyists without enterprise budget, creating support costs without proportional revenue.
| MARKET ENTRY PLAYBOOK
THE STANDARD: Greenfield entry is appropriate when a new technology creates a risk or job that existing categories do not yet own.
RULE 1 — Define the risk in language security and operational buyers both understand.
RULE 2 — Build the minimum credible control and evidence mechanism before broad enterprise selling.
RULE 3 — Use community, open source, or free tooling to create adoption and proprietary signal.
RULE 4 — Reject greenfield entry if the incumbent can absorb the risk into an existing platform before the entrant establishes category ownership.
How to enter
| FOOTHOLD STRATEGY PLAYBOOK
THE STANDARD: A beachhead strategy works when one segment has concentrated risk, reachable buyers, and a clear expansion path.
RULE 1 — Choose the risk with the clearest compliance, financial, or operational consequence.
RULE 2 — Solve one measurable control job before broadening the platform.
RULE 3 — Use the beachhead’s credibility to enter adjacent risks and buyers.
RULE 4 — A beachhead fails when the initial risk becomes a native feature of the underlying platform.
How to get the first strong position
MARKET PATTERNS & PLAYBOOK
3
MONEY
money rev pri
Protect AI had to prove that AI security could scale beyond services and point tools. It combined open-source adoption, Huntr vulnerability intelligence, and enterprise platform contracts into a scalable model: free tools created adoption and data, while Guardian, Radar, and Recon monetized enterprise risk coverage. The model attracted a $60 million Series B in 2024 at a reported $400 million valuation and culminated in Palo Alto Networks’ $700 million acquisition agreement in 2025.
REVENUE MODEL
Subscription, Usage-Based, Service Fee
PRICING MODEL
Custom Enterprise Pricing, Usage-Based Pricing, Freemium
WHY THEY WON
Enterprises paid recurring subscription or license fees for Guardian, Radar, and Recon, with usage tied to models scanned, API requests protected, and red-teaming or scanning volume. Huntr added researcher rewards and vulnerability-intelligence value, while services supported deployment and assessments. Revenue expanded as customers added models, LLM applications, and security workflows; margin depended on research rewards, cloud infrastructure, and enterprise support.
Protect AI used freemium adoption through LLM Guard, then custom enterprise contracts for Guardian, Radar, and Recon. Pricing scaled with the number of models scanned and the volume of API requests protected, aligning cost with the customer’s AI deployment footprint.
TARGET AUDIENCE
AI/ML engineering teams (LLM Guard and Model Scan; want safe model deployment and supply-chain scanning); security teams (Guardian and Radar; want LLM defense, monitoring, and governance); red teams and AI risk leaders (Recon; want adversarial testing and exploit discovery); large enterprises (platform contracts; want lifecycle AI-security coverage).
CUSTOMER BUYING BEHAVIOUR
An enterprise typically begins when AI adoption creates model, data, or LLM security exposure. Security and ML teams evaluate coverage across models, pipelines, prompts, and applications; procurement involves CISO, AI platform, legal, and compliance stakeholders. Adoption often starts with a free tool or scan, then expands into platform deployment.
| PRICING INTELLIGENCE
What makes this model effective & make customers pay
Customers are not buying an AI scanner; they are buying the ability to deploy AI without creating an unmanaged security liability.
RULE 1 — PRICE RISK REDUCTION, NOT SCANS: Enterprises pay to prevent model theft, data leakage, prompt injection, and unsafe deployment.
RULE 2 — USE FREE TOOLS TO CREATE DEMAND: Open-source adoption creates practitioner trust and surfaces enterprise risk.
RULE 3 — PRICE THE AI FOOTPRINT: Models, API calls, and applications are the natural expansion units because they scale with AI adoption.
RULE 4 — WATCH THE REWARD-COST TRAP: Bug bounties and researcher communities create intelligence but also recurring payout and moderation costs; the vendor must convert that signal into enterprise willingness to pay.
The buyer is really buying AI deployment assurance, evidenced by security, AI platform, and compliance budgets.
PRICE & REVENUE
| Revenue Risk - The biggest threat to revenue stability
Incumbent bundling: Microsoft, Google, Cisco, Palo Alto Networks, and cloud providers can add AI-security controls to platforms customers already use.
Category compression: Prompt filtering, model scanning, and red teaming can become features rather than standalone products.
Standards uncertainty: Evolving AI-security regulations and frameworks can shift buyer requirements and force product redesign.
Acquisition-integration risk: Multiple acquired products can create fragmented telemetry and support burden if not unified.
Community economics: Huntr rewards, researcher management, and vulnerability triage create ongoing cost that must convert into enterprise value.
Funding/valuation: Protect AI raised $108.5 million, including a $60 million Series B in 2024 at a reported $400 million valuation; Palo Alto Networks agreed in April 2025 to acquire it for $700 million in cash and replacement awards, and the acquisition closed in July 2025. Current standalone ARR was not publicly disclosed.
Where the model can break
4
MOTION
motion ge cs
Protect AI used partnerships and community assets to reach AI builders and security buyers. Hugging Face ran Guardian on its Hub, exposing Protect AI to developers scanning models and datasets; Huntr created a researcher network of more than 17,000 participants; and Palo Alto Networks ultimately provided enterprise security distribution after acquiring the company. These partnerships reduced the need for Protect AI to build every route to market independently.
GROWTH EXPANSION MODEL
Acquisition-Led Growth, Product Line Expansion
HOW THEY EXPAND
Protect AI expanded through acquisitions and product-line expansion. It acquired Huntr for AI/ML vulnerability research, Rebuff and Laiyer for prompt-injection and LLM firewall capabilities, and SydeLabs for red teaming. These acquisitions expanded Protect AI from model scanning into LLM defense, adversarial testing, and lifecycle security. The strategy increased platform breadth and made the company strategically valuable to Palo Alto Networks, which acquired it in 2025.
COMPETITIVE STRATEGY
First-Mover Advantage
HOW THEY COMPETE
Against Microsoft, Google, and Cisco, Protect AI moved earlier into AI-specific security and assembled lifecycle coverage before those incumbents fully packaged comparable controls. Against Robust Intelligence, Lakera, HiddenLayer, and TrojAI, it differentiated through Huntr’s researcher community and broader MLSecOps scope. Its constraint was that incumbents could bundle AI security into existing cloud and security platforms with far larger distribution.
GROWTH ENGINE
GTM
Content Flywheel
An AI developer adopts LLM Guard or Model Scan → identifies a model, dependency, or prompt risk → shares findings or participates in Huntr → Protect AI gains vulnerability intelligence and credibility → security and ML leaders evaluate Guardian, Radar, and Recon → the enterprise deploys platform controls across more models and applications. The loop compounds when community findings improve detection and enterprise deployments generate more telemetry. It requires useful free tooling, fast vulnerability triage, and a clear enterprise upgrade path; it breaks if the community produces cost without proprietary signal or if the platform remains fragmented.
Protect AI ran a community-led, partnership-amplified GTM with enterprise sales for platform contracts. LLM Guard and Model Scan created developer adoption; Huntr built researcher credibility and threat intelligence; Hugging Face extended distribution; enterprise sales converted AI risk exposure into Guardian, Radar, and Recon contracts. The primary motion was community-led adoption, with enterprise sales converting that trust into platform revenue. The transferable implication is that an emerging-risk vendor should build practitioner trust before selling enterprise governance.
SUSTAINING MOATS
High Customer Lock-In
moat
The moat is Protect AI’s accumulated AI-risk intelligence: vulnerabilities from Huntr, model and dependency telemetry from scans, prompt and LLM attack patterns, and red-team findings. This data improves detection and makes the platform more valuable as customers deploy more AI systems. The moat weakens if the company cannot integrate acquired products or if cloud and model providers generate comparable security telemetry at scale.
| MOAT INTELLIGENCE
THE STANDARD: A data moat lasts when the platform captures proprietary risk signals that improve future protection.
RULE 1 — COMMUNITY-GENERATED INTELLIGENCE: Huntr’s researcher network created vulnerability data before threats became public.
RULE 2 — LIFECYCLE TELEMETRY: Model scans, LLM traffic, and red-team results create a broader risk picture than point tools.
RULE 3 — PLATFORM INTEGRATION: Unified policies and telemetry increase switching cost across AI development and deployment.
THE SIGNAL: Protect AI combined Huntr’s 17,000+ researcher community, Hugging Face distribution, and acquisitions of Rebuff, Laiyer, and SydeLabs into a platform that Palo Alto Networks acquired for $700 million in 2025. The moat does not protect against fragmented products, commoditized point controls, or incumbents with superior distribution.
Why this company remains defensible
ARR & TAKEAWAY
ARR Journey - what to do at each stage
PRE-$1M ARR — DEFINE AI-SPECIFIC RISK. From 2022, Protect AI positioned around MLSecOps and model supply-chain security rather than generic application security. WATCH: buyer education and category clarity.
$1–5M ARR — BUILD THE RESEARCH ASSET. Huntr created an AI/ML bug-bounty community and proprietary vulnerability signal. WATCH: researcher cost and conversion to enterprise demand.
$5–10M ARR — ADD LLM DEFENSE. Rebuff and Laiyer extended Protect AI from model scanning into prompt-injection and LLM firewall capabilities. WATCH: product integration and developer adoption.
$10–50M ARR — ASSEMBLE THE LIFECYCLE PLATFORM. The SydeLabs acquisition added Recon red teaming; Guardian, Radar, and Recon formed a broader AI-security platform. WATCH: integration quality and enterprise sales readiness.
$50–100M ARR — PROVE STRATEGIC VALUE. Protect AI raised $60 million in 2024 at a reported $400 million valuation and attracted Palo Alto Networks’ $700 million acquisition agreement in 2025. WATCH: incumbent bundling and category consolidation.
$100M+ ARR — NOT REACHED as a publicly disclosed standalone milestone; Palo Alto Networks acquired Protect AI in July 2025, and its standalone ARR was not disclosed.
Rule: Define the new risk, build community-generated evidence, then assemble a lifecycle platform before incumbents bundle the category.
COPY PLAYBOOK : What Worked → What Failed → What to Replicate → What to Avoid
THE STANDARD: Define an emerging risk, build community-generated evidence, then assemble a lifecycle platform before incumbents bundle the category.
SEQUENCE:
1. Identify a new technology layer that creates unmanaged security, compliance, or operational risk.
2. Build a free tool or community asset that exposes the risk and generates proprietary signal.
3. Solve the highest-consequence control job before broadening the platform.
4. Acquire or build adjacent capabilities only when they share the same buyer, data model, and workflow.
5. Package the capabilities into one lifecycle view before pursuing large enterprise contracts.
WORKED: Protect AI used Huntr, LLM Guard, and Model Scan to build credibility, then acquired LLM defense and red-teaming capabilities to form a broader AI-security platform.
CAUTION: Do not acquire point products without integrating their telemetry and workflows; also avoid building around a single threat that the underlying platform provider can bundle.
bottom of page