TL;DR. Alice, the AI security company formerly named ActiveFence, raised $140 million on August 25. The number matters less than the survivor status: between June 2025 and May 2026, five of the category's named independents, Invariant Labs, Protect AI, Prompt Security, Lakera, and Portkey, were acquired by Snyk, Palo Alto Networks, SentinelOne, and Check Point. Securing AI agents at runtime is consolidating into platform security faster than almost any category before it, while research pushes least-privilege into the model itself. What none of the acquirers bought is the part that decides whether an agent's query should run: the context.
On August 25, 2026, Alice announced a $140 million round led by Apax Digital Funds, bringing its total funding to $280 million. Until its rebrand earlier this year the company was called ActiveFence, and its business, adversarial testing and runtime guardrails for AI models, is reportedly approaching $100 million in annual recurring revenue after growing more than 500 percent over two years. Reported valuations range from $700 to 800 million to nearly $1 billion, depending on the outlet.
A nine-figure round for an AI security vendor would have been unremarkable news at any point in the last two years. What makes this one worth reading closely is who was left to raise it. Go down the list of companies that defined runtime security for AI agents, the vendors that inspect what an agent is about to do and block the dangerous cases, and Alice is close to the only scaled one still answering to its own board.
Eleven months, five exits
The category's consolidation has a start date. On June 24, 2025, Snyk acquired Invariant Labs, the ETH Zurich spin-off that discovered and named tool poisoning and MCP rug pulls. Invariant was roughly ten people and about a year old; the researchers who mapped the attack surface were absorbed before the market for defending it had settled.
The rest of the year went the same direction, at larger checks. Palo Alto Networks completed its acquisition of Protect AI on July 22, 2025, for a total purchase consideration of $634.5 million, per its own 10-K. On August 5, 2025, SentinelOne signed a definitive agreement to acquire Prompt Security, whose runtime protection now ships inside the Singularity platform rather than as a product you can buy alone. On September 16, 2025, Check Point announced its acquisition of Lakera, the vendor behind the Gandalf prompt-injection dataset. And on April 30, 2026, Palo Alto came back for a second helping, announcing the acquisition of Portkey, the AI gateway that routes and observes enterprise LLM traffic, and closing it on May 29 into its Prisma AIRS line.
Five exits, and the buyers are not private equity or adjacent startups. They are four of the largest platform security vendors in the world, each attaching agent-security capability to an enforcement point it already owns: Check Point to the network, Palo Alto to its security platform, SentinelOne to the endpoint, Snyk to the developer pipeline.
The runtime AI security category, June 2025 to August 2026: five absorptions, one survivor.
When we argued in June that runtime control over agents had become table stakes, the open question was which vendors would own the layer. The market's answer arrived faster than expected and it was not any of the startups: table stakes get bundled, and bundling favors whoever already has the platform. The threat research was right, AutoJack really did demonstrate that one webpage could reach host-level code execution through an agent. The conclusion the acquirers drew from it was not that a new product category had opened, but that an existing one had grown a new feature.
A strategic check is not a growth bet
Alice's round has a detail that reads differently once you have the timeline above in view: among the new investors, alongside Samsung Electronics, is SentinelOne. The same SentinelOne that bought Prompt Security a year ago is now on the cap table of the last scaled independent in the category.
There are benign readings. Strategic investors take minority positions for partnership access, for visibility into a market, or simply because the return profile looks good. But when every comparable company has already been bought, and one of the buyers of a comparable company shows up as your investor, the position also functions as a seat at a future table. Alice's own asset explains the interest: since 2018 it has accumulated a proprietary dataset of real-world platform abuse, which now powers its model red-teaming and guardrails. Data like that is exactly what an endpoint or firewall vendor cannot rebuild by hiring, which is the same logic that priced the five acquisitions.
None of this says Alice sells. Approaching $100 million ARR at 500 percent growth is the profile of a company that can stay independent if it wants to, and its frontier-lab customer base gives it a franchise the platform vendors do not have. The observation is narrower: the category has consolidated to the point where a single funding round is legible as positioning, and everyone involved knows it.
The squeeze from below
While the platform vendors were buying the interposition layer, the research community started asking whether some of its job could move into the model. A paper from Purdue University Northwest posted this month post-trains a 4-billion-parameter model to exercise task-conditioned authority in executable terminal and MCP environments: instead of a proxy deciding after the fact whether an action exceeds what the task needed, the model is trained to not request the excess authority in the first place, with deterministic verifiers auditing every action, before execution and again from its observed effects, and scoring excess privilege separately from task success.
The protocol layer is absorbing another slice. The MCP maintainers' current roadmap, published August 22, commits to finalizing proof-of-possession tokens, an opinionated path for agent identity through workload identity federation, and a client registration model built for agents running as cloud workloads whose user is not present. Auth binding and workload identity are precisely the features third-party inspection vendors assumed they would differentiate on. When the protocol's own cache design was the vulnerability, the fix landed in the spec, not in a product.
Both developments deserve their caveats. A model trained toward least privilege is a probabilistic control: it shifts a distribution, and on any single request it guarantees nothing, which is why the paper measures excess-authority rates rather than claiming their elimination. Protocol auth hardens who an agent is, not whether what it wants to do is acceptable. Neither replaces enforcement. What both erode is the premium for buying enforcement as a standalone product, because a control that the model half-implements and the protocol half-specifies is a feature, and features accrue to platforms. The acquisitions above and the research here are the same squeeze applied from opposite ends.
What the acquirers did not buy
Look at what the five deals have in common. Each one attaches inspection to a vantage point: network traffic, endpoint telemetry, LLM API calls in flight, code and dependencies. From any of those positions you can see the shape of what an agent does, match signatures, block known-bad patterns, and increasingly you can do it with the acquirer's full threat-intelligence budget behind you. That is real capability, and teams running agents get more of it, cheaper, bundled into platforms they already pay for.
What none of those vantage points can see is what the data underneath means. An inline inspector can catch an exfiltration pattern or a prompt-injection payload. It cannot know that joining this table to that one crosses a data-use boundary, that the column an agent is about to read is owned by a team that never approved this workload, or that the approval the agent is executing under was granted against a schema that has since changed. Those are not signatures. They are facts about the data estate, and they live in whatever layer holds the estate's semantics: what each table is, who owns it, what policy binds it, how fresh and how trustworthy each piece of it is right now.
The consolidation, in other words, settled who owns the checkpoint and left open what the checkpoint knows. Two days ago we walked through the same dynamic in the agent state layer, where the absorbing platforms were foundation labs and the exposed asset was your agents' memory. The security version has a sharper edge: when a state vendor is absorbed you lose portability, while an absorbed enforcement vendor changes which party decides what your agents may do, and on what information that decision gets made.
If your agents touch production data
Three practical consequences follow for teams putting agents against databases now.
First, stop evaluating standalone runtime AI security products as if the standalone category will exist at renewal time. The base case, on this timeline, is that the capability arrives bundled in a platform you already run. The exit-continuity questions we posed for state vendors apply unchanged here: what does the contract say about acquisition, do your policies and rules export in a format anything else can read, and does the product survive as a product, or does it become a checkbox in someone's platform SKU the way Prompt Security became part of Singularity.
Second, put the controls you cannot afford to lose at the boundary that does not churn. Vendors above the database get bought and repriced; the database's own enforcement does not. Scoped roles, short-lived credentials, approvals that re-validate at execution time, and query-level audit all keep working identically whichever logo ends up on the inspection proxy above them. A control you rent from a vendor is a subscription; a control enforced by your own infrastructure is a property of the system.
Third, watch what Alice does with the money, because it now carries the category's counterfactual. If the last scaled independent can compound at frontier-lab customers and platform-vendor pricing without selling, runtime AI security remains a market. If it follows the other five, the market closes, and the interesting questions move permanently to the layers the platforms did not buy: the model's own restraint below, and the data's own governance above.
Where Datapace fits
Datapace is building the context layer between your databases and your AI: resolved meaning validated by the people who own the data, the workload evidence beside it (cost, performance, usage and freshness, lineage), and a policy gate over what an agent may do and access, served over MCP. The five acquisitions above bought vantage points; the quality of any decision made from a vantage point is bounded by the context available to it, and the context about what your data means, who owns it, and what policy binds it is precisely what no firewall, endpoint, or pipeline vendor acquired this year, because it was never theirs to buy. It has to be resolved from your own estate. If you are deciding which controls around your agents should outlive this consolidation cycle, book a call.
Sources
- SecurityWeek, Alice Raises $140M to Expand AI Model Defenses and Enterprise Guardrails, August 25, 2026 (round, lead investor, SentinelOne and Samsung participation, ARR, growth rate, ActiveFence history).
- Calcalist, Alice raises $140 million at $700-800 million valuation, August 2026.
- SiliconANGLE, Alice raises $140M as its AI security business grows more than 500%, August 25, 2026 (Bloomberg valuation figure).
- Snyk, Snyk Acquires Invariant Labs to Accelerate Agentic AI Security Innovation, June 24, 2025.
- Palo Alto Networks, Form 10-K, fiscal year 2025 (Protect AI acquisition completed July 22, 2025; total purchase consideration $634.5 million).
- SentinelOne, SentinelOne to Acquire Prompt Security, August 5, 2025.
- Check Point, Check Point Acquires Lakera to Deliver End-to-End AI Security for Enterprises, September 16, 2025.
- Palo Alto Networks, Palo Alto Networks to Acquire Portkey, April 30, 2026, and completion announcement, May 29, 2026.
- Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents, arXiv:2608.18351, August 2026.
- Model Context Protocol maintainers, MCP roadmap, August 22, 2026 (DPoP, workload identity federation, client identity metadata).