Before there was a kitchen table in London, there was a desk at BAE Systems Detica. Paterson had finished a first-class MEng in computer science at the University of Bristol and gone, like a lot of bright British engineers in the late 2000s, into defence consulting. His title was International Propositions Manager. The translation: he sold big-data risk projects to FTSE 100 companies and the kind of government clients you do not list on a CV. He learned what threat intelligence actually looks like before threat intelligence had a market.
The Digital Shadows years
The co-founder was James Chappell. They had worked together at Detica and decided, in 2011, that the open internet had become a hostile place for any company that did not know what was being said about it on the parts of the network it did not own. Digital Shadows began as a service: humans reading forums and pastebins for clients who could not. It became a product, SearchLight, in 2014, after the first venture round. By 2015 Paterson had moved to the Bay Area to open the US office, and Financial News had named him one of the forty most influential people in European FinTech. Computer Weekly had called him a rising star two years earlier.
Bootstrapping for four years before raising matters to him. It still shapes how he runs companies. Harmonic's seed-to-Series-A path looks lavish on paper, but everyone who has worked with him will note the same thing: the headcount stayed deliberately small for the first product release, and the company shipped to revenue before scaling go-to-market.
The eighteen-month gap
After the ReliaQuest acquisition closed in July 2022, Paterson spent the next year doing what successful founders are not supposed to admit doing: he watched. He had a thesis forming. The thesis was that the same dynamic that produced shadow IT in 2010 - employees adopting tools faster than security teams could write policies for them - was now producing something worse. The tools were not Dropbox and Slack. The tools were models that ingested whatever you fed them and used it, sometimes, to train. He started talking to CISOs. The conversations were repetitive in a way that founders learn to recognise as a market.
Harmonic and the heretical idea
The product Bryan Woolgar-O'Neil and Paterson built together is not a chatbot blocker. It is a set of small, purpose-built language models that sit between an employee and any AI tool they choose to use, including unsanctioned ones. The models classify what is about to be shared - is this a customer record, a piece of legal language, a credential, a healthcare identifier - and if it is sensitive, the system interrupts with a nudge. Not a block. A nudge. "Are you sure? Here is a sanctioned way to do this." If the employee insists, the system can escalate. If they reconsider, no policy was triggered, no ticket was filed, no shame was issued.
The bet is that coaching scales. Paterson likes to point out that pure blocking does not catch everything and frustrates the people you are trying to protect, who then forward the document to a personal email account and the problem is now invisible. He has been making this argument since Digital Shadows. The audience has finally caught up.
The British operator in San Francisco
Paterson sits on the board of GBx, the network of British founders working out of the Bay Area, and is a member of Founders Pledge. He has mentored at CyLon, Europe's first cybersecurity accelerator. In a Computer Weekly interview he argued that British security chiefs are "too polite" for startups - that CISOs need to give sharper feedback to founders and founders need to take it. It was an unflattering thing to say about his own peer group. It was also correct, which is why the headline travelled.
What he is working on now
Harmonic's product is in active use by thousands of employees across customer companies. The company was an RSA Innovation Sandbox finalist in 2024. The team is roughly split between San Francisco and the United Kingdom, with engineering weighted toward London. Paterson talks publicly about three things: the gap between AI adoption and AI governance, the failure of legacy data-loss prevention, and the specific risks of healthcare-sensitive data ending up in chat windows. He is building, in other words, the same company he built the first time - identify a shadow risk, build the tool the existing vendors are too slow to build, sell it to security leaders who are tired of being the people who say no.
