The most revealing thing about Chris Sestito’s company is that it began after the emergency was over. In 2019, at the cybersecurity company Cylance, an adversarial research group found a way to fool the machine-learning model behind its Windows malware defense. This was not the customary intrusion, with a stranger rattling doors and stealing a password. The model itself had become the thing to study, imitate and evade. Sestito, then leading threat research, and colleagues Jim Ballard and Tanner Burns helped answer the attack. They fixed what had to be fixed. Then they looked at one another and saw an industry-sized problem hiding inside a company-sized incident.
Cybersecurity has a habit of turning yesterday’s exotic trick into tomorrow’s tedious line item. Sestito’s wager was that attacks on artificial intelligence would follow the same path. Models were already making consequential choices inside antivirus products, fraud systems and business software. If an attacker could infer how a model behaved, poison what it learned, extract what it knew or manipulate what it produced, then the cleverest component in the system could also be its most peculiar weakness.
The three colleagues did not immediately rush out and print founder hoodies. They continued working together, first through Cylance’s BlackBerry chapter, then at Agari and Qualys. Sestito has described them as moving “as a pack.” That phrase says more about HiddenLayer’s origins than the usual language of disruption. Their advantage was not simply that they knew a new kind of attack. They knew how one another behaved when a difficult system stopped behaving.
How an incident became a company
The crack in the clever machine
Sestito had arrived at that moment by an unorthodox route. Before malware analysis, there was territory management at US Foods. In 2015 he moved into security work at The Media Trust, then joined Cylance and rose through its threat-research organization. By 2018 he was publicly arguing that threat research should shape machine-learning model development, not merely inspect the results. Later came senior data-science leadership at Agari and engineering leadership at Qualys. The path crossed sales, malware, research, data and management. A model may prefer neat categories; his career declined the offer.
That mixture proved useful because the problem sat between professions. Data scientists built models. Security operators protected the organization. Each group had its own tools, habits and anxieties. HiddenLayer, which Sestito, Burns and Ballard brought out of stealth in 2022, proposed a bridge: monitor and defend AI systems without requiring access to the customer’s raw data or proprietary algorithms. The ambition was broad, but the operating premise was pleasingly narrow. Let the data scientists build. Give the defenders something they can defend with.
“The team is the best part of HiddenLayer. That’s a no-brainer for me.”Chris Sestito, after the 2023 RSA Innovation Sandbox
Sestito’s comments about founding are notably short on the romance of becoming a CEO. He has called the title a symptom of deciding to solve the problem. In early companies, he argues, hiring for fixed titles matters less than finding people who can solve problems, make sound decisions and show empathy. This is a technical founder’s version of humanism: the org chart will change; judgment has to survive the edit.
It also explains why the founding trio matters. They had already experienced acquisition, integration and the daily frictions of research teams. They did not need a trust exercise involving rope or a rural hotel. They had an incident, several employers and years of shared work. When Sestito talks about startup cohesion, he returns to communication and belief in one another. The language can sound soft until one remembers that security work often consists of making an expensive decision before certainty has arrived.
The pitch that argued with itself
At the RSA Conference Innovation Sandbox in April 2023, Sestito had three minutes to make an emerging category feel immediate. He began by surrendering the stage to a counterfeit. A deepfake video of Sestito appeared and instructed the judges not to vote for HiddenLayer. The synthetic sabotage was a joke with excellent manners: it introduced itself, made the threat visible and left the real founder to explain what might be done about it.
The judges did not follow the fake Sestito’s advice. HiddenLayer won the contest and was named the conference’s Most Innovative Startup. Sestito later said the recognition gave chief information security officers permission to care about AI security. It also drew customer interest and investors. Awards are often ceremonial punctuation; this one behaved more like a door.
The episode captures Sestito’s preferred way of selling a technical subject. HiddenLayer’s early go-to-market approach leaned heavily on education rather than a blizzard of cold emails. The task was not merely to persuade a buyer that one platform was better than another. First, the company had to show that a distinct budget line deserved to exist. There is no more patient sales process than teaching the customer the name of the problem.
That educational instinct can be heard in Sestito’s plain advice to security leaders: apply the same scrutiny to AI that you would apply to traditional code. He avoids asking them to become research scientists overnight. Start with inventory. Understand which models and applications exist. Consider how training data, open-source components, prompts and model outputs can be manipulated. Then decide where limited defensive resources matter most. The novelty belongs to the attack surface, not to the basic obligation to know what the company is running.
From models to actors
The argument changed as AI changed. Early HiddenLayer discussions centered on predictive models: malware detectors, classifiers and systems that could be fooled or copied. Generative AI widened the opening. Models could leak information, accept hostile instructions or inherit malicious components from a sprawling supply chain. Then agents arrived, equipped not only to answer but to act. They could browse, call tools, send messages, edit files and execute code.
For Sestito, autonomy changes the clock. A compromised agent can move data or touch systems in seconds, before a person can interpret an alert. Security therefore has to follow intent and behavior at runtime, reconstructing what happened across prompts, tools and actions. This is less like inspecting a car at the factory and more like watching it enter traffic with a credit card and the office keys.
“Agentic AI has evolved faster in the past 12 months than most enterprise security programs have in the past five years.”Chris Sestito, March 2026
There is a tension inside this work that Sestito does not wave away. The authority that makes an agent useful also makes compromise consequential. Remove the authority and the product becomes less useful. Ignore it and the risk spreads. His stated goal is security that evolves without eliminating autonomy itself. In other words, the guardrail cannot be so grand that it becomes a roadblock, nor so decorative that everyone admires it on the way into the ditch.
By September 2026, the company said its annual recurring revenue had grown more than tenfold over the previous year and that it had added more than 50 platform customers. The $100 million Series B, led by Delta-v Capital with participation from Ten Eleven Ventures, Morgan Stanley, M12 and Booz Allen Ventures, brought disclosed funding to $156 million. HiddenLayer said the money would deepen its platform, including protections for autonomous coding agents, and support international expansion.
Money makes a useful headline because it fits neatly beside a dollar sign. The subtler measure is the distance from the 2019 incident. What began as an attack on one company’s malware model now includes agents writing and shipping code on behalf of enterprises. The surface has expanded from a model’s decision boundary to the messy sequence of things a semi-autonomous system sees, chooses and touches. Sestito’s original hunch has not grown tidier. It has grown legs.
The operator behind the category
Profiles of technical founders are tempted to present foresight as magic. Sestito’s story is more useful when stripped of clairvoyance. He did not predict every turn in generative or agentic AI. He encountered an odd failure, recognized that it could repeat and stayed close enough to the problem to revise the response. When the technology changed, the company’s vocabulary changed with it: model scanning, supply-chain protection, attack simulation, detection, runtime defense.
His public persona follows the same pattern. There is urgency without the costume of panic. He can call AI unusually vulnerable, then return to inventories, controls and collaboration. He uses a deepfake for a laugh, but the punchline lands on a practical question: if a synthetic founder can hijack his own pitch, what else can a persuasive machine be allowed to do?
The answer is still being written by researchers, regulators, vendors and every company hurriedly attaching an agent to its workflow. Sestito’s contribution is to insist that the security team be invited before the machine has wandered off with the keys. HiddenLayer exists because three colleagues once had to repair an intelligent system under attack. Its future depends on making that hard-earned reflex ordinary.
That may be the most founder-like quality in Sestito: not the taste for risk, nor the title, nor even the fundraising. It is the inability to close the incident report and forget the question that caused it.