Christopher “Tito” Sestito had three minutes to persuade a room full of cybersecurity judges. He began by giving them a reason to distrust the person speaking. On the screen was another Sestito, a deepfake, telling them not to vote for HiddenLayer. For a founder hoping to win the 2023 RSA Innovation Sandbox, it was an unusually accommodating gesture toward the competition.
The counterfeit lost the argument. HiddenLayer won. But the little act of self-sabotage made a useful introduction to Sestito’s working life. An apparently reliable system can deliver something thoroughly unreliable. A familiar face can give the wrong instruction. And the people charged with spotting the trouble need to understand what they are looking at before the consequences arrive.
There was a joke onstage because there had been a serious incident years earlier. Sestito and his co-founders had already seen an artificial-intelligence system become the target of an attack. By the time he faced the judges, he was trying to turn that experience into something other organizations could use. The duplicate founder was the opening act. The actual subject was trust.
The detector became the target
In 2019, Sestito was leading threat research at Cylance, whose security software used machine learning to identify malware. Researchers found a way to exploit the model handling Windows executables. By studying its behavior, they could work out how to modify malicious files so the detector would treat them as benign. The machinery intended to recognize danger could be persuaded to let it pass.
Sestito, Jim Ballard and Tanner Burns were involved in responding. It was a specific problem inside a specific security product, but the implications extended beyond that product. If a model could be examined through its reactions, an adversary could learn something useful about its blind spots. The model’s intelligence did not exempt it from being studied by someone with very different intentions.
The founders’ later account of the incident makes their motivation clear: they wanted to show that attacks of this kind could be prevented. The question followed them after the response effort. Other businesses were putting machine learning into products and operations. Those businesses would also need ways to recognize interference. Fixing the immediate weakness left a larger piece of work waiting.
The colleagues who kept turning up
Sestito had come into this problem through malware analysis and reverse engineering. Machine learning caught his attention as a way to tackle security problems; the intersection became the place where he wanted to spend his career. His later jobs kept him close to both disciplines: threat research at Cylance, senior data-science leadership at Agari, and engineering and data-science leadership at Qualys.
These were roles that involved explaining as well as investigating. He delivered cybersecurity and data-science training to large businesses and government agencies, worked on external product evaluations, and helped teams through acquisition transitions. Technical knowledge had to travel between researchers, engineers and people making decisions about products. A good explanation was part of getting the work done.
Ballard and Burns kept appearing in the same professional story. The three worked together at Cylance, Agari and Qualys. By an April 2023 interview, their shared history covered about five years. That is a substantial rehearsal for starting a company, although none of those earlier employers had been designed as a rehearsal. They had accumulated experience of the problem and of one another.
HiddenLayer emerged from stealth in July 2022 with $6 million in seed financing. Its proposition was to defend AI models without requiring access to customers’ raw data or proprietary algorithms. Even the name pointed inward: hidden layers are the parts of a neural network between its inputs and outputs. The business had taken its name from the machinery it intended to protect.
A different company on the same calendar
Starting HiddenLayer changed Sestito’s relationship to technical work. In a 2023 interview, he joked that Burns and Ballard worked at an adversarial machine-learning company while he worked at a sales and marketing company. They were, inconveniently for the joke, all employed by the same organization. The difference lay in what being CEO now required him to do.
He was used to coaching, mentoring and teaching technical subjects. Now more of his attention went outside the business. Someone had to explain the problem to prospective customers, establish a reason to act and help a new category acquire a vocabulary. A laboratory demonstration and a purchasing decision have different audiences. The founder had to become comfortable addressing both.
His account of hiring followed a similar logic. Early roles could stretch across several responsibilities, so choosing capable people mattered more than perfecting their titles. He pointed to bringing in Abigail Maines, a colleague they already knew, to lead the commercial work. Familiarity gave the founders something concrete to assess beyond a promising job description.
“The team is the best part of Hiddenlayer.”
Christopher “Tito” Sestito · Cyber Inspiration, 2023
That emphasis makes his public story feel less solitary than the standard founder portrait. The decisive incident involved colleagues. The company began with colleagues. When he described what he valued about it, he returned to the team. There is room for a recognizable chief executive in that picture, but the work keeps bringing other people into the frame.
Permission to care
The RSA appearance gave Sestito a concentrated version of his communication problem. Ten finalists competed. Each pitch had to make a technical issue understandable quickly enough for judges to assess the business behind it. His deepfake made the possibility of manipulation visible before he asked anyone to follow the details of defending a model.
The win mattered beyond the trophy photograph. Looking back in 2026, he said the recognition helped security leaders feel permitted to take AI security seriously. It brought customer inquiries and investor attention. For a business selling into an emerging category, outside recognition could help a prospective buyer explain the decision to colleagues who had other demands on the budget.
In September 2023, HiddenLayer announced a $50 million Series A led by M12, Microsoft’s venture fund, and Moore Strategic Ventures. The company planned to invest in its platform, its staff and its commercial efforts. Its early machine-learning detection and response approach monitored model inputs and outputs for evidence of attacks. The research problem was becoming an operational product.
- 2019The Cylance model attack.
- 2022HiddenLayer emerges from stealth.
- 2023RSA Innovation Sandbox winner.
- 2026A new focus on agent execution.
When the software gets the keys
The software being defended kept changing. Sestito’s earlier work concerned models making classifications, such as deciding whether a file looked malicious. Generative systems introduced different interactions: instructions, responses and the possibility that an attacker could exploit the exchange. AI agents added actions. A system could now use tools and interact with other systems while carrying out a task.
In a January 2025 conversation with investor Sid Trivedi, Sestito discussed threats ranging from poisoned data to shadow AI. The latter describes a familiar organizational headache in a newer form: software being used without the security team having a clear view of it. Before an organization can defend its AI, somebody has to establish which AI is actually there.
The move toward agents made the pace of the response another concern. “AI agents operate at machine speed,” Sestito said in March 2026. A compromised agent could reach systems or move data while a human was still trying to understand the warning. Permissions that made an agent useful could also give an attacker room to act.
HiddenLayer’s announced runtime capabilities addressed that sequence of behavior: visibility into sessions, investigation across tool use, and controls on unauthorized actions. Sestito’s concern had moved along with the technology. Watching the model’s answer was only part of the task once the system could do something with it. The security team needed to follow the work as it happened.
The next job is already moving
In September 2026, HiddenLayer announced a $100 million Series B led by Delta-v Capital. Its stated plans included further protection for agentic systems and autonomous coding agents, plus international expansion. Those are company plans, with execution still ahead of them. They also show how far the founders’ original problem had spread from a single malware-detection model.
Sestito remains chairman, CEO and co-founder, based in Austin. His public ambition is to make secure AI adoption practical for enterprises. The continuity in his story lies in the questions he keeps carrying forward: how can this system be manipulated, how would its owner know, and what could the defender do about it?
The RSA gag still offers a compact introduction. Two versions of the founder appeared, and the audience had to decide what to trust. Beyond the stage, that decision has acquired tools, permissions and a business calendar. Sestito’s task is to help organizations make it while the software is already at work. The counterfeit had a short speaking slot. The real founder has a rather longer assignment.