The first thing to fail in enterprise AI was not the model. It was the list. A marketing team connected a copilot to a content system. An engineer called a model through an API. A vendor slipped machine learning into a product the procurement team already approved. The official inventory said five AI systems; the actual business had dozens, scattered across repositories, cloud accounts, laptops and supplier contracts. Security could not protect what it could not see. Compliance could not document what it did not know existed.
Cranium AI sells an answer to that administrative horror show. Its software discovers AI, watches it behave, attaches policy, attacks it on purpose and turns the results into evidence for a board, customer or regulator. The company calls the sequence the AI Trust Loop: Discover, Observe, Govern, Secure, Prove. Then do it again, because the model changed, the agent gained a tool, or a vendor quietly upgraded an API.
This is less cinematic than catching a hacker in a hoodie. It may also be closer to the work. An AI system is not only a model. It is training data, libraries, prompts, cloud services, agent tools, human owners and third parties. Cranium’s central wager is that the valuable product is not one more guardrail. It is the record connecting all of those moving parts.
The arrow points back to the beginning. AI does not stay audited.
Born in the place audits come from
The origin explains the product. Cranium was incubated inside KPMG Studio, the accounting and consulting firm’s venture program. Jonathan Dambrot, who had led KPMG’s data and analytics security practice, saw a gap between the teams building machine learning and the people expected to secure and certify it. He pitched an internal startup. KPMG and cybersecurity investor SYN Ventures funded it, and Cranium emerged as an independent company in April 2023 with $7 million.
Six months later, Titanium Ventures led a $25 million Series A, with KPMG and SYN returning. The announced total reached $32 million. That is the only clean public answer to “what did it cost?” Cranium does not publish customer pricing, valuation or contract sizes. Buyers enter through a demo-led enterprise sales process, which usually means the bill depends on the number of systems, integrations and business units involved.
$7 million seed plus a $25 million Series A.
Enterprise scope, deployment and support shape the quote.
The founders now listed by the company are Dambrot, chief executive; Felix Knoll, chief operating and revenue officer; and Paul Spicer, vice president of IT security and compliance. The culture has one foot in sober enterprise controls and another in a backstage dressing room. Employees are “Craniacs.” The 2026 event calendar is styled as a world tour. Booked meetings could claim signed “Secure the Machine” vinyl. It is an amusing costume for a company whose practical output includes audit records.
“Security and governance shouldn’t be a separate workstream - they should be part of how every model is built.”Byron Hawkins, Cranium CIO/CISO
What the control room actually controls
Cranium ONE begins with sensors. CodeSensor looks through repositories for models, libraries and datasets. CloudSensor looks across cloud environments. AgentSensor maps the increasingly awkward world of autonomous software, while Detect AI finds unapproved use. Together they produce an AI Bill of Materials - an inventory that records components, owners and dependencies instead of merely listing project names.
Observation comes next. Cranium says its Trace system shows sessions, sequence diagrams and event-level behavior, using more than 100 risk signals and 250 intent classifications. Its pointed distinction is that the verdicts are deterministic and purpose-built rather than another large language model grading the first one. That can make a decision easier to reproduce and explain. It does not make classification perfect; it makes the path to a verdict inspectable.
Governance maps policies to systems and to frameworks including the EU AI Act, NIST AI Risk Management Framework and ISO 42001. ComplianceAgent automates portions of the mapping and scoring. Cranium Arena then red-teams systems using threat libraries from MITRE ATLAS, OWASP and Cranium itself. Arena Shield is meant to remediate findings and verify that the fix held. Finally, AI Cards package live posture, test results and runtime evidence into an exportable report. The spreadsheet becomes an output, not the underlying system.
A published life-sciences case study gives the most concrete example, although the client is not named. Cranium says it scanned 70,000 AI and machine-learning repositories and estimates that the work saved 14,000 hours and $1.3 million a year. Treat those figures as vendor-reported, not an independent benchmark. Still, they reveal the ideal customer: a large regulated organization where merely counting the estate is expensive.
The customer is a committee
Cranium does not really sell to “the AI team.” It sells to the collision between teams. Security leaders want attack-surface visibility and red-team results. Compliance officers want controls mapped to law. Vendor-risk teams want to know which external model is making a decision in the company’s name. Data scientists want checks inside the workflow, not a ticket raised three weeks after launch. Boards want a number and evidence they can defend.
That cross-functional reach is both the advantage and the risk. A point product may block prompt injection or scan a model file. Traditional governance software may collect attestations. Hyperscalers provide controls for their own clouds. Cranium competes by connecting inventory, runtime evidence, policy, adversarial testing and reporting across providers. The field includes Protect AI, HiddenLayer, Lakera, Noma Security, Cisco AI Defense, CalypsoAI, Credo AI and internal toolchains assembled from open-source scanners and cloud services.
Editorial positioning, not a performance benchmark.
Partnerships extend that reach. KPMG supplies advisory muscle and remains an investor. Microsoft joined Cranium and KPMG on the EU AI Hub and healthcare work. Archer connects risk records to established enterprise workflows. In May 2026, Cranium announced an integration with Weights & Biases by CoreWeave: teams can run Cranium evaluations against registry models, then write findings back beside model versions and performance metrics. On the same day, it announced an alliance with cyber-resilience adviser ISTARI.
The agent changed the plan
Models answer. Agents act. They call tools, retrieve files, hand work to other agents and preserve state. That difference forced the AI-security market to widen its frame. In May 2026, Cranium acquired Aiceberg, an agentic AI security and risk-management company. Aiceberg chief executive Alex Schlager became Cranium’s chief technology officer, and the acquired employees moved across with him. The price was not disclosed.
The acquisition is the clearest answer to what changed Cranium’s mind: the relevant object was no longer only a model pipeline. It was an autonomous workflow. Cranium’s earlier ingredients - inventory, risk mapping, monitoring and policy - remained useful, but they needed to follow tool calls and agent behavior. A February 2026 disclosure about a high-to-critical severity exploitation technique affecting coding assistants reinforced the point. The attack surface had moved into the development workflow.
The bit worth copying
A company does not need to buy Cranium to borrow its most useful idea. Governance works better as an operating loop than as an annual project. Start with evidence, not a policy document. Give every AI system an owner. Record the models, data, libraries, vendors and tools it depends on. Watch behavior after launch. Test again when any component changes. Keep the evidence close enough to the system that an audit report can be generated rather than reconstructed.
Scan code, cloud, endpoints and vendors. Do not rely on a survey alone.
Attach a person, use case and policy to every discovered system.
Re-test when a model, prompt, tool, dataset or supplier changes.
Make proof a by-product of controls, not a quarterly scavenger hunt.
The loop does not work by installation alone. Sensors need permission and coverage. Someone must resolve duplicate discoveries, assign ownership and decide which risks deserve a block. A deterministic classifier can be auditable and still miss a new behavior. Framework mappings can speed compliance without replacing legal judgment. Automated remediation is useful only when teams are willing to let software change controls - and when they test the change.
It may also be the wrong purchase for a small business running three approved models on one cloud. A lightweight inventory, provider guardrails and disciplined reviews can be cheaper. Cranium’s economics improve as sprawl, regulation and organizational complexity rise. It is a control-room product; first you need enough moving aircraft to justify the tower.
For large enterprises, that traffic is already overhead. Cranium’s opportunity rests on a mundane truth: AI adoption moves faster than the systems built to account for it. The company is not promising to make models harmless. It is promising to make them visible, testable, governable and explainable to the people who will be asked what went wrong. In enterprise software, that may be the more valuable promise.