A company can buy a roomful of cybersecurity tools and still struggle with a basic question: what, exactly, are we protecting? One system sees a device. Another sees an account. A third sees a vulnerability. Getting them to agree can become a job in itself. Prevalent AI has spent nearly a decade building a business in that gap.
In August 2026, the London company announced $22 million from Integrity Growth Partners, its first primary growth capital since its founding in 2017. Its proposition has acquired a new audience. The confused operational records that frustrate a security analyst also make poor instructions for an AI agent. Prevalent wants to supply the common picture both can use. The investment announcement sets out that expansion.
There is something refreshingly practical about the premise. Before automating a decision, establish what the decision concerns. Before asking a model to reason about a business, sort out which systems belong to it, who can access them and how they connect. The model may be clever. The inventory still needs doing.
First, get the machines to agree
Prevalent’s Security Data Fabric collects information from existing enterprise systems and turns it into a connected operational view. Its inputs span cloud services, identity directories, endpoint tools, vulnerability scanners and other business technology. The aim is to reconcile their different descriptions of the same environment. The company calls the resulting structure a knowledge graph.
Think of a hypothetical server represented by several records. Matching those records establishes that they concern one asset; connecting that asset to its owner, permissions and business function explains why it matters. Prevalent’s product description places entity resolution and relationship mapping at the centre of this process. DataBridge is the integration layer for adding systems as the environment changes.
identity records
Connect relationships.
Assign action.
An editorial explanation of the workflow, not a product screenshot.
The operational difference is between storing a finding and placing it in a useful relationship. A vulnerability becomes more informative when a team can connect it to an exposed machine, a privileged identity or an important application. Prevalent’s approach makes those connections part of the working data rather than leaving each analyst to reconstruct them.
A queue of fixes, with reasons attached
Exposure Management is the application built on that foundation. Its workflow moves through discovery, assessment, prioritisation and remediation reporting. Prevalent says it weighs vulnerability information alongside business importance, exploitability, identities and threat intelligence. That gives teams a way to order their work when the list of findings exceeds the time available to fix them. The exposure workflow also tracks whether remediation changes the overall picture.
Its scope includes devices, cloud environments, identities, data and applications. Those categories matter because a security problem can travel between them. A permission connects an identity to a resource; a resource supports an application; the application serves a business process. Looking at each separately can obscure the relationship that makes a finding urgent.
Continuous Controls Monitoring tackles another everyday frustration: establishing whether safeguards keep working. In a March 2026 demonstration, Prevalent describes ongoing assessments, evidence views and dashboards tied to more than 100 frameworks, including NIST and ISO 27001. Users can drill from a control issue into affected assets and receive remediation suggestions. The emphasis is on repeatedly checking the environment instead of treating last month’s assessment as today’s answer. The official https://prevalent.ai/resources/prevalent-ai-ccm-ai-powered-continuous-controls-monitoring-at-scale/ demonstration shows the intended workflow.
The intelligence pedigree has a practical outlet
The founding team brings unusually direct experience of making sense of difficult information. Paul Stokes and Arun Raj established the business with Sir Iain Lobban, the former GCHQ director, and Andrew France, formerly deputy director for cyber defence operations at GCHQ. Stokes is CEO; Raj is COO. Their names and the 2017 origin appear in the 2021 account of ISTARI’s investment.
The company’s own account stresses the discipline of interpreting incomplete and contradictory information. That is a useful way to understand its expertise: security knowledge helps frame the question, engineers handle the data, and data scientists develop the analysis. Its AI services description explicitly separates those roles. A graph without a useful question is still a graph.
Prevalent describes customers including global banks, insurers, telecommunications providers, sovereign wealth funds and critical infrastructure operators. These are organisations with complicated technology estates and consequential decisions to make. The customer profile helps explain the product’s attention to ownership, operational relationships and deployment control. It also explains why the delivery model involves more than opening an account.
The software comes with people
Stokes describes a “build with” model: architects, managed-services staff and engineers work closely with customers to design, deploy and develop the platform. The business combines enterprise software with ongoing services and recurring revenue. In his account of the company’s growth, long customer relationships are part of how the technology was developed.
The same account identifies another early choice: private-cloud and on-premises deployment. Customers keep the operational intelligence in their own environments. Prevalent now puts sovereignty at the centre of its positioning, connecting the concern over security information with the newer concern over where AI systems obtain their business context.
Its recruiting materials offer a glimpse of the intended working culture. The company lists authenticity, focus and curiosity among its values, alongside flexible working, mentoring, employee options and a Shared Value Fund. Those are the employer’s stated commitments. Its careers page recruits across engineering, architecture, managed services and security analysis, reflecting the mix required to keep customer deployments useful.
For a buyer, the practical cost question therefore extends beyond software. An evaluation should account for integration work, infrastructure, access to internal specialists and continued maintenance of the data relationships. That is an inference from the delivery model, not a published price estimate. A useful pilot would pick one operational question and measure the effort required to answer it before and after deployment.
The numbers need their nouns
Prevalent reports that a global insurer reduced the time needed to prepare executive security reports by 95%. It also reports that an international banking group improved its ability to detect incidents by more than 80%. These are company-reported customer outcomes. The first describes reporting time; the second describes detection capability. Neither should be rewritten as a percentage reduction in cyber risk.
Less time preparing executive security reports.
Illustrative index, before = 100. Derived from the reported reduction; not elapsed hours.The distinction matters because reporting is real work. Someone has to gather evidence, reconcile discrepancies and explain the result to executives. A faster report can release staff time without proving that every underlying exposure has disappeared. The coverage of the funding attributes the customer results to Prevalent, as a reader should too.
Why take the money now?
The investment history contains an easily missed distinction. ISTARI became a minority shareholder in 2021 through a secondary transaction. Buying existing shares is different from putting fresh growth capital into the business. That is why Prevalent can have an established institutional shareholder and still describe August 2026 as its first primary raise.
The company says it was profitable from its first customer and that annual recurring revenue more than doubled in the twelve months before the announcement. Its stated use for the $22 million is expansion: a more formal commercial organisation, a stronger US presence, additional leadership and applications beyond cybersecurity. Tech.eu’s account describes those priorities.
“Large enterprises do not have a shortage of tools or data. They have a shortage of context.”Paul Stokes / August 2026
Stokes’s explanation for the timing is a market that has moved towards the problem the company already works on. AI has increased demand for reliable operational context. Prevalent’s next challenge, in editorial terms, is organisational: spreading a business shaped by close customer work across more customers and countries. Selling more deployments and delivering them well are related jobs, but they require different kinds of effort.
More questions for the same graph
The newer product demonstrations show where Prevalent wants to remove friction. Studio’s Any Connect uses prompts to help create integrations. Its tools assist with mapping, transformation and entity resolution, with visual validation of the result. The March 2026 Studio demonstration makes the data preparation itself part of the AI story.
Navigator Mobile brings a conversational interface to security questions, including vulnerability analysis. Its May 2025 demonstration shows the ambition to make the underlying information easier to query away from a desk. Meanwhile, Prevalent describes financial crime, compliance and operational intelligence as further uses for connected enterprise data. The strategic appeal is reuse: another department may need another analysis of relationships already assembled.
Prevalent occupies a competitive part of security software. Armis Centrix, for example, also offers asset intelligence, exposure assessment and prioritisation. The overlap means that a knowledge graph alone is an insufficient buying argument. Prevalent’s particular proposition combines customer-controlled deployment, data reconciliation and embedded delivery. Those choices deserve evaluation against an organisation’s actual systems and operating preferences.
The reader can copy the sequence without copying the purchase: choose a decision, reconcile the records it relies on, connect them to ownership and business impact, then check whether the answer improves. By inference, this approach is less attractive where a small, simple estate already produces dependable answers. It also depends on access to the relevant data and people willing to resolve ambiguous ownership. Software cannot settle an organisational question that nobody will take responsibility for answering.