shadow-ai
(23)
Your Company Has Two AI Strategies. Velatir Raised €5 Million to Govern the One You Can't See
Employees adopted AI before management wrote the rules. The Danish startup is betting that a browser-level map, enforceable guardrails and a human yes-or-no can turn shadow AI from a security problem into usable infrastructure.
Wojciech Blaszak
Wojciech Blaszak is the co-founder and CEO of Golf (YC X25), a San Francisco company building a security and governance control plane for the Model Context Protocol (MCP), the layer where AI agents connect to company data. He started his first business at 14, grew it to around $200k in revenue, and left university after a single semester to build full-time with his longtime collaborator Antoni Gmitruk. Golf began as an open-source framework for shipping production MCP servers and grew into an enterprise product that discovers shadow AI, enforces per-tool policies, and produces compliance-ready audit trails.
Compliant LLM
Compliant LLM (formerly FiddleCube, YC W23) is an AI security and compliance toolkit that helps infosec, compliance, and GenAI teams keep their AI agents, prompts, and MCP servers secure. It red-teams AI systems against attacks like prompt injection and jailbreaking, checks them against frameworks such as NIST, ISO, OWASP, GDPR, and HIPAA, and monitors employee use of third-party GenAI tools to catch data leaks and PII exposure across both approved and shadow AI workflows.
Golf
Golf is a Y Combinator (X25) startup building the security and governance layer for AI agents and Model Context Protocol (MCP) servers. It began as GolfMCP, an open-source Python framework for shipping production MCP servers without boilerplate, and grew into an enterprise control plane that discovers every AI agent and MCP connection in an organization (including shadow AI), enforces granular policies with sub-millisecond latency, and maintains compliance-ready audit trails. Founded by high-school friends Wojciech Blaszak and Antoni Gmitruk, who both dropped out of university to build it full-time.
Oximy
Oximy is the system of record for how enterprises use AI. It sits at the network layer to discover every AI tool employees touch (sanctioned or not), track spend across teams and vendors, and protect sensitive data - then adds a company-controlled AI workspace and a routing layer that sends each request to the best model by cost, quality, and latency. Founded in 2025 by Naman Ambavi and part of Y Combinator's W26 batch, Oximy already processes millions of requests a day for customers in financial services and healthcare.
Nudge Security
Nudge Security is an Austin-based cybersecurity company that helps organizations discover and govern the SaaS and AI applications their employees adopt, often without IT's knowledge. Founded in 2021 by Russell Spitler and Jaime Blasco, the platform combines Day One SaaS and AI app discovery, security posture management, identity governance, third-party risk, and spend management, then reaches employees directly with 'security nudges' via browser, Slack, and Teams to guide safer choices without blocking work. It raised a $22.5M Series A in November 2025 and serves nearly 200 customers.
Token Security
Token Security is a New York- and Tel Aviv-based cybersecurity company that secures non-human identities (NHIs) - the service accounts, API tokens, workloads and, increasingly, autonomous AI agents that now vastly outnumber human users inside enterprises. Its agentless platform continuously discovers these machine identities across cloud, SaaS and AI environments, maps their ownership, permissions and access into a unified identity graph, and enforces least-privilege and lifecycle controls. Founded in 2023 by CEO Itamar Apelblat and CTO Ido Shlomo, the company has raised roughly $27M (Seed plus a $20M Series A led by Notable Capital) and counts customers such as GitLab, Bloomreach, HiBob, Dayforce and BetterHelp.
Torii
Torii is a SaaS Management Platform (SMP) that helps IT and finance teams discover, optimize, and govern the software running across their organization. Founded in 2016 by three serial entrepreneurs, Torii pioneered a discovery-first approach that surfaces shadow IT - and, more recently, shadow AI - through browser extensions, SSO, direct integrations, and financial data. On top of that visibility it layers spend analytics, license optimization, and no-code automation for tasks like onboarding, offboarding, and renewals. Headquartered in New York with R&D in Israel, Torii counts customers such as Instacart, Bumble, and Palo Alto Networks, and was named a Leader in Gartner's 2025 Magic Quadrant for SaaS Management Platforms.
Valence Security
Valence Security is a SaaS and AI security company that helps enterprises find and fix risks created by SaaS and AI sprawl. Its platform unifies SaaS discovery, SaaS Security Posture Management (SSPM), AI Security Posture Management (AI-SPM), and Identity Threat Detection and Response (ITDR), then pairs that visibility with one-click and collaborative remediation workflows that engage business users to actually close gaps. Founded in 2021 and backed by Microsoft's M12, YL Ventures, and Porsche Ventures, Valence positions itself as a leader in securing the modern, agentic SaaS estate.
Zenity
Zenity is a cybersecurity company that builds an end-to-end security and governance platform purpose-built for AI agents. Founded in 2021 by Ben Kliger and Michael Bargury, it gives enterprises visibility and control over what AI agents - from Microsoft Copilot and Salesforce Agentforce to home-grown builds on AWS Bedrock - can access, do, and invoke. Zenity covers the full agent lifecycle with discovery, posture management, real-time threat detection, and response across SaaS, cloud, and endpoint environments, closing the blind spots that traditional model-focused security tools miss.
Cyberhaven
Cyberhaven is a data security company that protects enterprises from data exfiltration and insider risk by tracing how information moves rather than just where it sits. Founded in 2016 by five PhD researchers with roots in the DARPA Cyber Grand Challenge, the company built a proprietary 'data lineage' engine and an AI layer, Linea AI, that combines Data Loss Prevention (DLP), Data Security Posture Management (DSPM), Insider Risk Management, and AI security into one platform. Reaching a $1 billion valuation in April 2025 after a $100M Series D, Cyberhaven serves customers such as Snowflake, Motorola, Reddit, and major law firms.
BlueFlag Security
BlueFlag Security is a Sunnyvale, California cybersecurity company building an identity-centric security and governance platform for the software development lifecycle (SDLC). Rather than scanning code for vulnerabilities, BlueFlag watches the identities and tools behind the code - developers, service accounts, bots, and increasingly the AI coding assistants and autonomous agents that now write, test, and deploy software. Founded in 2024 by former CloudKnox and Symantec operators Raj Mallempati and Ken Schneider, the company applies AI/ML-based 'Identity Intelligence' to detect risky behavior, enforce least privilege, and govern AI agents across CI/CD pipelines. In March 2026 it announced a $28 million Series A and 300% year-over-year revenue growth.
DataGrail
DataGrail is a San Francisco-based data privacy company that helps modern brands automate compliance with regulations like GDPR, CCPA, and CPRA. Its Agentic Data Privacy Platform - powered by an AI privacy agent named Vera and backed by more than 2,500 pre-built integrations - handles the unglamorous plumbing of privacy: mapping where personal data lives, fulfilling data subject requests, managing consent, and running privacy and AI risk assessments. Founded in 2018 by three data and go-to-market veterans, it counts Salesforce, Databricks, Instacart, and Major League Soccer among its customers.
Russell Spitler
Russell Spitler is co-founder and CEO of Nudge Security, an Austin-based cybersecurity company that helps organizations discover and govern the sprawl of SaaS and AI apps employees adopt on their own. He previously ran product strategy at AT&T Cybersecurity and AlienVault, where he co-founded the Open Threat Exchange, one of the largest open threat intelligence communities in the world. In November 2025, Nudge Security raised a $22.5 million Series A led by Cerberus Ventures, bringing total funding to roughly $39 million.
BEMO
BEMO is a Redmond, Washington-based managed IT and security service provider built specifically for small and mid-sized businesses that run on Microsoft 365 and Azure. Founded in 2010 by ex-Microsoft veterans Bruno Lecoq and Joel Lachance, the fully remote company bundles cybersecurity, compliance (SOC 2, ISO 27001, CMMC, NIST 800-171), managed helpdesk, and AI/Copilot security into packaged tiers so 10-to-500-person organizations can meet audit requirements without hiring an in-house security team. BEMO is a repeat Microsoft US Partner of the Year and a four-time Inc. 5000 honoree.
Wald.ai
Wald.ai is a Palo Alto-based context intelligence company that lets enterprises use generative AI assistants like ChatGPT, Claude, Gemini and Grok without leaking sensitive data. Its context-aware DLP engine uses specialized small language models to detect and redact confidential information in real time, then restores it in the response, giving regulated industries a governed, single-pane way to adopt AI without blocking it. Founded in 2023 by Vinay Goel and Ritesh Ahuja, the company closed a $4M seed round in December 2024.
Casey Bleeker
Casey Bleeker is the co-founder and CEO of SurePath AI, a Denver-based startup that helps enterprises adopt generative AI without leaking their secrets to it. He built the company in 2023 around a simple bet: companies will not choose between banning AI and losing control of their data, so SurePath sits at the network edge, governing what employees send to public models and redacting what they should not. Before founding SurePath, Casey ran CDW's $2B+ Cloud and Cloud Native business and held senior roles at Cisco in AI/ML, IoT, and developer advocacy. He is a computational-biology major turned go-to-market operator who codes his own prototypes, and online he is better known as 'geekbleek.'
Vinay Goel
Vinay Goel is the CEO and co-founder of Wald.ai, a Palo Alto startup building contextual data-loss protection for the age of generative AI. After more than 30 years in product and technology - a decade at Google leading Maps and Local, then top product roles at JLL, Kiavi, Check Point and Webroot - he co-founded Wald.ai in 2024 to solve the 'shadow AI' problem: employees feeding sensitive company data into ChatGPT, Claude and Gemini. Wald.ai redacts sensitive data inline, lets the AI answer, then restores the original context before the user sees it. He raised a $4M seed round in December 2024 and sits on the Forbes Technology Council.
Productiv
Productiv is a SaaS and AI portfolio governance platform that helps enterprise IT teams discover, measure, and right-size every application employees actually use - including the AI tools nobody told them about. Founded in 2018 in Palo Alto, the company has raised $73M and now counts companies like DocuSign, Robinhood and Okta among its customers.
Sean Murray
Sean D. Murray is the CEO of Productiv, the AI Portfolio Governance platform that gives enterprise IT teams real-time visibility over every SaaS and AI application running in their organization - including the ones nobody approved. A 20-year revenue and sales leadership veteran, Murray spent years building go-to-market engines at CEB (now Gartner), Xactly Corp, SalesLoft, and Greenhouse Software before stepping into the CEO seat at Productiv in April 2024. He now leads a 160-person company backed by IVP, Accel, and Norwest - on a mission to turn shadow AI from an enterprise liability into a managed capability.
Harmonic Security
Harmonic Security helps enterprises adopt generative AI without leaking sensitive data. Using small, purpose-built language models, its AI Governance and Control platform spots risky prompts, enforces policy across browsers and desktops, and gives security teams visibility into the thousands of AI tools employees quietly use every day.
WitnessAI
WitnessAI is an enterprise AI security and governance platform that helps organizations safely deploy AI at scale. Built on three pillars - Observe, Protect, and Control - its platform provides real-time visibility into all AI interactions (employee tools, internal models, AI agents, MCP servers), detects and blocks prompt injections and jailbreaks with over 99% accuracy using intent-based ML models, and enforces behavioral policies without code changes. With $85.5M in total funding, 500% ARR growth in 2025, and customers across financial services, telecom, airlines, and automotive, WitnessAI is positioning itself as the confidence layer enterprises need to move from AI experimentation to production deployment.
Alastair Paterson
Alastair Paterson is the co-founder and CEO of Harmonic Security, a San Francisco-based startup building language models that protect enterprise data as employees pour it into generative AI tools. He previously co-founded Digital Shadows in a London kitchen in 2011 and ran it for eleven years through to its $160M acquisition by ReliaQuest in 2022. A Bristol-trained engineer who cut his teeth at BAE Systems Detica, he is now back on his second cybersecurity company, this one wagering that coaching beats blocking.