Topic starter
06/09/2026 6:21 pm
TL;DR: Nearly a third of organisations cannot confirm whether they have suffered an AI-related breach, and the funding underscores investor conviction that AI security must move from design-time controls to runtime protection, according to HiddenLayer; the company’s $100 million Series B reinforces a broader market shift toward securing agentic systems, where governance fails if behaviour, tool use, and action approval are not continuously verified.
Editorial analysis by NHI Mgmt Group, based on content published by HiddenLayer: “HiddenLayer Raises $100M Series B to Advance Trustworthy AI”.
Key questions
Q: What fails when AI agents are only governed at design time?
A: Design-time controls can define intended behaviour, but they do not prove what an agent will do once tools, prompts, and external data interact in production.
Q: Why do AI agents increase privilege risk even when logs exist?
A: Logs record what happened, but they do not stop a privileged agent from taking an irreversible action before review.
Q: How do teams know whether AI runtime enforcement is actually working?
A: Look for low-latency enforcement, consistent decisions across languages and encodings, complete telemetry, and repeatable blocking of risky content under load.
Practitioner guidance
- Define runtime approval boundaries for AI agents Specify which tool calls, code actions, and data operations require live enforcement rather than pre-approved policy alone.
- Separate coding-agent authority from human developer access Create distinct access scopes for autonomous coding agents so they cannot inherit broad repository, deployment, or admin permissions from human roles.
- Instrument agent behaviour for audit and intervention Log tool use, output-to-action transitions, and blocked requests so security teams can detect misuse while the agent is operating.
Bottom line: AI security is moving from static assurances to runtime enforcement as organisations deploy systems that can act through tools and code.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:21 pm
Runtime governance is now the decisive control plane for agentic AI. Once AI systems can select tools and act inside enterprise workflows, design-time safeguards stop being sufficient. Security teams must govern what the system does while it is live, not just what it was intended to do at build time. That shifts the centre of gravity from model policy to operational enforcement, which is where identity, privilege, and auditability converge for practitioners.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI-driven exposure as a data governance issue or an identity issue?
A: They should treat it as both, but data visibility should come first because identity controls need a known asset to protect. The better model is to connect DSPM, DAG, IAM, and PAM so exposure, entitlement, and privilege are evaluated together.
👉 Read our full editorial: HiddenLayer's $100M Series B signals tighter AI runtime security