Business

London-based Harmonic Security raises $50m to govern staff AI use

Harmonic Security, co-headquartered in London, raises a $50m Series B led by Crosspoint to govern how employees use AI tools and agents.

Rising bar chart graphic with the headline Harmonic Security lands $50m for AI governance

Harmonic Security, the workforce AI security firm with headquarters in London and San Francisco, has closed a $50m Series B led by Crosspoint Capital Partners. The round signals that investors now see governing everyday staff use of AI as a market of its own, not a feature bolted onto data loss prevention.

What happened

On 14 October 2026 Harmonic Security announced an oversubscribed $50m Series B round. Crosspoint Capital Partners led it, and existing investors also took part. The raise brings the company’s total funding to $76m. The valuation was not disclosed.

Harmonic was founded in 2023 by chief executive Alastair Paterson and chief technology officer Bryan Woolgar-O’Neil. Both previously ran Digital Shadows, the London threat intelligence business that ReliaQuest bought in 2022 for $160m. Ten Eleven Ventures led a $7m seed round in 2023. Next47 then led a $17.5m Series A in October 2024, when the company had around 30 staff split between the US and the UK.

Headcount has grown sharply since then. The company’s own announcement puts it at more than 90 people across both countries. GovInfoSecurity, which interviewed Paterson, reported a figure of 80. Harmonic says the new money will pay for more engineering, sales and marketing on both sides of the Atlantic. It also claims its platform covers millions of employees at more than 100 organisations, some of them very large enterprises, and it has signed new distribution agreements with Climb and Distology.

Zach Sivertson, a managing director at Crosspoint, argued in the announcement that organisations “shouldn’t have to choose between moving quickly and maintaining control” when they adopt AI.

The detail

The product sits between employees and the AI tools they use. Harmonic began by monitoring generative AI in the browser. Over the past year, the company says, it has extended coverage to desktop AI applications and agentic workflows. GovInfoSecurity reports that it also looks at Model Context Protocol (MCP) connections and locally run models. That matters because staff rarely stick to the sanctioned assistant: they use personal accounts, install their own apps and connect assistants to email, CRM and chat.

Instead of relying on a general-purpose frontier model or traditional pattern matching, Harmonic uses its own small language models to classify each interaction by context. The aim is to tell a developer mentioning a database schema from someone pasting live credentials. Paterson told GovInfoSecurity that these models answer in about 23 milliseconds, are retrained weekly, and in his view outperform larger models for this narrow classification job.

Harmonic also pitches a “Usage Intelligence” layer that shows leaders which AI use cases deliver value, not only which ones carry risk. Paterson’s line in the announcement was that boards keep asking two things: how to cut AI risk, and whether they are getting value. On integrations, Harmonic is listed as an ecosystem partner for Cisco Cloud Control’s Agent Builder and has built a connector to Anthropic’s Claude Compliance API. According to the company, that connector gives security teams visibility of activity logs and, for Claude Enterprise customers, conversation content.

Paterson’s view of where the real risk lies will be familiar to practitioners. In the GovInfoSecurity interview he said a well-meaning employee who wires a customer database to outbound email is a more material threat for the average company than rogue frontier models.

Timeline of Harmonic Security's funding from the Digital Shadows sale in 2022 to its $50m Series B in October 2026

Why it matters for UK organisations

First, it is another British-rooted security business scaling with transatlantic capital. Harmonic’s London base and the stated plan to grow its UK team are good news for the domestic skills market. Still, some reporting simply calls it San Francisco-based, and the centre of gravity of UK start-ups often shifts west as they grow.

Second, the money is following a problem that UK security teams already have. Staff are pasting customer records, contracts and source code into AI tools, often through personal accounts that corporate logging never sees. Under UK GDPR, an organisation is still the controller for that personal data wherever an employee sends it. Uncontrolled disclosure to a third-party AI service can also become a reportable incident. “We didn’t know staff were using it” will not satisfy the ICO.

Third, the category is consolidating. According to Tech Funding News, larger vendors have bought or agreed to buy rivals Prompt Security and Aim Security. For UK buyers that is a procurement risk, because a point product chosen today may soon have a new owner. Contracts should cover change of control, data residency and exit.

Expert view

When we test organisations, AI usage has become one of the quickest ways to find sensitive data leaving the building, and the route is rarely clever. Someone has connected a helpful assistant to a shared mailbox, or a team has adopted a browser extension that nobody in IT has reviewed. The technology Harmonic is selling addresses a real gap, and I welcome the emphasis on understanding why people use AI, not just blocking it. Blanket bans just push activity onto personal devices.

That said, a funding round is not a security assessment. Treat vendor claims about classification accuracy and speed as claims until you have tested them on your own data. A tool that inspects every prompt sees some of the most sensitive content in your organisation, so its own security, hosting location and retention settings deserve the same scrutiny as any other high-privilege supplier. In my experience the organisations that handle AI well start with policy and an inventory of what is in use. Tooling comes second, to enforce decisions already taken.

There is also a market question. Platform vendors are adding AI usage controls to web gateways, CASB and endpoint suites, so specialists must stay clearly ahead on context and agent coverage to justify a separate line item. This round buys Harmonic time to prove it can.

What to do now

  1. Build an inventory of AI use. Use proxy, DNS, endpoint and SaaS logs to find the AI services, apps, extensions and MCP connectors in use. This supports the Cyber Essentials requirement to know and control your software.
  2. Write a short, usable AI policy. Name approved tools, ban specific data types (credentials, special category data, unreleased financials) and explain how staff can request new tools.
  3. Lock down connectors and agents. Treat OAuth grants and MCP integrations as privileged access. Review them, apply least privilege and remove unused ones, in line with Cyber Essentials user access control.
  4. Apply secure configuration to approved AI services. Enforce single sign-on and MFA, turn off training on your data where the option exists, and set retention to the minimum.
  5. Evaluate controls with your own data. When trialling a product, test detection on realistic samples and check where prompts are processed and stored.
  6. Update incident response and DPIAs. Add AI data leakage scenarios to playbooks and record AI processing in DPIAs.

Bottom line

Harmonic’s $50m round shows investors backing tools that govern the AI staff already use, and that a team with London roots can compete for that market. For UK security leaders, the takeaway is not to buy this particular product. It is to accept that shadow AI is now a mainstream data protection risk. Get visibility, set clear rules and control the connectors, then decide which tools will enforce those rules.

Sources

Related Posts