What are the top AI governance startups by revenue today?

The ranking of top startups in the AI governance market by revenue

Below is a table ranking all the companies in this market by their current revenue scale. You can find our methodology at the end of this page.

If you want a deeper understanding of the market and its current dynamics, get our report covering the AI Governance Market.

Which AI governance startups make the most revenue today?

HiddenLayer has the strongest claim to the top spot today, with Fiddler AI, Zenity and Holistic AI forming the clearest group behind it.

HiddenLayer's CEO has said the company now generates ARR in the tens of millions of dollars. Fiddler AI's best current external estimate is around $30.7 million of annual revenue, Zenity's is roughly $19.4 million, and Holistic AI's is about $13 million.

The big caveat is that these are not four equally clean numbers. HiddenLayer gave an actual company-level ARR indication. Fiddler, Zenity and Holistic AI have not published comparable revenue figures, so their amounts come from outside estimates. That makes the top group easier to identify than the exact order inside it.

Below those four, the market drops into a crowded group around $5 million to $9 million, where differences of a few hundred thousand dollars are mostly noise.

Rank	Startup	Best current commercial figure	What the figure is
1	HiddenLayer	ARR in the tens of millions	Company-disclosed ARR
2	Fiddler AI	~$30.7M	External annual-revenue estimate
3	Zenity	~$19.4M	External annual-revenue estimate
4	Holistic AI	~$13M	External annual-revenue estimate
5	Monitaur	~$8.1M	External annual-revenue estimate
6	Credo AI	~$7.9M	External annual-revenue estimate
7	WitnessAI	~$7.8M	External annual-revenue estimate
8	RagaAI	~$8.9M	External estimate with conflicting evidence
9	Patronus AI	~$5.8M	External annual-revenue estimate
10	Noma Security	~$5.8M	External annual-revenue estimate

Is HiddenLayer really the largest AI governance startup by revenue?

HiddenLayer is the best-supported current leader in specialist AI governance, although the public data still cannot prove that its revenue is higher than every competitor's.

CEO Chris Sestito told TechCrunch that HiddenLayer's ARR had grown more than tenfold in one year and had reached the "tens of millions of dollars." More than 90% of that increase reportedly came from customers signed during the previous year.

That is stronger evidence than a database guessing a company's revenue from headcount, hiring or web traffic. HiddenLayer also has customers across large technology companies, financial services, the U.S. Department of Defense and the intelligence community.

The ambiguity is the size of "tens of millions." HiddenLayer could be below Fiddler's estimated $30.7 million, close to it or comfortably above it. We still put HiddenLayer first because direct ARR evidence carries more weight than an outside estimate with more decimal places.

How much revenue does Fiddler AI make?

Fiddler AI looks like roughly a $30 million business today, but the company has not publicly confirmed that revenue figure.

Our best current external estimate is approximately $30.7 million a year. The surrounding evidence makes that scale plausible. Fiddler recently raised a $30 million Series C, taking total funding to $100 million, and is pushing beyond model monitoring into what it calls an AI control plane covering evaluation, observability, security, policy enforcement and governance.

That product expansion puts Fiddler across several budgets that used to be separate. An enterprise can use the same platform to understand model behavior, evaluate AI applications, watch production systems and enforce policies around new agent workflows.

We would read $30.7 million as an order-of-magnitude estimate rather than a reported financial result. Fiddler clearly belongs near the top of this market; the exact dollar amount is less certain.

Is Zenity already one of the biggest AI governance startups?

Zenity is already one of the larger AI governance and agent-security startups, with our best current estimate putting annual revenue around $19.4 million.

Zenity moved early into AI-agent security, where companies increasingly need to see which agents exist, what they can access and what they are allowed to do. The company raised $38 million in its Series B and said the round took total funding above $55 million.

The revenue estimate is external, so we would not treat $19.4 million as a company-reported figure. Still, Zenity would need to be very substantially overestimated to fall into the $5 million to $9 million pack beneath it.

Its place in the top group therefore looks fairly robust even if the exact number changes.

How big is Holistic AI today?

Holistic AI appears to generate roughly $13 million a year, which would put it among the few independent AI governance specialists already at eight-figure scale.

Holistic AI is useful to watch because its business is less centered on runtime cybersecurity than HiddenLayer, Zenity or Noma. The company sells governance, risk management, compliance and assurance across enterprise AI systems.

That is useful evidence that companies are paying for dedicated governance software rather than treating governance purely as a feature inside cybersecurity products.

The $13 million figure remains an outside estimate, so confidence is lower than for HiddenLayer. But Holistic AI still looks meaningfully larger than most pure-play governance vendors.

Which AI governance startups have probably passed $10 million in revenue?

HiddenLayer, Fiddler AI, Zenity and Holistic AI are the only specialists we can currently place above roughly $10 million with reasonably strong evidence.

HiddenLayer has disclosed ARR in the tens of millions. Fiddler's best estimate is around $30.7 million, Zenity's about $19.4 million and Holistic AI's around $13 million. After that, our ranking quickly falls into single-digit millions.

That is surprisingly thin for a category attracting this much attention and capital. AI governance already supports real enterprise software businesses, but we are not yet looking at dozens of independent $50 million or $100 million revenue companies.

Funding has simply moved much faster than revenue so far.

Which AI governance startups sit just below the leaders?

Monitaur, Credo AI, WitnessAI, RagaAI, Patronus AI, Noma Security, Arthur and ModelOp currently form the broad second tier of AI governance startups.

Most of these companies appear to sit somewhere around $5 million to $9 million of annual revenue or revenue-equivalent scale. The exact ordering is shaky.

RagaAI, for example, has a nominal estimate above several companies that we rank higher, but separate legal-entity evidence makes that amount harder to trust. Noma has competing outside estimates. Arthur's selected figure is older. WitnessAI has much stronger recent ARR growth than its static revenue estimate captures.

So we would not read too much into whether a company ranks sixth or eighth. The useful point is that a large group of AI governance startups has reached mid-single-digit-million commercial scale, while only a few have clearly broken away.

Startup	Best scale figure	What makes the figure tricky
RagaAI	~$8.9M	Conflicting entity-level evidence
Monitaur	~$8.1M	Current external estimate
Credo AI	~$7.9M	External estimate, with growth evidence
WitnessAI	~$7.8M	Estimate looks backward while ARR is growing quickly
Patronus AI	~$5.8M	External estimate, with 15× reported revenue growth
Noma Security	~$5.8M	Different estimators disagree
Arthur	~$5.6M	Figure reflects an older period
ModelOp	~$5.1M	Current external estimate

Is WitnessAI bigger than its current revenue estimate suggests?

WitnessAI is one of the clearest cases where today's revenue estimate may already lag the company's real commercial trajectory.

WitnessAI says ARR grew by more than 500% over the previous 12 months. It also expanded headcount fivefold and says its platform is now deployed across major financial institutions, utilities, airlines, automakers, retailers and telecom companies.

The company raised another $58 million as it expanded from monitoring AI usage into securing AI agents themselves. Its platform now watches which agents are active, which tools and MCP servers they access and what information they share.

We still cannot turn 500% growth into a clean revenue figure because WitnessAI does not disclose the starting ARR. But among companies in the current $5 million to $9 million cluster, WitnessAI is one of the fastest-moving.

How fast is Noma Security growing?

Noma Security is growing at a pace that makes its current revenue estimate look almost secondary.

Noma disclosed more than 1,300% ARR growth over a year, with customers across financial services, life sciences, retail and large technology companies. The company then raised a $100 million Series B less than a year after its previous funding round.

The product has also moved deeper into agent governance. Noma can discover agents, models and MCP servers, control which data and systems agents can access, red-team AI applications and enforce protections while those applications are running.

A 1,300% growth rate needs context because a tiny base can produce a spectacular percentage. For now, Noma stays below companies with stronger absolute revenue evidence. Still, its growth makes the roughly $5.8 million outside estimate one of the figures most likely to become stale quickly.

Is Patronus AI becoming a major AI governance company?

Patronus AI is becoming a serious AI assurance business, with revenue reportedly growing 15-fold over the previous year.

Patronus began with model evaluation and has expanded into digital environments where AI agents can be tested against realistic tasks before they are trusted in production. TechCrunch reported that virtually every frontier AI lab and many emerging AI companies now use Patronus.

The company also raised a $50 million Series B, taking total funding to roughly $70 million.

Our best current absolute revenue estimate is only around $5.8 million, so Patronus has not yet reached the scale of Fiddler or HiddenLayer based on the evidence we can see. But 15× growth puts it among the fastest-moving companies in the ranking.

Why are AI agent governance startups growing so fast now?

AI agent governance is growing quickly because companies now need to control software that can take actions rather than simply generate answers.

An AI model might produce text. An AI agent can query a database, call an API, use credentials, interact with an MCP server, edit a file or trigger another application. Every added capability creates another permission, security and governance problem.

That has changed what enterprises buy. Security teams increasingly want to discover which agents exist, understand what they can access, watch what they do and stop unsafe actions in real time.

The commercial numbers line up with that change. HiddenLayer reported more than 10× ARR growth. WitnessAI reported more than 500%. Noma reported more than 1,300%. Patronus reported 15× revenue growth.

Those percentages come from different starting points, so they should not be compared mechanically. Taken together, they show that agent security and governance are currently growing much faster than a normal mature enterprise-software category.

Is AI governance turning into a cybersecurity market?

A growing share of AI governance spending is moving toward cybersecurity teams, especially around AI agents and systems already running in production.

HiddenLayer protects models, agents and workflows. Noma combines discovery, access control, red teaming and runtime protection. WitnessAI watches how employees and agents interact with models, tools, data and MCP servers. Zenity focuses heavily on controlling agent behavior across enterprise systems.

Traditional governance vendors still matter. Holistic AI, Credo AI, Monitaur and ModelOp address policy, inventory, model risk, compliance and documentation that enterprises still need.

The fastest growth, though, is clustering where governance becomes enforceable. Companies appear particularly willing to pay when the product can block data leakage, limit agent permissions, stop prompt attacks or prevent an AI system from doing something dangerous.

Why are cybersecurity companies buying AI governance startups already?

Large cybersecurity vendors are buying AI governance and AI-security startups before most of them have reached large standalone revenue.

Check Point paid approximately $201.8 million for Lakera. F5 paid $145.2 million in cash for CalypsoAI and another $50.1 million for SurePath AI. SentinelOne bought Prompt Security, while Cisco acquired Robust Intelligence.

The attraction is straightforward. Large security vendors already have enterprise customers, established sales teams and existing security budgets. Acquiring a specialist gives them technology they can distribute through that installed base rather than spending years building the same capability internally.

Current revenue can therefore be quite small relative to acquisition value. Check Point described Lakera as a way to expand protection for generative AI and autonomous agents. F5 wanted CalypsoAI's real-time threat defense, red teaming and data-security technology. Cisco built Robust Intelligence into its broader AI Defense effort.

These acquisitions also distort the independent-startup ranking over time. Some of the strongest products disappear from the standalone list because a larger platform buys them.

Startup	Buyer	Public transaction evidence	What the buyer wanted
Lakera	Check Point	~$201.8M consideration	Agentic and generative-AI security
CalypsoAI	F5	$145.2M cash	Threat defense, red teaming, data security
SurePath AI	F5	$50.1M	AI discovery and shadow-AI detection
Prompt Security	SentinelOne	Price not publicly broken out	Runtime GenAI and agent security
Robust Intelligence	Cisco	Price not publicly disclosed	AI model and application security

Does funding tell us which AI governance startups are actually the biggest?

Funding tells us surprisingly little about which AI governance startups make the most revenue today.

Noma raised $100 million in one round while its available revenue evidence still sits in the mid-single-digit millions. WitnessAI raised $58 million. Patronus raised $50 million. Fiddler raised $30 million despite already appearing commercially larger than several startups raising bigger rounds.

Investors are paying for what these companies might become, especially if AI agents become a standard part of enterprise software. Revenue answers a different question: how much commercial scale exists already.

That distinction is particularly important in AI governance because valuations and funding rounds have moved well ahead of disclosed operating results.

How many AI governance startups are still below $5 million in revenue?

Most AI governance startups with usable commercial data still appear to generate less than about $5 million a year.

ValidMind, Openlayer, SPLX AI and Enkrypt AI sit around the $3 million to $5 million range in our research. Straiker, Acuvity, Vijil, Saidot and Gray Swan are closer to roughly $2 million to $3 million. Naaia and Modulos are below $2 million on the best current estimates we found.

Then there is another group where even that level of precision is impossible. Geordie AI, Lasso Security, Onyx Security, NeuralTrust, Runlayer and others disclose growth, customer deployments or usage rather than an absolute revenue figure.

So the startup population is large, but the commercial market remains top-heavy. A relatively small group has reached meaningful eight-figure or high-single-digit-million scale.

Which smaller AI governance startups are growing too fast to ignore?

Geordie AI, NeuralTrust and Runlayer are three smaller or less transparent companies worth watching even without a clean revenue number.

Geordie AI reported 1,300% ARR growth during the first five months of the year and raised a $30 million Series A. The company's product focuses directly on governing and securing enterprise AI agents.

NeuralTrust said its first-quarter ARR alone doubled its full-year ARR from the previous year. Its customers include large airlines, banks, energy companies and government organizations.

Runlayer has not disclosed revenue, but Fortune reported that the company signed more than 12 unicorn customers, while one Fortune 500 bank uses the platform to monitor AI activity across more than 100,000 employees and 200,000 devices. Runlayer also raised a $30 million Series A after coming out of stealth only months earlier.

None of those figures lets us place the companies accurately in the revenue table. They do show where the next group of challengers may come from.

Can user counts or AI requests tell us which governance startups make the most money?

User counts and usage volumes are useful for spotting real adoption, but they are too weak to turn into revenue.

Promptfoo is a good example. OpenAI said the platform was trusted by teams at more than 25% of Fortune 500 companies when it announced plans to acquire the startup. That is powerful evidence of enterprise adoption, but OpenAI did not disclose Promptfoo's revenue.

Runlayer has large enterprise deployments. Other young governance companies disclose API requests, evaluations, agents monitored or customers signed.

Pricing varies too much to reverse-engineer reliable revenue from those figures. A billion API requests could produce very different revenue depending on contract structure, product bundling and pricing.

We therefore keep usage as supporting evidence rather than multiplying it by an assumed price.

Is regulation finally creating real demand for AI governance software?

Regulation is now creating concrete work for AI governance teams, although security concerns are driving demand at the same time.

Several parts of the EU AI Act are already enforceable, including provisions covering prohibited AI practices, certain transparency requirements and general-purpose AI models. Important requirements for high-risk systems come later.

That forces larger organizations to know which AI systems they use, classify risks, maintain documentation, control deployment and preserve evidence that policies are being followed. Those jobs map directly onto products sold by Holistic AI, Credo AI, ModelOp, Monitaur and similar vendors.

The security side is moving even faster because companies do not need a regulator to tell them that an autonomous agent with access to sensitive data can create a problem. Regulation gives governance teams a durable compliance budget; agents add immediate operational pressure.

Are traditional AI governance platforms losing ground to security-first startups?

Traditional AI governance platforms still have a real business, but security-first companies are currently producing the more aggressive growth numbers.

Holistic AI appears to be one of the larger companies in the entire ranking. Credo AI, Monitaur and ModelOp also have meaningful commercial scale, so policy, model risk and compliance software clearly still sells.

What changed is the urgency around runtime risk. An enterprise can schedule a governance review. It has much less flexibility when an agent can leak information, call the wrong tool or take an unauthorized action today.

That also changes the buyer and the budget. Security teams already spend heavily on controls that operate continuously, giving runtime AI-governance vendors a familiar route into large enterprises.

Over time, the categories will probably overlap more. Governance platforms are adding security controls, while security companies are adding policy, inventory and audit features.

Why are AI governance startup revenue numbers so hard to trust?

AI governance revenue is unusually messy because most of the important companies are private and very few publish audited standalone financials.

We often have one company disclosing ARR growth, another providing customer counts and another saying nothing about revenue at all. External databases fill some of those gaps, but estimates can differ sharply.

Corporate scope creates another problem. A number may cover one legal entity, one product, one geography or an acquired business rather than the full company. Historical figures also become stale quickly when startups are growing several hundred percent a year.

We give direct revenue measures more weight than estimates, and strong ARR or run-rate disclosures more weight than user counts or traffic. Freshness helps when the evidence is otherwise similar, but a new weak metric does not automatically beat an older solid revenue figure.

That is why we do not treat differences such as $7.9 million versus $7.8 million as meaningful precision. The figures are good enough to identify commercial tiers; they are rarely good enough to pretend every ranking position is exact.

How concentrated is revenue among the biggest AI governance startups?

AI governance revenue is still concentrated among a surprisingly small number of startups.

Only four companies in our research clearly sit around or above eight-figure annual scale. Beneath them, a cluster of businesses sits around $5 million to $9 million, followed by a long tail under $5 million.

The market is ahead of itself in one sense. There are already dozens of vendors, major funding rounds and aggressive acquisition activity, yet only a handful of independent specialists have built large revenue bases.

A few big enterprise contracts can still change the position of many companies in the middle of this ranking.

Could the AI governance revenue ranking change quickly?

The AI governance ranking could look materially different within a relatively short period because several companies below the leaders are still growing at extreme rates.

HiddenLayer itself shows how quickly a company can break out. More than 90% of its recent ARR growth reportedly came from customers added during the previous year.

As seen above, WitnessAI has reported more than 500% ARR growth, Noma more than 1,300%, Patronus 15× revenue growth and Geordie AI 1,300% ARR growth over five months. Those figures start from different bases, but all four point to businesses changing too quickly for annual third-party estimates to stay accurate for long.

Acquisitions can reshuffle the list just as quickly. Lakera, CalypsoAI, Prompt Security, Robust Intelligence and Promptfoo have all moved or are moving into larger technology companies.

So today's ranking is best read as a picture of demonstrated commercial scale now, rather than a prediction about who will lead several years from now.

So, which AI governance startups are actually the revenue leaders today?

HiddenLayer is our best-supported current leader, with Fiddler AI and Zenity the strongest challengers and Holistic AI rounding out the clearest top group.

HiddenLayer combines direct company-disclosed ARR in the tens of millions with more than 10× annual growth. Fiddler's best external estimate is around $30.7 million, Zenity's around $19.4 million and Holistic AI's around $13 million.

Below them, the ranking gets much less precise. Monitaur, Credo AI, WitnessAI, RagaAI, Patronus AI, Noma Security, Arthur and ModelOp all sit in a broad single-digit-million cluster based on the strongest evidence we found.

The most interesting change is inside that second group. Agent security and runtime governance companies are growing much faster than their static revenue estimates suggest, while cybersecurity incumbents are already buying specialists before they reach major standalone scale.

For now, HiddenLayer has the strongest combination of current scale, direct evidence and growth. Fiddler and Zenity remain close enough that one solid company disclosure could change the order, while WitnessAI, Noma and Patronus are the clearest fast-moving challengers beneath them.