AI Safety Funding Tracker (170 deals)

Our funding tracker covering the AI safety market

Below is the table listing all the deals. You may find our methodology at the end of this page.

And, if you want to gain a deeper understanding of the market and its current dynamics, get our report covering the AI Safety Market.

Is AI safety funding actually a big market right now?

AI safety funding is already a multibillion-dollar market, but the normal startup here raises single-digit millions rather than the giant checks that dominate the headlines.

We counted 170 qualifying financings across 147 companies, representing $3.872 billion of capital. The comparable median round comes to $7.3 million, while the average reaches $22.7 million. That gap gives us an immediate sense of how skewed the market is.

Take out financings above $50 million and the capital total falls to $1.566 billion. Meanwhile, 70.6% of all rounds are Seed, and 91.5% of financings with a known stage are either Seed or Series A.

There is plenty of real venture activity here today. It just sits inside a market that is much younger, smaller at the company level and more concentrated at the top than the $3.9 billion headline suggests.

Metric	Result
Financing records	170
Funded companies	147
Capital raised	$3.872B
Comparable median round	$7.3M
Comparable average round	$22.7M
Capital excluding >$50M rounds	$1.566B
Companies with multiple rounds	22
Seed share of all deals	70.6%
Seed + Series A share of classified deals	91.5%

Is Safe Superintelligence making the AI safety market look bigger than it really is?

Safe Superintelligence has an enormous effect on AI safety funding: its $1 billion financing alone represents roughly 26% of all the capital we tracked.

The concentration extends beyond SSI. Sixteen rounds above $50 million account for just 9.4% of deals but almost 60% of capital.

There is still a sizeable market underneath the $1 billion outlier. Goodfire reaches $157 million of qualifying capital, Onyx Security $148 million, Noma Security $132 million and Braintrust $116 million. Zenity, HiddenLayer and LMArena also appear around or above the $100 million mark in our AI safety cohort.

Yet SSI changes the scale of the whole picture. Its single financing is almost seven times the combined capital raised by all 57 sub-$5 million deals. Bloomberg reported that the money was intended in large part for computing capacity and technical hiring, which helps explain why this financing sits so far outside ordinary software-startup economics.

By company, the concentration is equally clear: the ten largest recipients hold 53% of all capital raised during the period.

Company	Capital in our AI safety dataset	Qualifying rounds
Safe Superintelligence	$1.000B	1
Goodfire	$157M	2
Onyx Security	$148M	2
Noma Security	$132M	3
Braintrust	$116M	2
Zenity	$115M	1
HiddenLayer	$100M	1
LMArena	$100M	1
Neo	$100M	2
WitnessAI	$85.5M	2

How many AI safety startups are actually getting funded?

The funded AI safety market currently contains 147 companies, and most of them have only one visible financing in our window.

We found 125 companies with one qualifying round, 21 with two rounds and just one with three or more. In other words, 85% of the companies appear only once.

Part of that comes from how young the sector is. A startup funded for the first time recently has simply not had much time to return for another round. Earlier financings can also fall before the start of our research period.

Still, the shape is hard to miss. AI safety has a wide entry funnel, with lots of companies getting an initial shot at venture capital, followed by a much smaller group that investors fund again.

Noma Security is one of the clearest examples of that smaller group. We track a $7 million Seed, a $25 million Series A and a $100 million Series B. Goodfire also moved quickly from a $7 million Seed into much larger rounds.

So when we talk about a market with 170 deals, the more useful mental picture is roughly 150 funded companies, most of them still early in their financing history.

What does a normal AI safety funding round actually look like?

A normal AI safety funding round is still fairly small: almost four out of five comparable deals come in below $20 million.

We counted 57 rounds below $5 million and another 74 between $5 million and $20 million. Together, those buckets represent 131 of the 169 financings we can compare cleanly on round size.

The jump from frequency to dollars is striking. Those 57 smallest rounds contribute only $145.5 million, while seven $100 million-plus financings absorb $1.678 billion.

Founders therefore face a market with a very broad low end and a tiny, extremely valuable upper tier. A $5 million to $10 million financing sits close to the center of the market. A $100 million round belongs to a completely different funding regime.

Round size	Deals	Share of deals	Capital
Under $5M	57	33.7%	$145.5M
$5M to under $20M	74	43.8%	$731.4M
$20M to under $50M	21	12.4%	$609.0M
$50M to under $100M	10	5.9%	$678.0M
$100M+	7	4.1%	$1.678B
Total comparable rounds	169	100%	$3.842B

Where is the serious money going in AI safety right now?

AI safety money is flowing most heavily into model robustness, guardrails, risk platforms and evaluation, with recent large rounds making agent security especially hard to ignore.

Model Robustness Tools lead on capital at $1.211 billion, although SSI explains most of that result. Guardrail Platforms are much broader, with 50 deals and $926.1 million. AI Risk Platforms contribute another $705.1 million across 44 financings.

The newer rounds show where the market is moving these days. HiddenLayer raised $100 million around AI security monitoring and runtime protection. Lasso Security added $30 million around guardrails. AIR Security disclosed two Seed financings totaling $50 million for technology that vets the skills, plugins and MCP servers used by AI agents. Zenity's large round sits around controlling what enterprise agents can actually do.

Evaluation is developing its own scale layer. LMArena's $100 million Seed sits at one extreme, while Arize reached a $70 million Series C around evaluation and observability for production AI systems.

More and more of the money is going to the points where AI systems meet the real world: evaluation before deployment, continuous monitoring after deployment and controls around autonomous actions.

Category	Deals	Companies	Capital	Median round
Model Robustness Tools	11	10	$1.211B	$7.0M
AI Guardrail Platforms	50	43	$926.1M	$10.0M
AI Risk Platforms	44	40	$705.1M	$6.68M
AI Evaluation Tools	26	23	$519.8M	$5.35M
AI Safety Monitoring	23	22	$294.1M	$7.0M
AI Red Teaming	16	12	$216.2M	$6.0M

Is Model Robustness really the biggest AI safety opportunity?

Model Robustness leads the funding table, but its apparent dominance mostly comes from one extraordinary company rather than a huge pool of heavily funded startups.

SSI accounts for 82.6% of all Model Robustness capital. Remove that one financing and the category looks far less exceptional.

Goodfire shows that investors will still back interpretability and robustness at serious scale. Its financing history moved from a $7 million Seed to much larger checks, including a $150 million Series B. The company is working on infrastructure for understanding and manipulating the internal behavior of advanced models, including work at frontier-model scale.

The broader commercial base currently sits elsewhere. Guardrails and Risk Platforms spread hundreds of millions of dollars across dozens of companies rather than concentrating almost everything in one outlier. Evaluation also has a broader ladder, with companies ranging from small early-stage tools to scaled players such as Arize.

For now, Model Robustness has the biggest capital number. Guardrails, Risk Platforms and Evaluation give a better picture of what a diversified AI safety software market looks like.

How young are AI safety startups when investors back them?

AI safety startups are getting funded very early: the median company is only one year old when it raises a qualifying round.

The progression stays surprisingly fast as companies move up the ladder. Median company age is one year at Seed, two years at Series A, three years at Series B and five years at Series C.

The founding cohorts make the same point from another angle. Among the 145 companies where we could establish a reliable founding year, roughly 43 were founded in 2023, 29 in 2024 and 38 in 2025. Those three cohorts make up around three quarters of the observable company population.

Some companies compress the timeline even further. Goodfire was founded in 2024 and had reached a nine-figure Series B roughly two years later. LMArena's commercial company was formed in 2025 and raised $100 million as a Seed financing. AIR Security was founded in 2026 and disclosed $50 million across two Seed rounds soon afterward.

A lot of today's funded AI safety sector was built after the generative-AI boom had already begun. The age profile looks much more like a newly forming technology category than an old software industry adopting a new label.

Why does AI safety funding fall off so hard after Seed?

AI safety funding has a very wide Seed funnel and a brutal drop-off after it: 120 Seed rounds shrink to 30 Series A, 11 Series B and only three Series C financings.

The first contraction is the biggest in absolute terms. There are four Seed rounds for every Series A in our dataset. From Series A to B, the ratio is roughly 2.7 to one.

Some of that narrowing is simply time. Most companies are still young enough that they could not realistically have progressed through several institutional rounds yet.

Even with that caveat, the market already has a visible selection point. Investors seem quite willing to fund experiments, new security approaches and new evaluation products. Much fewer companies get the money needed to scale a large enterprise business.

There is also no Series D or Growth Equity financing in the cohort. For a market with billions of dollars in total funding, the traditional late-stage layer is still remarkably thin.

Stage	Deals	Capital	Median round	Median company age
Seed	120	$887.6M	$5.0M	1 year
Series A	30	$771.3M	$19.5M	2 years
Series B	11	$807.6M	$80.0M	3 years
Series C	3	$215.0M	$70.0M	5 years
Unknown	6	$1.190B	$44.0M	-

Why are the few AI safety Series B rounds so huge?

AI safety Series B rounds are unusually large because investors appear to reserve them for companies that already look capable of becoming major infrastructure or security vendors.

The median Series B reaches $80 million. That compares with $19.5 million at Series A.

Noma Security raised $100 million after moving through much smaller earlier rounds. Onyx Security reached $113 million for a platform designed to discover and control enterprise AI agents. HiddenLayer raised $100 million as companies pushed more autonomous AI into production. Goodfire went even higher with a $150 million financing around interpretability infrastructure.

Those businesses need more than another handful of engineers. They are building technically demanding products while expanding enterprise sales, integrations, security research and infrastructure at the same time.

Series B is starting to look like a second qualification test. Very few companies get there, but the ones that do can suddenly access capital at a scale that looks nothing like the Seed market.

Do investors put more money into repeat AI safety bets?

AI safety investors write much larger checks once a company comes back for more money: the median follow-on is $15 million, three times the $5 million median for a first financing.

The deal count itself is almost evenly split. We classify 85 financings as first rounds in the company's visible history and 81 as follow-ons, with four cases where the status could not be established confidently.

Capital leans more heavily toward the follow-ons. They account for $2.105 billion versus $1.674 billion for first financings, even though SSI alone contributes $1 billion to the first-financing side.

That fits the rest of the dataset. Investors make a lot of relatively small initial bets, then put substantially more money behind the companies that return with stronger evidence of product demand, technical credibility or a route into large enterprise accounts.

New company formation therefore remains healthy. The bigger concentration happens after the first check.

Is AI safety still basically a U.S. funding market?

AI safety funding is still overwhelmingly centered on North America, with the United States taking most of the companies and an even larger share of the dollars.

North America accounts for 111 deals across 97 companies and $3.216 billion of capital, or 83.1% of the market total. The United States alone contributes 109 financings and roughly $3.206 billion.

SSI inflates the dollar share, but removing its $1 billion round would leave North America far ahead. Goodfire, Onyx Security, Braintrust, HiddenLayer, LMArena and WitnessAI all add sizeable U.S.-linked financing activity.

Israel is the clearest secondary cluster. We count 22 deals and $453.7 million across the Middle East grouping, driven heavily by Israeli-founded security companies such as Noma, Lasso and AIR.

This concentration makes sense given the overlap between AI safety, cybersecurity, frontier-model research and enterprise software. Right now, the deepest pools of specialist talent and venture capital for those businesses remain heavily concentrated in the U.S. and Israel.

Why is Europe raising so much less AI safety money?

Europe is producing a meaningful number of AI safety companies, but those companies are raising much smaller rounds than their North American counterparts.

We counted 30 European deals across 28 companies, which gives Europe 17.6% of the deal count. Its capital share is only 4.7%, at $181.5 million.

The median European financing is around $3.08 million. We also found no European round above $50 million in this cohort.

Asia-Pacific is thinner again, with seven deals and just $20.4 million of capital.

We should be careful about turning that gap into one neat explanation. Venture-market depth, company age, headquarters choices and taxonomy all play a role, and some Israeli or European-founded businesses later establish a major U.S. commercial presence.

The funding difference itself is much less ambiguous. Europe is participating in AI safety company creation today, but scale capital remains heavily concentrated elsewhere.

Which investors keep leading AI safety funding rounds?

No small venture club controls AI safety funding right now: we found 163 different disclosed lead or co-lead names, and only 19 lead more than one deal.

Andreessen Horowitz is the most frequent recurring lead with six appearances. Bessemer Venture Partners and SYN Ventures each show up four times. Redpoint, Sequoia, Race Capital and Hetz Ventures appear three times each.

That is remarkably dispersed for a market with 170 financing records.

It also reflects the mixed nature of AI safety. Generalist venture firms sit alongside cybersecurity specialists, enterprise-software investors and later-stage funds. Different categories attract different underwriting logic: frontier interpretability looks different from enterprise guardrails, and both look different again from evaluation infrastructure.

For founders, there is no single obvious shortlist of five investors that defines access to this market. The funding base is still broad and fluid.

Lead or co-lead investor	Deals	Combined size of those rounds
Andreessen Horowitz	6	$169M
Bessemer Venture Partners	4	$206.3M
SYN Ventures	4	$84M
Redpoint Ventures	3	$135.5M
Sequoia Capital	3	$97M
Race Capital	3	$25.5M
Hetz Ventures	3	$20M
Evolution Equity Partners	2	$160M
Norwest	2	$143M
Illuminate Financial	2	$82M

Do strategic investors actually matter in AI safety?

Strategic investors are far from universal in AI safety, but their presence rises sharply once rounds get bigger.

We found a disclosed strategic investor in 23.5% of financings. The median round with a strategic participant is $20 million, compared with $6.3 million without one.

The stage mix is even more revealing. Strategics participate in 15 Seed rounds and 13 Series A financings, then appear in seven of the 11 Series B deals and all three Series C rounds.

The companies involved make the logic easy to understand. Arize's Series C included M12, Datadog and PagerDuty. Zenity attracted corporate investors linked to Intel, Hitachi and LG. WitnessAI brought in Qualcomm Ventures and Samsung Ventures. Databricks Ventures has also invested around AI security.

These investors operate close to the infrastructure being protected, monitored or evaluated. Their participation suggests that the larger AI safety companies are becoming strategically relevant to cloud platforms, semiconductor groups, enterprise software vendors and cybersecurity businesses.

Is AI safety funding steady, or does it just explode when a giant round happens?

AI safety deal flow is fairly steady, while the amount of money invested from month to month can swing wildly.

Across the 32 completed months in our research window, the median month contains five financings. The busiest month reaches ten, so deal activity at the peak is only twice the median.

Capital behaves very differently. The median completed month comes to $69.1 million, whereas the largest month reaches just over $1 billion because SSI happened to raise its giant round then. That peak is about 14.6 times the monthly median.

Another high-activity month produced ten deals but only $182 million. That contrast captures the market better than a chart of total capital alone.

Companies are getting funded with reasonable continuity. The big volatility comes from a handful of exceptional rounds landing in different months.

Is AI regulation actually creating more demand for AI safety startups?

AI regulation is becoming a real commercial tailwind for parts of the AI safety market, especially governance and evaluation, although regulation alone cannot explain where the venture money is going.

The EU AI Act gives us the clearest concrete example. Obligations for providers of general-purpose AI models started applying in 2025, including technical-documentation requirements. Providers of models with systemic risk face additional obligations around risk assessment, mitigation, incident reporting and cybersecurity. The European Commission's enforcement powers over these requirements are now in force.

Those requirements land directly on problems that companies in this market sell tools to handle: documentation, model evaluation, risk tracking, monitoring and controls.

At the same time, enterprise AI is creating demand on its own. Companies are moving beyond chat interfaces and giving agents permission to read corporate data, call external tools and take actions. AIR focuses on the software supply chain around those agents. Noma covers agent discovery, governance and runtime security. Zenity controls agent behavior inside enterprise environments. HiddenLayer is pushing further into runtime protection.

Regulation is one part of a broader shift. The commercial opportunity is growing because AI systems are becoming harder to govern at exactly the same time that companies and regulators are asking for more evidence that those systems are safe.

What's still missing from the AI safety funding market?

The biggest thing missing from AI safety funding is a deep population of mature, repeatedly financed companies.

There are only 11 Series B rounds and three Series C financings, with nothing beyond Series C in our cohort. Red Teaming has 16 deals but no Series B or later round. Guardrails have huge activity at the early end but very little traditional later-stage depth.

Large rounds outside North America and Israel are scarce as well. Europe and Asia-Pacific together contribute dozens of financings, yet neither region produces a deal above $50 million in the dataset.

Repeat histories remain short too. As pointed out above, only a small minority of companies come back for multiple qualifying rounds during the period.

These gaps do not mean the market has hit a ceiling. The company population is young enough that a substantial part of the later-stage story simply has not had time to happen.

For now, AI safety has proven that it can create lots of startups and a handful of very valuable scale candidates. It has yet to prove that a large cohort can move predictably through the full venture funding ladder.

What should we actually take away from AI safety funding today?

AI safety funding currently has two very different layers: a broad early-stage market where most checks remain relatively modest, and a narrow upper tier where a few companies can raise $100 million or more.

The headline capital number needs context. A small number of exceptional financings control a huge share of the dollars, while the typical company still operates much closer to Seed economics.

Commercial breadth looks strongest in Guardrails, AI Risk Platforms and Evaluation. These categories contain enough funded companies to feel like actual software markets rather than single-company stories. Model Robustness has attracted extraordinary capital too, but SSI heavily shapes that result.

The funding ladder gets difficult quickly. Lots of teams can raise an initial round; far fewer reach Series A and B, and genuine late-stage depth barely exists so far.

The largest checks increasingly go to companies building infrastructure around production AI: interpretability, evaluation, agent security, monitoring and runtime controls. Investors appear most willing to spend heavily when the product could become part of the layer through which large-scale AI systems are deployed or governed.

Strategic investors strengthen that picture. They remain a minority of the overall market, yet they show up far more often in the larger rounds where AI safety starts to overlap directly with cloud, enterprise software, cybersecurity and computing infrastructure.

The clearest description of AI safety funding today is a young market with a lot of experimentation, a surprisingly narrow scale layer and a small group of companies that investors are already treating like future infrastructure businesses.