The archive · AI & Models · Strategic decision · 2022–2026
Cranium Bets EU AI Act Makes AI Safety a Necessity
KPMG-incubated AI security firm spun out in 2023, raised $25M, betting on regulation.
Cranium
What the business is
Provides AI security and governance SaaS for large enterprises: automatically discovers and inventories all AI models, agents, and third-party AI suppliers within an organization, conducts red-team security testing, and generates compliance proof such as AI Cards.
Starting capital：Cumulative $32M: 2023 seed round (backed by KPMG and SYN Ventures), 2023-10 Series A $25M (led by Telstra Ventures, with KPMG LLP and SYN Ventures participating).
How it started
Founded in 2022 inside KPMG’s startup incubator KPMG Studio, it was the first spin-out company incubated by KPMG, and all four founders came from KPMG’s cybersecurity and AI business; in 2023-04 it emerged from stealth and began independent operations, with seed funding from KPMG and SYN Ventures. Founder Jonathan Dambrot saw that after ChatGPT was released, every enterprise was deploying AI, but no one could clearly say what data these models were using, whether they could be attacked, or whether they were compliant.
What happened
In 2023-10 it completed a $25M Series A (led by Telstra Ventures), bringing cumulative funding to $32M; it launched AI Card (packaging an AI application’s safety, use, data, and governance into a shareable compliance profile) and AI Maturity Score. In 2025-05 it released the Arena red-team platform, focusing on LLM prompt injection testing and EU AI Act/NIST RMF audit readiness; the product line subsequently expanded to agent monitoring (AgentSensor), cloud and compliance modules, and the official website states that the Govern module directly maps to the EU AI Act.
How it ended up
Still running, and the regulatory dividend is being realized: the EU AI Act becomes fully applicable on 2026-08-02 (high-risk provisions were extended by the AI Omnibus to 2027-12/2028-08), turning “being able to prove AI safety” from a slogan into a legal obligation. A third-party profile says its 2025-09 annual recurring revenue was about $7.3M and that in 2026-05 it acquired agent AI security company Aiceberg; the official website claims recognition such as Gartner Cool Vendor 2025 and Fortune Top 50 Cybersecurity Companies 2025.
Background
Cranium, a New Jersey AI safety firm, incubated in KPMG in 2022, spun out in 2023-04. It bets that EU AI Act will make proving AI safety a procurement must-buy. Act enters force 2024-08-01, applicable 2026-08-02.
It offers AI asset inventory and red-team testing, packaging compliance into AI Cards. In 2023-10 raised $25M Series A (Telstra Ventures, KPMG, SYN), total $32M. Released Arena red-team platform in 2025-05.
As of 2026-09, still expanding. Act fully applicable; prohibitions from 2025-02, GPAI from 2025-08, high-risk delayed to 2027-12. Third-party: 2025-09 ARR ~$7.3M, acquired Aiceberg 2026-05. Recognized as Gartner Cool Vendor 2025, Fortune 2025 Cybersecurity 50.
What has to be true
- The EU AI Act turns AI governance from an optional item into a legal obligation and provides a phased effective-date timetable, forcing enterprises to buy tools now rather than wait.
- Starting from KPMG incubation means having an enterprise client channel from day one, turning “compliance demand” directly into early revenue rather than doing market education from scratch.
- The product first delivers lightweight items such as “inventory + AI Card proof,” then extends to red-team testing and agent monitoring, gradually expanding categories along enterprise demand.
- The regulatory dividend comes in multiple waves: 2024 entry into force, 2025 prohibitions, 2026 applicability, and 2027 high-risk rules, with each deadline recreating procurement urgency.
What can be applied
Productize compliance early to lock in niche; Cranium used KPMG channel and time before regulations.
Aftermath
As of 2026-09, Cranium operates independently. EU AI Act fully applicable since 2026-08-02. Third-party data: 2025-09 ARR ~$7.3M, headcount ~62, acquired Aiceberg in 2026-05. Recognized by Gartner, Fortune 2025 Cybersecurity 50. Risks: competition and customer concentration.
Sources
- AI Act
- Cranium raises $25M to fund enterprise AI monitoring, security, and compliance platform
- Cranium raises $25m in series A funding to advance AI security solutions
- Cranium Launches Arena: The Industry's First AI Red Teaming Platform That Extends to the AI Supply Chain
- Cranium (company profile)
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card