Ent's $100M seed bets 'intent-aware' endpoint security beats reactive detection

RiskIQ founders re-emerge with Ent: on-device AI reads user and agent intent to prevent risky actions before they finish; $100M seed led by Decibel.

Ent

它在赌什么That security must shift from detecting bad actions after the fact to understanding user and agent intent, preventing risky actions before damage is done.已上线

做的是什么生意

Sells an intent-aware endpoint security platform that runs lightweight agents and AI reasoning on devices (Windows, macOS, Linux, browsers) to monitor human and AI-agent behavior, intervene in real time, and prevent risky actions.

启动资金：$100M seed led by Decibel, announced June 2026

起因

Ent was founded in San Francisco in May 2025 by Elias Manousos and Brandon Dixon, who co-founded attack-surface firm RiskIQ, sold it to Microsoft in July 2021, and then worked on Microsoft Security Copilot. Their argument: endpoint detection and response only fires after something bad has happened, but AI-driven attacks can complete intrusion chains in seconds, so detection-first security is structurally too slow. On June 16, 2026 Ent came out of stealth with a $100M seed led by Decibel, with Sequoia, Crosspoint Capital, Craft Ventures, Shield Capital, Felicis and In-Q-Tel also investing, and about a dozen employees.

新闻Ent's intent-aware platform — AIToday/ISMG

经过

The platform reads signals such as app switching, copy-paste, file uploads and AI-assistant interactions to build a picture of intent, applies customer-defined policies, and intervenes before an action is finalized; it is available as SaaS or self-hosted and generally available on Windows, macOS, Linux and as a browser extension. Ent says it is already deployed with Global 2000 customers in hospitality, financial services and defence, for insider-risk detection, AI governance, data loss prevention, threat prevention and incident investigation. Advisers include former CISOs of Google, Aetna and MassMutual plus former senior NSA and Microsoft Azure Cloud Security officials.

新闻Ent raises $100M seed — SecurityBrief

结果

Live and scaling as of September 2026: the $100M is going into engineering and go-to-market hiring; the bet is unproven against the incumbent EDR/XRDR vendors it says are stuck in a reactive loop.

背景

Ent is a San Francisco endpoint-security startup founded in May 2025 by Elias Manousos and Brandon Dixon, the duo who co-founded RiskIQ, sold it to Microsoft in 2021, and then worked on Microsoft Security Copilot. The company's bet is that endpoint security's reactive model is broken: conventional EDR and XDR spot malicious code and post-execution behavior, but by the time an alert fires, an AI-driven attack may already be done. Ent instead reads what users and AI agents are trying to do — intent — and intervenes before a risky action is completed.

Ent came out of stealth on June 16, 2026 with a $100M seed led by Decibel, with Sequoia, Crosspoint Capital, Craft Ventures, Shield Capital, Felicis and In-Q-Tel participating. The platform runs a lightweight agent and specialized AI models on the device, captures signals such as app switching, copy-paste, uploads and AI-assistant interactions, applies customer-defined policies in real time, and offers an escape valve — users can converse with the AI engine when an intervention is wrong, which the founders argue keeps false positives from destroying workflows.

Ent says it is already deployed with Global 2000 customers in hospitality, financial services and defence, for insider-risk detection, AI governance, data loss prevention, threat prevention and incident investigation; the product is generally available for Windows, macOS, Linux and browsers, as SaaS or self-hosted. Investors frame it as a bet on a paradigm shift: prevention at the moment of decision rather than signals that arrive after the action is complete, with In-Q-Tel noting agencies where AI adoption is outpacing governance.

As of September 2026 the round is funding engineering and go-to-market hiring. The open question is whether intent-aware prevention can displace the established endpoint vendors — and whether on-device AI reasoning is genuinely better, not just a new architecture with the same false-positive problem.

这件事要成立，得有什么

AI attacks can complete in seconds, so post-hoc detection is structurally too slow; prevention requires understanding intent before an action finishes.
The endpoint is where employees and AI agents touch data, apps and AI systems — a natural vantage point for intent telemetry.
Founder credibility: the RiskIQ team already built and sold a category leader, then worked on Microsoft Security Copilot inside the incumbent ecosystem.
On-device AI reasoning plus an explanation and escape valve attacks the false-positive problem that makes prevention controls get disabled by users.
AI governance is an expanding market — insider risk, DLP, AI governance and threat prevention — and one intent layer can serve several use cases at once.

可借鉴之处

A founder who has already sold a category leader can raise a record seed on a reframe — but the reframe must attack the incumbent's structural weakness (post-hoc detection), not just its features.

后续进展

As of September 2026, Ent has $100M in seed funding led by Decibel, about a dozen employees at launch, and Global 2000 deployments in hospitality, financial services and defence. The company is hiring across engineering and go-to-market and developing AI governance, threat prevention, integrations and endpoint intelligence. It has not disclosed revenue; the bet on intent-aware prevention replacing reactive detection is still being tested against incumbent EDR and XDR vendors.

资料来源

发现哪里写错了？告诉我们。

轮到你了

你刚读完一家。说说你在做什么，看看谁在赌同一件事。

免费账号 · 3 次免费提问 · 不用绑卡