Mindgard's $30M and 150 disclosed bugs point to AI attack testing as its own budget line

Mindgard has raised a $30 million Series A led by Album VC, with Karma Ventures, existing investors, .406 Ventures, Atlantic Bridge, IQ Capital and Lakestar also participating ^[1][2][3]. The number that makes this more than another security seed round is the one behind it: the company says it has publicly disclosed more than 150 high-impact vulnerabilities in popular AI applications to date ^[4].

That disclosure record is the product. Mindgard was founded in 2022 as a spinout from Lancaster University, commercialising more than a decade of AI security research, and now operates independently with headquarters in Boston and London ^[5][6][7][8]. Four years from founding to a $30 million Series A works out to roughly 35 to 40 disclosed findings a year, on the company's own count ^[9][10]. Whatever else that is, it is a research cadence, not a scanner signature list.

The argument the round is buying into is that this work does not fold into existing tooling. Chief Executive James Brear says AI is creating an entirely new attack surface and that organisations need a fundamentally different approach, and that the company does not just automate attacks but operationalises the knowledge of offensive security practitioners ^[11]. Ty Boswell, a partner at Album VC, says organisations are moving AI into critical operations without security infrastructure designed for how these systems operate in practice ^[12]. Both statements come from the seller and its lead investor, and should be read that way. The more useful evidence is where the money is landing: Mindgard says the Series A has accelerated deployment among Fortune 2000 companies and AI-native firms across financial services, pharmaceuticals, gaming, digital services, semiconductors and healthcare ^[13]. Six sectors with six different regulators is not a vertical compliance trigger; it looks like a horizontal line item appearing in security budgets independently of industry rules ^[14].

The failure modes being sold against are also not the ones classic appsec was built for. SiliconANGLE's report lists zero-day code execution in AnySphere's Cursor editor, a "trusted workplace" flaw in Google's Antigravity, and image-generation guardrail failures in OpenAI's ChatGPT as examples of vulnerabilities in widely used AI products ^[15][16][17]. Notably, the report describes these as the class of exploit Mindgard studies to strengthen its platform, without explicitly crediting the three to its own disclosures ^[18]. Guardrail bypass and agent trust boundaries do not map onto dependency scanning or static analysis, which is the mechanical reason a separate procurement line is plausible.

Proceeds go to engineering, product, sales and marketing to meet customer demand, per the company ^[19]. That is a distribution problem, not a research one, and it is where the thesis gets tested.

What to watch: whether the 150 figure keeps compounding at the same rate now that headcount is funded, since the disclosure ledger is the only externally verifiable asset here; whether Mindgard's findings continue to name shipping products from large vendors, which is what gives the count procurement weight; and whether buyers keep this as a standalone contract once application security incumbents ship AI attack testing as an included module. A category that survives being bundled is a category. One that does not was a feature.