The person who has to defend this renewal a year from now will have real numbers but a thin case. She can produce runtime logs and a count of quarantined model files, plus the scanner's list of roughly 50 AI file frameworks it parses to confirm a model is what it claims to be, including models hidden inside other models [11]. What she probably cannot produce is the attack that would otherwise have landed. TechCrunch's own framing concedes the gap: there are still not many headlines about agents being exploited, and the live worry is agents going haywire in production [12]. Three years ago, at the $50m Series A, the open question was whether attacks on AI would ever show up in enough volume to make a market [2][13].
So the money is moving ahead of the incident count, which is worth naming rather than dressing up. Teams tell themselves they are funding defence against adversaries probing their models, but the deployment mostly produces reliability failure with a security budget attached, and that is why Sestito's framing of runtime protection as endpoint detection and response for AI [10] lands with buyers who have never seen a prompt-injection campaign but have watched an agent call the wrong tool [9].
The arithmetic under the 83% is more useful than the round. If this year is $2.83bn and that is 83% above 2025 [3], then last year was about $1.55bn, so the category added roughly $1.28bn in twelve months [18][19]. Gartner's next step, nearly $4.78bn [4], works out to about 69% growth, meaning the rate cools while the dollars climb, and the two-year path is roughly 3.1x [20][23].
Now set the vendor against the category. "Tens of millions" of ARR tops out under $100m, which is below 3.5% of this year's spending figure [5][21], so most of that 83% is being paid to someone else. A more-than-10x jump into tens of millions also means the company was under $10m a year ago [22], which is a fast climb and a thin operating history in the same sentence.
The useful exercise for Monday is to lay out the last three AI incidents your org actually had and sort each one twice: first by whether the trigger was external or an internal misconfiguration, and second by whether you found out from a log you already owned or from a customer.
Incidents that were internal and customer-reported mean your gap is inventory and logging, so check whether the registry you already pay for lists every deployed model and agent before you buy a second inventory. Incidents that were external and log-detected mean you want the specific controls, the file-format scanning [11] and the runtime blocking on tool calls [9], and those justify a named owner and a longer term. If those three rows come up empty, what you are buying is insurance. That is a defensible purchase, provided the person signing says the word out loud in the meeting.
