How much has HiddenLayer raised?
About $155M in total, including a $100M Series B announced on September 2, 2026 led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, M12 and Booz Allen Ventures participating.
Beam vs HIDDENLAYER
Beam vs HiddenLayer
HiddenLayer secures models and agents at runtime for enterprises and raised a $100M Series B on September 2, 2026 led by Delta-v Capital, taking it to roughly $155M raised. It operates at the deployed-AI layer. Beam works at the developer endpoint: recording, workspace policy, and Sentinel on browser AI chats.
Beam vs HiddenLayer, side by side
Details below are drawn from a September 2026 review of the AI agent security market. Some figures are vendor-sourced or analyst estimates, and this is a fast-moving space — check with each vendor before you buy. Composio details come from its own pricing and documentation pages as of October 2026.
| Beam | HiddenLayer | |
|---|---|---|
| What it is | Local-first activity monitor, policy enforcement, and pre-run scanner for AI coding agents, with a Sentinel browser extension for AI chats. | Enterprise platform for model and agent runtime security. |
| Monitoring | Shell commands, file changes, tool calls, network endpoints and browser actions from harnesses such as Claude Code, Codex and Cursor, plus Beam Sentinel checks on supported AI chat sites before send. Normalised into local NDJSON with risk flags and evidence attached. | Model and agent runtime security across enterprise AI deployments. |
| Skill / MCP scanning | Yes. SKILL.md files and MCP configurations are scanned before you run them, using 11 heuristic patterns plus an MCP version-pin check. Workspace admins can also block an MCP server for the org or one user. | Not specifically covered in our source research. |
| Blocking / enforcement | Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse hooks. The Sentinel Chrome extension pauses or blocks high-risk browser sends and can hold a send after redacting live secrets. | Runtime protection is core to the product. |
| Individual use | Free for up to 3 people, and Pro for one person at $8/month. Team workspaces add owner/admin roles, org baselines, stricter member overrides and a control plane. | None. Enterprise platform sale. |
| Deployment | Local collector plus a workspace dashboard. Apple and Windows MDM. Sentinel Chrome extension for browser AI chats. Licensed self-hosted control plane for teams that need it on their own infrastructure. | Enterprise deployment. |
| Source / licence | AGPL-3.0 for the local CLI and collector; the multi-user control plane is proprietary. | Commercial, not open source. |
| Pricing | Free for up to 3 people. Pro $8/month for one person. Team $20 per developer and $5 per browser seat a month, billed yearly. | Enterprise custom quote, no public price. |
HiddenLayer in numbers
As reported in our source research. Some figures are estimates.
- Series B
- $100M on September 2, 2026, led by Delta-v Capital
- Other investors
- Ten Eleven Ventures, Morgan Stanley, M12 (Microsoft's Venture Fund), Booz Allen Ventures
- Total raised
- About $155M
- Reported growth
- ARR up more than 10x and 50+ new enterprise customers
Where HiddenLayer does more
- Runtime protection for models and agents at enterprise scale, which Beam does not attempt.
- Well capitalised: a $100M Series B on September 2, 2026 and about $155M raised in total.
- Established enterprise customer base, with more than 50 new enterprise customers reported.
Where Beam differs
- Beam covers the developer endpoint — the agent running on someone's laptop — rather than deployed models.
- Beam is local-first: data stays on the machine and credentials are redacted before writing.
- Beam's pre-run scan targets SKILL.md files and MCP configurations specifically.
Beam’s current gaps
- Enforce is hook-based: a native deny is wired for Claude Code and Codex PreToolUse. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block.
- Missing, unreadable or expired cached policy allows the action. Beam is not a fail-closed kernel sandbox or an in-silicon watchdog.
- Scanning is heuristic pattern matching. It produces false positives, misses novel phrasing, and is not a guarantee of safety.
- There is no SOC 2 report and no default SIEM forwarder. Kernel isolation like OpenShell remains a different layer.
Which one fits
If your risk sits in deployed models and production agents, HiddenLayer is built for that and is well resourced. Beam addresses a narrower surface: the coding agent on a developer's machine.
FAQ
Does HiddenLayer monitor coding agents on a laptop?
Our source research describes model and agent runtime security for enterprise AI rather than developer-endpoint monitoring, which is Beam's focus.
Is Beam an alternative to HiddenLayer?
Not really. Beam is a local-first coding-agent control layer with workspace policy and Sentinel. HiddenLayer is model and production-agent runtime security. They address different layers.
See how Beam works
Beam is an early, local-first prototype. Read what it actually does today before comparing it further.