Harmonic Security raises $50M to police how staff use AI — from the ex-Digital Shadows team

Harmonic Security has raised a $50M (about £38M) Series B led by Crosspoint Capital Partners, taking its total funding to $76M. The company tackles a problem every organisation now has and few can see clearly: “shadow AI” — employees quietly pasting sensitive data into whatever chatbot or AI tool is to hand, outside any policy or oversight.

Rather than block AI outright, which simply pushes usage further underground, Harmonic’s platform monitors how staff actually use AI across browser-based tools, desktop apps and increasingly agentic workflows, shows security teams what data is going where and why, and applies controls in real time. It is a governance-not-prohibition stance, and a pragmatic read of how AI adoption actually happens inside companies.

A British security pedigree

The UK angle here is the founders. Harmonic was started in 2023 by Alastair Paterson (CEO) and Bryan Woolgar-O’Neil (CTO), the pair behind Digital Shadows — the British threat-intelligence firm Paterson sold to ReliaQuest for a reported $160M in 2022. They are, in other words, a proven UK security team going again, and the company runs engineering and go-to-market teams across both the UK and US, with the new money earmarked to expand both.

A note on how we’re treating it: Harmonic describes itself as headquartered in both San Francisco and London, and some trackers list it as US-based. Because our company directory lists UK-headquartered companies only, we’re covering this as news rather than adding a directory entry — the same call we made on ClearDraft. But the British roots and London engineering base make it squarely part of the UK AI story.

Why it matters

Shadow AI is one of the most real, least glamorous problems in enterprise AI right now. Staff are more productive with AI tools and will use them regardless of policy; the risk is confidential data and, increasingly, autonomous agents acting with access they were never meant to have. Tools that make that usage visible and governable — rather than pretending it can be banned — are solving a problem that actually exists, which is more than can be said for a lot of AI startups. It also sits alongside a broader UK strength in security-adjacent AI, from Darktrace in threat detection to a wave of governance tools following AI into the workplace. The caveats are the usual ones for a fast-growing category: AI-governance is getting crowded quickly, and the hard part is proving the monitoring is accurate and low-friction enough that companies keep it switched on.