Creators of Microsoft Security Copilot raise $100 million to prevent attacks

ENT Security — a startup founded by veterans of the industry who built Microsoft Security Copilot — has raised $100 million in a seed round. The company is developing an AI system of the intent-aware workspace prevention class, which should block cyberattacks before they have time to cause damage.

The End of the Response Era

Over the last ten years, the cybersecurity industry has tacitly accepted the inevitability of breaches. The logic was simple: attacks will happen anyway, so you need to detect them quickly and mitigate the consequences. Corporate budgets flowed into EDR systems, SIEM platforms, and incident response teams.

The idea of preventive protection — stopping an attack before it starts — was seen as unachievable. The founders of ENT Security worked within this system for many years. When they built Security Copilot for Microsoft, it became clear: the old response tools had a fundamental limitation — they only activate when damage has already been done or is about to be done.

New-generation AI models made it possible for the first time to analyze intentions in real time — and the team decided to turn this capability into a product.

How Intent-Aware Protection Works

The key concept in the company's approach is intent. Traditional security systems react to what has already happened: a file with malicious code has been downloaded, a network traffic anomaly has been detected, credentials have been compromised. ENT Security proposes to intercept the threat earlier — before the malicious action completes and causes damage. The product is built around the concept of workspace prevention — protection within work environments themselves. This is fundamentally different from classical perimeter protection and traditional endpoint security. The system tracks the behavior of users, applications, and processes in real time, assesses where it's leading, and when necessary, blocks it — without interrupting legitimate work.

Key principles:

• Analysis of action intent before damage occurs, not after
• Preventive blocking without interrupting normal work processes
• Integration with existing infrastructure without replacing the stack
• AI models trained on real patterns of corporate attacks
• Focus on work environments — where most incidents occur

What the Record $100 Million Round Says

$100 million at the seed stage is a large bet even by the standards of the hot cybersecurity market. Such a volume of funding at an early stage signals several things at once. First, high confidence in the specific team.

The background of the creators of Microsoft Security Copilot is not just a line in a resume. These are people who saw how AI is embedded into corporate security from inside one of the world's largest technology companies, and who understand both technical limitations and real enterprise customer needs. Second, the scale of the bet on a new category.

The corporate cybersecurity market is valued at hundreds of billions of dollars. If AI attack prevention emerges as a standalone category, a significant portion of budgets currently spent on response and incident investigation will begin to shift toward pre-attack protection.

What It Means

The cybersecurity industry may go through a pendulum cycle: from "breaches are inevitable, we need to respond quickly" back to "an attack can be stopped before it happens." AI has become the tool that makes this real — not theoretically, but in the conditions of real corporate environments. For business, this potentially means a paradigm shift: less spending on cleanup, more on prevention.