WhiteMatter (formerly QuilrAI) funding, valuation and investors

Product & use cases

Illustrative buyer workflow grounded in vendor documentation: (1) a CISO/platform team identifies its employee/browser, code-agent, cloud and SaaS AI inventory using extensions/endpoint or gateways. (2) Define identities, permission boundaries, allowable MCP servers/skills and spending limits for each agent type. (3) Test each agent against policy and issue an approved deployment blueprint. (4) Deploy a corresponding policy Guardian and put tools/LLM traffic behind enforcement hooks or a gateway; sensitive tool calls can be blocked or require approval. (5) Review traces, retention settings, costs, incidents and policy decisions in the console before expanding the rollout. WhiteMatter claims monitoring-only onboarding and on-prem/VPC deployments. Verify data retention terms and measurable false positives during a POC; we have not tested the platform. Procurement model reportedly charges a flat fee based on managed agents; published per-agent price not found.

• Secure MCP tool calls by enforcing access, data-exfiltration and budget policies before agent action execution.
• Inventory agents and their delegated identities across CI/CD, code assistants, SaaS and public cloud.
• Preproduction threat modelling, access approval and traceable audit review for enterprise autonomous workflows.

Key facts

• $20M Series A disclosed November 10, 2026, led by Blumberg Capital.
• QuilrAI rebranded to WhiteMatter; do not create a separate new startup or prior funding event from the rename.
• Guardian agents under management are vendor-reported control instances, not distinct customers, revenue or proof of breach prevention.
• Named customer statements from Sentara and Alter Domus are company-selected testimonials, not controlled ROI studies.
• Vendor website has conflicting default raw-prompt storage statements (homepage: no storage by default; security page: 14 days default); exact plan/deployment conditions should be clarified.

Competitive landscape

Edge: Vendor claims integrated protection across cloud, endpoint, SaaS, code and gateways with Guardian-to-agent matching. Reported 2.24 ms policy decisions and 7,800 actions/minute are internal performance claims, not independent benchmarks. Packaging may offer fewer overlapping vendors but require broad deployment and privileged access.

A serious buyer should compare actual interception points (model gateway vs MCP server vs browser/endpoint), local on-prem/VPC options, independent SOC 2 report, tool-call latency, data retention, identity delegation and false-positive approvals. A reported 2.25M Guardian agents is not a count of paying businesses. Vendor case studies and token savings cannot be assumed to apply elsewhere. Vendor website FAQ states prompts aren't stored by default; separate security page says 14-day default raw prompt retention, configurable 0–30 days. Treat this as an unresolved policy wording discrepancy pending vendor confirmation.

• Zenity direct

  Enterprise AI-agent risk/security and governance; compare deployment hooks and policy enforcement scope.

• Noma Security direct

  AI security posture and agent governance; compare detection versus blocking and development lifecycle.

• Onyx Security direct

  Agentic security controls and runtime risk, named in independent Business Insider coverage.

• Microsoft Purview adjacent

  Established enterprise data governance/DLP; may complement rather than replace agent-specific authorization.

• Cloudflare AI Gateway adjacent

  LLM gateway observability/control, not automatically a substitute for endpoint and agent-identity governance.

Market / IPO context