Creators of Microsoft Security Copilot raise $100M to prevent attacks

ENT Security, a startup founded by industry veterans who built Microsoft Security Copilot, has raised $100M in a seed round. The company is developing an AI system in the category of intent-aware workspace prevention, designed to block cyberattacks before they can do damage.

The end of the response era

For the past ten years, the cybersecurity industry has tacitly accepted that breaches are unavoidable. The logic was simple: attacks happen anyway, so the job is to detect them quickly and clean up the consequences. Corporate budgets flowed into EDR systems, SIEM platforms and incident response teams. The idea of preventive protection, stopping an attack before it starts, was seen as unachievable.

The founders of ENT Security worked inside this system for many years. While building Security Copilot for Microsoft, it became clear to them that the old response tools have a fundamental limitation: they kick in only when the damage has already been done or is about to be. A new generation of AI models made it possible, for the first time, to analyze intent in real time, and the team decided to turn that capability into a product.

How intent-aware protection works

The key concept in the company's approach is intent. Traditional security systems react to what has already happened: a file with malicious code has been downloaded, an anomaly in network traffic has been logged, credentials have been compromised. ENT Security proposes intercepting the threat earlier, before the malicious action has completed and done damage.

The product is built around the concept of workspace prevention: protection inside the work environments themselves. This differs fundamentally from classic perimeter defense and traditional endpoint security. The system monitors the behavior of users, applications and processes in real time, assesses where that behavior is heading and, when necessary, blocks it, without interrupting legitimate work.

Key principles:

• Analyzing the intent of an action before damage occurs, not after
• Preventive blocking without interrupting normal workflows
• Integration with existing infrastructure without replacing the stack
• AI models trained on real patterns of corporate attacks
• Focus on work environments, where most incidents happen

What the record round says

$100M at the seed stage is a big bet even by the standards of an overheated cybersecurity market. A funding round of this size at such an early stage signals several things at once.

First, high confidence in this particular team. The background of the Microsoft Security Copilot creators is not just a line on a résumé. These are people who watched AI being built into corporate security from the inside at one of the world's largest technology companies, and who understand both the technical limits and the real demands of enterprise customers.

Second, the scale of the bet on a new category. The enterprise cybersecurity market is valued at hundreds of billions of dollars. If AI-based attack prevention establishes itself as a standalone category, a significant share of the budgets now going to response and incident investigation will start shifting toward protection before the attack.

What this means

The cybersecurity industry may be going through a pendulum swing: from "breaches are inevitable, so respond fast" back to "an attack can be stopped before it happens." AI has become the tool that makes this real, not in theory but in the conditions of real corporate environments.

For business, this could mean a shift in paradigm: less spending on cleaning up consequences, more on prevention.