Nine years of "we don't need it," then a signature

Here's the deal: $22 million is a small number in AI funding news right now. Several billion-dollar rounds closed in the same month. But what makes London's Prevalent AI announcement on August 19 interesting isn't the amount.

It's the first outside capital in nine years.

Prevalent AI was founded in 2017 and hasn't taken a penny of external investment since. It ran on its own revenue, was profitable according to the release, and grew annual recurring revenue by more than 2x over the past year.

Companies like that raise for one of two reasons: they need money, or they want to buy something money alone can't produce. Prevalent AI is clearly the second. The stated uses are US market expansion, building a global go-to-market organization, deepening the leadership team, and extending the product beyond cybersecurity. Every one of those is buying speed.

Who's who — GCHQ, Darktrace, and nine bootstrapped years

The company's résumé is unusual.

Co-founder and CEO is Paul Stokes; Arun Raj is COO. The two previously founded and sold a cybersecurity company, and used that outcome to start the next one without outside capital.

But the surrounding names draw more attention. The team includes Sir Iain Lobban, former director of GCHQ, and Andrew France, formerly GCHQ's deputy director for cyber defence operations and co-founder and CEO of Darktrace.

Bootstrapping for nine years is itself remarkable in this category. Enterprise security software has long sales cycles — a single contract can take a year to close. Surviving that cash-flow profile without outside capital means structuring for revenue from the start, which means giving up development speed. That's plausibly why this company was quiet for nine years.

GCHQ is Britain's signals intelligence agency, the counterpart to the NSA. Darktrace is one of the most successful cybersecurity companies the UK has produced. Having both lineages inside one company is a strong signal in British security circles.

That background actually helps explain the product. The core work of an intelligence agency is connecting fragmented pieces into a picture. Individual data points mean nothing; relationships create meaning. That is precisely what Prevalent AI built.

What they sell — "not a shortage of tools, a shortage of context"

CEO Paul Stokes's quote does the product description for us.

"Large enterprises do not have a shortage of tools or data. They have a shortage of context."

What Prevalent AI built is a data fabric: it weaves the hundreds of scattered data sources inside an enterprise into a single queryable knowledge graph. The release describes it as continuously cleaning, connecting, and contextualizing fragmented enterprise data into a sovereign knowledge graph.

"Sovereign" isn't marketing garnish there. The customer list is global banks, telcos, and critical infrastructure operators — organizations under regulation that forbids exporting data. Keeping the data inside organizational control is a design premise, not a feature.

Why this sells now is the heart of the story. The wall enterprises hit when deploying AI agents internally usually isn't model quality. A smart agent can't do anything if it has no way to query what the company knows. Which server backs which service, who owns that service, what happened in that system last month — all of it lives across many systems. Humans figure it out by asking around. Agents can't.

So the company's position isn't "we build AI." It's "we get your company into a state AI can use." A large share of enterprise AI projects fail at exactly this point. The reason an agent that demoed beautifully does nothing inside a real corporate environment is usually not a bad model — it's that there's nothing organized to ask.

Concretely: a large enterprise typically runs hundreds of systems. HR, asset registers, cloud consoles, ticketing, access management, log collectors. Each is internally consistent and knows nothing about the others. The same server appears as a hostname in the asset register, an instance ID in the cloud, and an IP in the logs. A human knows from experience those are one thing. A machine doesn't.

Solving that matching problem is the actual labor of a data fabric. It's unglamorous, tedious, full of per-organization exceptions, and requires continuous maintenance once done. That's where nine profitable years buy an advantage — not in algorithms but in accumulated exception handling. It's the kind of asset a well-funded newcomer can't buy its way past quickly.

Prove it where it hurts, then expand sideways

The market Prevalent AI has sold into for nine years is cybersecurity. That looks like a choice, not an accident.

A security operations center is where the pain of data fragmentation shows up most immediately. When an alert fires, an analyst has to gather context across several systems to judge whether it's real: asset details, user privileges, recent changes, network location. Slow context means slow response, and slow response means loss. It's one of the rare domains where the cost of missing context is quantified instantly.

Selling there gets you two things. Revenue, and validation under the hardest conditions. Security data is high-volume, wildly heterogeneous, and demands near-real-time handling. If it works there, it works elsewhere.

The expansion this round funds is exactly that. The company says the same foundation supports financial crime analysis, operational intelligence, compliance, and enterprise AI initiatives. Push the graph proven in security into the departments next door.

The expansion order has logic to it, too. Financial crime analysis is structurally near-identical to security — connect entities, find anomalous patterns. Compliance comes next, and enterprise-wide AI is furthest away. Pushing outward in order of proximity means the company knows how far its graph actually generalizes. That's a much more grounded posture than declaring an all-industry data platform on day one.

There's a risk worth naming alongside it. Adjacent expansion is easy to say and is in practice new-market entry. SOC budgets and compliance budgets sit with different people who buy on different criteria — security teams evaluate detection speed, compliance teams evaluate audit defensibility. Selling the same graph still requires separate packaging and a separate sales motion, and the organization hired with this round will carry that load.

The investor and what's being bought

The investor is Integrity Growth Partners (IGP) of Los Angeles. Managing partner and co-founder Ryan Anderson's comment:

"Paul, Arun, and the team have built something rare: genuinely differentiated, AI-native technology."

The "growth investment" label matters. Unlike a seed or Series A, growth capital is money to scale something already working. It isn't given to find product-market fit; it's given to sell more of a fit you already found. That's exactly the shape of capital that attaches to a profitable company whose ARR just doubled.

People arrived with the round too. CFO Stuart Barnard and SVP of Global Sales Mike East both joined recently. Filling the CFO and sales-head seats at the same time is an unambiguous signal: the company decided it's time to build a commercial organization, not a product organization. UK press reported the round as £16 million — framed there as US capital flowing into a British security company.

Worth noting what wasn't disclosed. No valuation. No absolute ARR figure — "more than doubled" is an easy sentence when the starting point is small. Customer counts and contract sizes are private. "Profitable" appeared without magnitude or method. Bootstrapped companies have no disclosure obligation, so the opacity is natural, but judging this company's actual weight class requires information we don't have.

Who gains what

Prevalent AI gains the US market — the perennial homework of European enterprise software. Landing banks and telcos in Britain doesn't transfer; the US is a different game and it doesn't happen without a local sales organization. This $22 million buys the time to build one.

IGP gains something scarce. An enterprise infrastructure company that has been profitable for nine years is rare in today's venture market, where most buy growth rate with losses. And first-outside-capital means no prior preference stack and no accumulated dilution. The cap table is clean.

The founders gain optionality. Nine years without selling equity means they hold most of it at the moment of this round. That's a fundamentally different negotiating position.

Enterprises deploying AI agents gain something indirect but real. Capital arriving behind "fix the data before you pick the model" means more products will be built at this layer.

What happens when a bootstrapped company takes money

The history cuts both ways.

The success story usually cited is Atlassian, which ran on its own revenue for a long time and took outside capital late. By then the product and culture had set, leaving investors little room to steer. Late money couldn't change the company; it just accelerated it.

The failure pattern is equally clear. Growth capital enters a company that had been growing at its own pace, and suddenly there are quarterly targets. Careful selling becomes aggressive selling; a team that went deep per customer starts counting new logos. Product quality has broken in that transition more than once. The problem isn't the capital — it's the clock the capital brings.

Which way Prevalent AI goes is unknown. But the fact that the founders declined capital for nine years is itself a basis for resistance. If you didn't take money because you needed it, you probably set the terms.

How competitors respond

This market is crowded. Palantir has sold precisely this problem — unifying fragmented organizational data into one model — for over twenty years, complete with the same intelligence-community lineage story. The scale difference means it isn't head-to-head, but the names will come up in the same customer meetings.

Databricks and Snowflake approach from a different layer. They sell putting data in one place; Prevalent AI sells the relationships between data once it's there. Both are steadily climbing toward graph and semantic layers, so that boundary blurs over time.

SIEM vendors — the Splunk lineage — have the advantage of already holding security data. But their architecture is optimized for log search and handles entity relationships poorly. Expect acquisition attempts to close that gap.

The most realistic competitor is building it yourself. Large enterprise data teams can always construct an internal knowledge graph. Prevalent AI's basis for winning is nine years of accumulated connectors and reconciliation logic — an advantage that's hard to demo, which makes it hard to sell.

So what actually changes

If you're deploying enterprise AI — this round confirms the bottleneck has moved from models to data context. If your pilots go well and die at scale-up, the cause is more likely this layer than the model.

If you run security operations — the graph-based approach proven in the SOC is moving into compliance and financial crime. Worth checking whether adjacent teams can share the same data foundation. Two teams separately building the same entity resolution is pure duplicated cost.

If you're a European B2B founder — profitable, 2x ARR, nine years bootstrapped is a combination that just pulled in US growth capital. A data point that buying growth rate with losses isn't the only route.

If you handle AI governance — watch why "sovereign knowledge graph" sells in regulated industries. Giving agents context without moving data outside the organization has a good chance of becoming the standard compliance pattern.

If you're an investor — a small deal with a clean structure. The thing to watch is whether the company maintains product density while scaling a sales organization on growth capital.

🥄 Three Things You're Probably Wondering

— Isn't $22M small by current standards? It is. Billion-dollar rounds closed the same month. But this company was already profitable, so it isn't survival money. They took enough for US entry and hiring, which means minimal dilution. Terms matter more than size in this one.

— Haven't knowledge graphs been around forever? Yes, the concept is old. What changed is the consumer. They used to be built for humans reading dashboards; now they're built for agents to query. The required accuracy and refresh cadence are different, and that's why this market reopened.

— How is this different from Palantir? Scale and entry path. Palantir started in government and defense and moved down into enterprise; Prevalent AI started in corporate security teams and is expanding sideways. The underlying problem does overlap, so the bigger this company gets in the US, the more likely they meet head-on.

Sources

Numbers and criteria are as of announcement and may change. Investment calls are yours to make!