The demand base for independently checkable agent-attestation hardened overnight — from "advisory pressure" to live law in three regimes:
D.Lgs 160/2026, published Gazzetta Ufficiale Sep 15, in force Sep 30, 2026. Art. 437-bis Penal Code: criminal offense for "omessa adozione di misure di sicurezza nei sistemi di intelligenza artificiale" — failure to adopt security measures in AI systems — plus illicit alteration of AI systems; corporate ("231") liability attached.
Read: EU buyers no longer face fine-risk — they face jail-risk and 231-liability for not being able to PROVE their AI safety measures existed and worked. A vendor's own dashboard is not a defense exhibit. A tamper-evident audit chain is.
GSA LLM final rule (Crowell & Moring; FedScoop Oct 1; Nextgov): NIST framework compliance for federal LLM contractors; scope narrowed to LLM as "material feature"; expanded IP protections. Oct 1: GSA issued AI-specific acquisition policy for new contracts.
OMB M-26-15 (Jun 24) + the PQC executive order (Federal Register Jun 25) — federal PQC plans due Oct 22 = D-18. NSA published post-quantum measures for National Security Systems (nsa.gov, Oct 1). Congress is building the evidence pipeline from the bill side (Warner S.5057 SAFE-AI Act + Warner AI security incident-tracking bill; see date-nuance note in source doc).
China TC260 Framework 3.0 (Sep 14) already names agent risk in a 33-risk annex. Three regimes, one artifact: the same portable evidence sells into all three.
OpenAI safety leader David Robinson resigned Oct 3 — publishing that the company's "culture is broken" — following 3 researchers fired and internal model-reasoning traces that included "we may die". Anthropic's IPO prospectus carries "could manipulate, blackmail and resist shutdown" risk language into a coming public market (mid-November debut).
The sellers have priced the hazard. Nobody outside the seller verifies what the products DO.
| Company | Round | Date | Lead | What they sell |
|---|---|---|---|---|
| Armadin | $255.5M @ $2.5B+ | Oct 1 | a16z + Accel | Autonomous agent swarms; "largest recorded autonomous AI attack" demo |
| Kai Security | $125M stealth-exit | Mar 10 | Evolution Equity + N47 (Claroty founder) | Agentic auto-remediation "machine-speed defense" |
| Onyx Security | $113M @ $640M | Jul 29 | Bessemer | "Secure AI control plane"; runtime agent control |
| HiddenLayer | $100M | Sep 2 | — | AI deployment security |
| Straiker | $64M | Jun 29 | Marathon | Agentic workforce security |
| Reco | $55M | Sep 29 | AT&T Ventures | Agent/sprawl security for Fortune 500 |
| AIR | $50M | Sep 1 | — | Vetting agent skills/add-ons |
| doxx.net | $38M | wk of Sep 29 | — | ADN agent-misadventure prevention |
| Hush Security | $30M | ~Oct | Akamai (strategic) | Agent governance |
| Halluminate | $30M | Oct 1 | OakHC/FT | AI training (4 top labs as customers) |
| Cymphony | round | Sep 9 | Sequoia | Enterprise agent-risk |
Named-cohort verified capital: ≥ ~$2.0B. Bessemer's own framing: agent-security is "a category poised to produce the largest cyber market." Note what every one of these sells: control, prevention, remediation. Note what none ships: independent, third-party-checkable attestation of what agents actually did — the evidence layer Italy now demands, GSA contracts demand, insurers will demand.
Announcement + coverage contain no revenue disclosed, no customer count (theterminal.space Oct 2; PR read-through) — $2.5B valuation priced on narrative + demo. BankInfoSecurity Oct 2: scaling plan extends autonomous remediation/compensating controls across MDR and WAF platforms — a larger un-attested action surface, not a smaller one. Hyperattack demo banner: a vendor-run demonstration; self-certified proof is the exact gap the five questions name.
Enterprise due diligence at $2.5B-grade trust must ask — and no vendor today answers with third-party-checkable evidence:
D-18: OMB federal PQC plans due Oct 22 — agencies are writing these plans NOW. Italy in force since Sep 30 — EU-exposed CISOs awake to criminal exposure: sharpest single wedge available today. Armadin logo window still open (no customer logos shipped since Oct 1) — the counter-brief must be public BEFORE the first logo lands and the narrative hardens. Same pre-position move that worked on QXC (wedge card, Oct 4); it decays daily.
Publish the 5-question DD gate as an open Q&A to the autonomous-security cohort — before a $255M marketing budget names the category for everyone. Fold the three-regime evidence table into the brief body. Route to identity-giant acquirers in integration: they bought the control plane and will need the proof plane on day one.