Arti Raman has a problem most founders would envy: her customers are panicking.
The CEO of Portal26, a Los Gatos startup that tracks employee use of generative AI tools, fields calls from IT leaders who've just discovered their workforce is using dozens—sometimes hundreds—of unauthorized ChatGPT accounts, Claude subscriptions, and obscure AI assistants nobody in procurement approved. One recent survey put the figure at 78% of employees using unapproved AI tools. Another found that virtually every enterprise surveyed has bled money from AI-related risks.
Which helps explain why Shasta Ventures just led a $9 million Series A round for Portal26. Announced November 4, the funding brings the company's total capital to $15 million and arrives at a moment when "shadow AI"—the workplace cousin of shadow IT—has evolved from theoretical concern to budget line item.
When Curiosity Becomes Liability
The numbers tell a story about control slipping away. Portal26's platform now monitors more than 400,000 enterprise users of generative AI, a scale that reflects not triumph but necessity. Somewhere between the launch of ChatGPT in late 2022 and today, employees decided they didn't need permission to experiment. IT departments are still catching up.
A 2025 survey by storage firm Komprise found that 90% of IT leaders worry about shadow AI. Fair enough—79% reported negative outcomes from unauthorized GenAI use, and 13% saw direct financial, customer, or reputational damage. EY's Responsible AI Pulse survey landed on an even starker figure: 99% of enterprises have experienced financial losses tied to AI risks.
Gartner, never one for understatement, predicts that by 2027 more than 40% of AI-related data breaches will stem from improper cross-border use of generative AI tools. The implication? Most companies lack even basic guardrails.
"Enterprises are racing to adopt GenAI, but most lack the visibility and controls to do it safely," Raman said in the announcement. It's the kind of statement that doubles as a pitch and a diagnosis.
Portal26—originally founded in 2019 under the name Titaniam—pivoted in October 2023 to focus exclusively on GenAI governance after launching what it calls an AI TRiSM platform (Trust, Risk, and Security Management, for those tracking acronyms). The shift came as Raman recognized that data security, her original focus, had spawned a more urgent cousin: AI security.
The Money and the Moment
Shasta Ventures Managing Director Jacob Mullins, who spends his days evaluating applied AI and enterprise SaaS companies, led the round. "Portal26 addresses a critical gap as companies move from experimentation to scaled GenAI adoption," he said—a framing that suggests the experimental phase may be ending sooner than many realize.
Fusion Fund returned as an investor after backing Portal26's $6 million seed round in February 2022, when the company still operated as Titaniam. That earlier round was led by Refinery Ventures. Fusion announced a $190 million Fund IV in March 2025, and its continued commitment suggests confidence that AI governance has legs as a category. An unnamed Fortune 500 financial services institution also participated, the kind of strategic investor that signals enterprise interest beyond venture enthusiasm.
Portal26 plans to plow the capital into growth and product development. Recent additions include a Zero-day Shadow AI Discovery Engine—essentially a reconnaissance tool for finding unapproved AI usage—and what the company bills as the industry's only NIST FIPS-certified GenAI Prompt Discovery and Forensic Vault. That last piece matters more than it sounds: as regulators begin requiring audit trails for AI decisions, enterprises need a way to reconstruct what prompts employees fed into which tools and when.
The Competitive Landscape
Portal26 positions itself as a "GenAI Adoption Management Platform," which in practice means visibility into sanctioned and unsanctioned AI tools, policy enforcement through integration with firewalls and security gateways, risk management via more than 35 risk detectors, forensic audit capabilities, and ROI analytics. The company claims customers can activate the platform in 30 minutes and see ROI within 72 hours, though no independent validation of those metrics exists.
Named customers include Expedia, which Portal26 cites for governance and risk visibility use cases. The company also distributes through government IT contractor Carahsoft and joined AWS's ISV Accelerate program in September 2024—strategic moves that signal ambitions beyond traditional enterprise sales.
The broader AI governance market has attracted a cluster of startups. Credo AI has raised approximately $41 million. CalypsoAI announced a $23 million Series A-1 in 2023. Companies like Protect AI and HiddenLayer focus on model-layer security. Portal26 differentiates by zeroing in on user-level consumption—the messy reality of who's using what tool to do which task—rather than securing the models themselves.
It's a crowded field, but perhaps not yet a mature one. Most enterprises still struggle to articulate what "AI governance" even means beyond compliance checkbox theater.
What Happens Next
Regulatory timelines are tightening whether companies feel ready or not. The EU AI Act phases in obligations for general-purpose AI systems through August 2027, meaning enterprises operating in Europe need to demonstrate governance capabilities in writing. Portal26 says the "vast majority" of its customers have signed multi-year contracts, some reaching seven figures, though the company declined to disclose revenue or ARR.
The round also highlights sustained investor appetite for woman-led enterprise infrastructure startups—still a minority in venture portfolios but gaining traction. Raman, who held senior product roles at Symantec and other security firms before founding Portal26, received the 2022 TITAN Female CEO/Entrepreneur of the Year award.
The company operates with 11 to 50 employees—lean even by startup standards—and maintains NIST FIPS validations and SOC 2 Type II certification, credentials it inherited from its earlier incarnation as a data-security company and now applies to AI governance.
Which brings the story full circle. Portal26 began life solving one kind of security problem, pivoted when a larger one emerged, and now finds itself riding a wave of enterprise anxiety about tools that didn't exist three years ago. Whether that anxiety translates into sustained revenue growth depends on how quickly the regulatory environment hardens and how much damage shadow AI inflicts before then.
For now, at least, Raman's customers keep calling. And they keep sounding worried.
