Ultra Security Raises $10M Seed for AI Runtime Security

Installing a security product can mean sending another company a record of the work. Ultra Security has built its launch around a local-first alternative, putting custody of agent activity inside the decision about how to control it. The machine carrying out the work can also keep the evidence of what happened.

The Birmingham, Michigan company emerged from stealth on October 21, 2026, with $10M in announced Seed funding. Founder and CEO Chase Lee is building runtime protection for AI agents, with Ludlow Ventures, Hidden Capital, Entrée Capital, Detroit Venture Partners, Firedrop and FDVC among the investors. Ultra's official company description puts its seed backing at more than $10M; the launch headline uses the rounded $10M figure.

Ultra says its software applies controls as agents use tools and move information. For an IT administrator opening business systems to an AI assistant, the purchase reaches beyond whether a connection works: someone must decide which actions deserve permission, where sensitive data can travel and who gets to inspect the record afterward. The funding arrives around that growing operating responsibility.

A founder returns to the security buyer

Chase Lee founded Ultra in 2025 after building Trustpage and later working on product at Vanta, according to Ultra's company history. Vanta's January 19, 2023 acquisition announcement identifies Lee as Trustpage's CEO and describes a business helping vendors and buyers exchange evidence about security. That history gives the new company a concrete commercial connection to the people evaluating whether software deserves access.

An agent adds another moving part to that evaluation. A buyer can approve an application and still need boundaries around the particular tools it invokes, the information it reads and the systems it changes. Ultra's stated design places a control layer in that path, so a company's rules can follow a request into execution. Buying the product means accepting another participant in the work, with responsibility for allowing or blocking actions.

The investor roster gives that design seed-stage backing, but the announcement names no lead investor, valuation or detailed allocation of proceeds. Ultra's launch is a public introduction backed by existing seed capital; it should not be read as an additional $10M layered on top of the more-than-$10M company description. The available evidence supports the amount and stage without supplying a financing history more elaborate than the company has disclosed.

Local custody becomes part of the product

Ultra says its default deployment keeps tool calls, payloads and audit trails on the user's machine, with a remotely hosted option also available. That choice makes the location of security evidence part of the buying conversation. An organization considering agent access may have reason to examine both the information an assistant can reach and the additional copies created while monitoring it.

The company's technical material on MCP security guardrails describes controls around tool inputs, outputs, permissions and human approval. Model Context Protocol, or MCP, connects AI applications with tools and data sources. In that setting, a control attached to the action can help an administrator express a narrower rule than granting access to an entire connector and hoping every use falls within the employee's assignment.

Ultra's observability research also emphasizes linking events across an agent's work. That is an important operational distinction: a collection of individually understandable requests can still be difficult to investigate when their relationships disappear. A buyer evaluating runtime protection needs to understand how an allowed request, a denied request and the surrounding session remain connected in the evidence available to the team. These are implementation questions to examine in a deployment, rather than outcomes established by a launch announcement.

The meter follows delegated work

Ultra's published pricing offers a free tier, action-based usage pricing and enterprise contracts. The commercial unit is an agent action rather than simply an employee seat. That links the security purchase to how much work an organization delegates, including activity generated by people whose jobs never previously involved operating across several technical systems.

For a buyer, this makes usage visibility part of budgeting as well as security. An assistant can perform several operations while satisfying a single request, so the person approving the subscription needs a useful account of what counts and what the resulting activity costs. Ultra's pricing page contains inconsistent wording about charges for blocked actions; the published general model is clear, while that detail warrants clarification directly with the company before a customer relies on an estimate.

The same commercial structure can support a smaller initial deployment before an enterprise contract. Ultra advertises different retention and support arrangements across its plans, giving procurement teams decisions about the evidence they need to keep and the assistance they require. Those choices sit alongside the technical evaluation: a useful control has to fit the organization's investigation practices and operating budget after the first successful demonstration.

Engineering the checkpoint and explaining the purchase

Ultra's careers page lists Staff Engineer and GTM Engineer openings. The engineering role sits around applied AI and security infrastructure, while the commercial role includes translating technical capabilities into a proposition buyers can understand. The listings provide a current hiring signal without establishing a specific spending commitment for the seed financing.

DevCuration’s coverage of Opsin’s enterprise agent-security financing and Hilt’s data-movement governance round provides related context for buyers examining this category. Ultra’s engineering and commercial hiring belong inside its own funding story. An administrator considering Ultra must understand where the software operates, what happens when an agent reaches a restricted resource and how the team can review the event. The person selling the product needs to explain those boundaries with the same precision the engineering team uses to implement them.

Ultra is opening access to organizations that want agents working inside real systems. As those organizations connect another tool or give an assistant another assignment, the security checkpoint becomes part of the working relationship between the employee, the agent and the administrator who authorized the reach. Chase Lee's team is now hiring for both sides of that relationship, with the next deployment bringing another set of permissions someone has to understand.