Alice: who they are, what they sell and what CISOs should ask

What Alice sells

Alice, which traded as ActiveFence until a 2026 rebrand, sells software and research services that test, guard and monitor generative AI applications, agents and foundation models. Its buyers are AI labs and enterprises that ship customer-facing AI. The company describes itself as "an enterprise AI security, safety, and trust platform". It was founded in 2018 and is headquartered in New York and Tel Aviv. It says the name change reflected a wider focus on AI security. Alice is private and venture-backed. In August 2026 it raised a $140 million round led by Apax Digital. The company says the round took total funding to $280 million and gave Apax a board seat.

The products sit under one platform, WonderSuite. The company pitches it to teams launching customer-facing AI in regulated industries. It has three parts, one for each stage of an AI system's life:

• WonderBuild is pre-launch testing. Alice says it stress-tests models, applications and agents for prompt injection, jailbreaks, data leakage and policy violations before deployment, using automated and managed red teaming.
• WonderFence is the runtime layer. Its page states that it sits between a company's external-facing AI and its users and intercepts harmful and off-policy responses. The company lists latency under 150ms and coverage of more than 20 languages.
• WonderCheck runs periodic red teaming against production systems. Alice says it detects drift, regressions and new vulnerabilities as models change through updates and fine-tuning.

All three draw on Rabbit Hole, a dataset the company calls the world's largest of real-world adversarial and harmful content.

Two lines sit beside the suite. For model labs, Alice's researchers simulate malicious prompts and agentic tasks before release. The company names Anthropic, Google and Cohere among those labs. It also still sells content moderation and trust and safety for user-generated content platforms, which it calls its original expertise as ActiveFence.

On delivery, the company says WonderFence can consolidate guardrails from multiple vendors and models into one observability layer. Its platform page lists model-agnostic protection. For customer experience agents hosted on third-party platforms, Alice says it connects through existing CX agent extensions without a rebuild. The portfolio page of investor Grove Ventures lists a story headlined "ActiveFence Guardrails Now Deployed on AWS Marketplace".

Alice says it is not the safety filter that ships with a model. Its page states that WonderFence, unlike the guardrails baked into an LLM or cloud platform, is configured to the customer's application, policies and industry risks. Another page is blunter: "Built-in guardrails from your LLM provider are a starting point, not a security posture." In our reading, the pages describe protection for AI that an organization builds and exposes to its own customers. They do not describe control over staff use of outside AI tools.

Figure: Alice's home page, captured 2026-10-29. Source: Alice | Secure, Safe, & Trustworthy AI.

The founders

Alice was founded by three people, and all three hold executive roles there. Noam Schwartz is CEO and co-founder, Iftach Orr is CTO and co-founder, and Alon Porat is chief customer officer and co-founder.

The sources available for this profile do not describe the founders' careers before the company existed. They name no earlier employers, military service, academic work or prior startups. We have not filled that gap. What the sources do show is how each founder appears in the company's public record, and what Schwartz has said about the company's purpose.

Noam Schwartz is the company's public voice. When the August funding round was announced, he described the company's thesis this way: "There are infinite ways to break an AI, and you can’t defend against something you’ve never seen," according to SecurityWeek. He traced that to the company's history: "We spent nearly a decade learning exactly how people abuse technology at the scale of billions, first on the world’s largest platforms and now on the models those same people are probing." He framed the round as a response to a gap he sees in the field: "We are very quickly democratizing capabilities before we’ve democratized the defenses. This round is about closing that gap." (SecurityWeek)

On the change of name, which Wowtale reported took effect in January, Schwartz said he had realized at the end of the previous year that the company "hadn’t abandoned the past" and that "the future is just bigger". He also spoke publicly under the old name. Grove Ventures, an investor, lists a story titled "Lotan Levkowitz and ActiveFence’s Noam Schwartz on Trust and Safety in the Era of AI" and another titled "ActiveFence CEO Interviews at Unicorn Forum". On the same page he says of the firm: "We see them as true partners, and they are an integral part of our day-to-day operations and everything that we do" (Grove Ventures).

Iftach Orr appears in the company's research output. Alice's ENT-IPI Bench post credits him first among the Alice Labs staff who made "significant contributions" to the work (Alice). That benchmark evaluated eight frontier models as enterprise agents across 147 adversarial scenarios. The sources do not say what else he leads as CTO.

Alon Porat appears in the sources only by name and title. Grove Ventures' portfolio page lists him among Alice's leadership (Grove Ventures). We found no statement from him in the material given here.

In our reading, the founders' public record is thin outside Schwartz's own statements. Readers who want to follow changes in the company's leadership can track them on /people.

What the product does

Alice sells its three products as one platform, WonderSuite, which its page says "combines pre-launch adversarial testing, real-time adaptive guardrails, and periodic production testing and drift detection" (Alice). Each stage maps to one product, and the work a security team does follows that order.

Before launch: WonderBuild. The team points WonderBuild at a model, application or agent before release. The company says it uncovers "prompt injection, jailbreaks, PII leakage, data leakage, policy violations, and adversarial vulnerabilities before deployment" (Alice). The same page lists text, image, audio and video testing, more than 120 languages and no-code CI/CD integration. The output is a launch decision: the platform page says the red teaming gives "security and legal teams the evidence to approve launch" (Alice).

In production: WonderFence. WonderFence is the company's AI guardrails product, and it is built around the customer's own rules. Its page says WonderFence "trains a dedicated detector for each of your policies using real-world adversarial data" (Alice). It reviews traffic in both directions. The company says blocking harmful inputs before they reach the model also keeps token costs down (Alice). For agents, Alice says the platform covers "prompt injection, unsafe tool calls, data leakage, and multi-step exploits" (Alice).

The controls a team keeps sit mostly here. Operators can see which detections were triggered, what actions were taken and why, across agents and applications (Alice). The product maps guardrails to EU AI Act, ISO 42001, NIST, MITRE ATLAS and OWASP, and the page states that "every decision is logged, every policy is documented" (Alice). Policy definition stays with the customer. Alice supplies the detectors that enforce it.

After launch: WonderCheck. Beyond the drift and regression testing noted earlier, WonderCheck offers scheduled, ongoing and on-demand runs plus validation of the guardrails already in place (Alice). In our reading, this is the step that checks whether the runtime layer still holds after a model update.

The pieces are meant to feed each other. Eric Levine of Apax Digital, an investor, described the design this way: "attacks observed in the wild seed the tests, the tests tune the guardrails, and model behavior in production feeds back into both" (Alice). That is an investor's description, not a measured result.

The company's case studies show the workflow in practice. In one, red teaming of a Fortune 100 investment firm's assistant came first. Alice says it then "built five custom policy enforcement models within 48 hours" (Alice). Outside the suite, Alice also released Caterpillar, an open-source scanner, after it caught malicious OpenClaw skills used by more than 6,000 users (Alice).

Figure: Alice's product page, captured 2026-10-29. Source: Production LLM Security & Real-Time AI Guardrails | Alice.

How it works and what it connects to

Alice describes three product layers that draw on one data source. WonderFence is the inline layer. The company says it "sits between your external-facing AI and your users", and its reference page gives a latency figure of under 150ms. The product page states that detection covers text, image, audio and video in 20+ languages. By our reading, that is a shorter language list than the testing product's, noted earlier. The platform page says the suite "combines automated adversarial testing with expert-led red teaming and real-time protection", so part of the testing is human work rather than software alone.

On integrations, the WonderFence page says it consolidates guardrails from multiple vendors and models into a single observability layer. Some customers run customer-experience agents on a third-party platform. For them, Alice says it connects through those platforms' existing CX agent extensions, "so there's no need to swap vendors or rebuild integrations". Grove Ventures' portfolio page lists earlier stories, under the ActiveFence name, on guardrails deployed on AWS Marketplace and partnerships with Databricks and NVIDIA. Those headlines name the channels. They do not describe how the integrations work.

Detection rests on Rabbit Hole. Alice's funding announcement describes it as a dataset of real-world adversarial and harmful content "which lets Alice recognize attack patterns in AI systems that it has already seen elsewhere". The company's reference page says the dataset "Evolves in real time to identify and anticipate new risks". The homepage calls it a network of in-house researchers and data.

Alice has published its own numbers for its detection model. For a 2025 benchmark it ran itself, it says it tested more than 28,000 prompts across categories defined by OWASP and MITRE ATLAS. It reported a precision of 0.890 and a false positive rate of 5.4% for its model. These are vendor-run tests, not independent ones. A health-platform case study describes a "segmented enforcement architecture" that, by Alice's account, cut false positives from 4% to 0.6% while keeping latency under 99ms.

The company lists SOC 2 and ISO 27001 certifications. The limit it states most plainly concerns other vendors' defaults: its apps page says built-in guardrails from an LLM provider "are a starting point, not a security posture".

Other profiles on our vendor record cover how neighbouring companies describe those points.

Where it sits in the market

CISO Tribune's record files Alice under two categories. The first is AI firewalls and guardrails: inline filters that inspect prompts, responses and tool calls of AI applications an organization builds. The second is AI model and agent security: scanning, red-teaming and runtime monitoring of models, AI applications and autonomous agents for attacks and unsafe behaviour. On our reading, WonderFence fits the first category, and WonderBuild and WonderCheck fit the second.

The chart shows how many vendors on CISO Tribune's record sit in each of the two categories Alice is filed under.

The record lists the following vendors as selling into one or both of those categories. Each has a profile in our vendor directory.

Alice's own pages draw their main line against the safeguards that ship with models and cloud platforms. That point came up earlier with built-in provider guardrails. The WonderFence page states: "Unlike the guardrails baked into your LLM or cloud platform, WonderFence is configured to your application, your policies, and the specific risks that come with your industry" (WonderFence). The platform page makes the same case for the whole suite: "Built-in model guardrails weren't designed for your application, your customers, or your regulatory environment. WonderSuite was" (WonderSuite). The homepage puts it in one line: "Off-the-shelf guardrails don't know your policies" (Alice).

The second line the company draws is scope. Its apps and agents page claims that "Most tools cover one part of the problem. WonderSuite covers all of it". It names pre-launch red teaming, real-time guardrails and post-launch testing in one platform (Alice). The same page says agents bring "attack surfaces that standard security tools weren't designed for" (Alice). These are the company's descriptions. CISO Tribune has not tested them against the neighbours above.

Alice also sells outside both categories. Its reference page lists content moderation and trust and safety for UGC platforms, which it calls "Alice's original expertise as ActiveFence" (Alice). Few of the neighbours above share that line of business, on our reading.

The category has seen ownership changes. In August 2026 Wowtale reported that Lakera had been acquired by Check Point and Protect AI by Palo Alto Networks, and that HiddenLayer remained independent (Wowtale). Terms used in this section are defined in our glossary.

Funding, investors and growth

Alice's most recent round came in August 2026, when it raised $140 million in a round led by Apax Digital, according to Multiples. The company's own announcement listed the participants. New backers were Samsung, SentinelOne, Maj Invest, MoreTech and Phoenix Financial. Returning investors were Resolute Ventures, Grove Ventures, CRV, Highland Europe, Vintage Investments, Norwest Venture Partners, NFX and Claltech (Alice). The company said the round took its total funding to $280 million and that Apax Digital would join its board (Alice).

Alice did not publish a valuation for the 2026 deal. Wowtale reported that valuations for the round ranged from $700 million to $1 billion depending on the outlet, and noted that Alice itself had not disclosed a figure.

The company said it would spend the money in three areas. The first was to further develop the platform that tests, defends and monitors AI models across their lifecycle. The second was to expand the team behind Rabbit Hole. The third was to scale its go-to-market organization serving foundation model labs and enterprises (Alice). Noam Schwartz framed it in the announcement this way: "This round is about closing that gap." (Alice)

The earlier money dates to the ActiveFence years. Multiples records that ActiveFence came out of stealth on July 27, 2021 with $100 million raised across two rounds. CRV and Highland Europe led the Series B. Grove Ventures and Norwest Venture Partners led a previously undisclosed Series A, and Resolute Ventures and Vintage Investment Partners also took part. The same profile states that the company was valued at over $500 million post-money at that point and reported roughly 100% annual growth (Multiples). Grove Ventures, which led that Series A, still lists the 2021 story on its portfolio page (Grove Ventures).

On growth, the company's figures are its own. Alice says it is approaching $100 million in annual recurring revenue and that its AI business grew more than 500% over the two years before the 2026 round (Alice). It says more than 150 researchers work in its AI security research lab and that it protects more than 3 billion people online (Alice). The company gives its base as New York and Tel Aviv, and its founding year as 2018 (Alice).

Alice has also grown by acquisition. Grove Ventures lists stories on ActiveFence buying Spectrum Labs and the UK-based Rewire (Grove Ventures). Multiples dates the Spectrum Labs deal to September 7, 2023 and records the price as undisclosed (Multiples).

Customers, partners and public evidence

Most of the public evidence for Alice comes from Alice itself. Its funding announcement described the company as trusted by Anthropic, Google, and Cohere, and the same post claimed it works with 8 of the 10 leading AI model labs. That ranking of labs is the company's own.

Named case studies. The case studies page names several model builders. It says Amazon partnered with Alice to red-team Nova Premier against high-risk prompts. It says Cohere reduced its time to mitigation by 38%. Black Forest Labs, Lovable and Niantic also have named entries. Sumeet Pandey of Google's generative AI partnerships team is quoted saying "Alice supports our most complex and high priority red teaming needs."

Anonymised case studies. Other entries do not name the customer. A Fortune 100 investment management firm is credited with five custom policy enforcement models built within 48 hours, with false positives under 1%. A digital health platform is said to have cut false positives from 4% to 0.6%. A toy company with a child-facing product has a third entry. These figures are Alice's own, and with no customer named, there is nothing outside the company's page to check them against.

Partners and listings. Alice's site carries a banner saying it partners with Inflection AI and AI21 on NVIDIA Nemotron safety. A later post said Alice and Inflection AI were releasing a multi-turn red-teaming dataset. Grove Ventures' portfolio page lists earlier headlines from the ActiveFence years:

• joining the AWS ISV Accelerate program
• guardrails deployed on AWS Marketplace
• tie-ups with Databricks and NVIDIA
• a sixth-place spot on Calcalist's list of 50 promising Israeli startups

The company's reference page lists SOC 2 and ISO 27001 certifications. We did not see the audit reports.

Benchmarks. Alice has published its own tests. Its 2025 benchmark report compared six prompt injection detection models on more than 28,000 prompts. Alice says its model achieved the highest precision (0.890) and F1 score (0.857), with a 5.4% false positive rate. In our reading, a benchmark designed and run by a vendor that scores its own model is a vendor claim, not independent evidence.

A second study, ENT-IPI Bench, tested eight frontier models acting as enterprise agents across 147 adversarial scenarios. It ran in May 2026 and reported a mean agent failure rate of 0.75. That study measures other companies' models rather than Alice's product.

Alice also announced Caterpillar, an open-source scanner. The company says it built the tool after catching malicious OpenClaw skills used by more than 6,000 people.

Research, open source and public work

The research below was published on Alice's own site, and each benchmark was designed, run and scored by the company. On our reading, the figures are best treated as vendor results: the sources we reviewed did not include an independent replication.

Prompt injection detection benchmark (2025). The benchmark covered earlier set Alice's detector against Deepset, Llama Prompt Guard 2, ProtectAI, Bedrock and Azure. It used prompt categories defined by OWASP and MITRE ATLAS and tested in 13 languages. The headline scores appear above. One detail in the company's own results table is worth noting: Azure posted a lower false positive rate, 0.028, but a recall of 0.273. In our reading, that shows the trade-off between blocking too much and missing attacks, and why no single metric settles the comparison.

ENT-IPI Bench (2026). Alice described this indirect prompt injection benchmark as the first entry in a series on agentic model behaviour. It placed models in enterprise tasks across seven work domains, from finance and legal to IT and customer support, and seven industries. Each scenario ran three times per model and was scored by an eight-judge jury of frontier models. A scenario counted as failed if any run scored below 7.0 on security. Claude Opus 4.6 had the lowest failure rate, 0.58, with the other models between 0.67 and 0.88. In a re-test against newer versions, Claude Opus 4.8 cut its rate from 0.58 to 0.17. Nova was not included in that round. Contributors included co-founder Iftach Orr, others from the Alice Labs team and Prof. Avi Mendelson of the Technion.

Open data and tools. Besides the Caterpillar scanner noted earlier, the Nemotron work produced a public dataset. Alice and Inflection AI said they were releasing a multi-turn red-teaming dataset aimed at risks such as emotional dependency and misplaced belief. The companies say these risks build over long conversations and that single-prompt benchmarks miss them. Alice says post-training NVIDIA's Nemotron 3 Super on the dataset "improved safety measurably".

Whitepapers, podcast and webinars. A whitepaper, "5 Ways Your Third-Party CX Agent Gets Broken", set out five attack patterns that, the company says, vendors miss. Alice's podcast recorded an episode live at Black Hat Las Vegas. In it, Caroline Wong and Allie Mellen discussed why AI made nation-state attacks cheaper and why safety guardrails can work against the people using them. A virtual fireside chat with Google's Nidhi Lahoti looked at what had changed six months after the TAKE IT DOWN Act took effect.

What a CISO should ask before buying

These questions are our reading of what a proof of concept should test. Each one is drawn from a claim Alice makes about its own products.

1. Latency under your load. The WonderFence page says each policy detector is deployed at sub-100ms latency. Ask Alice to measure this on your own traffic volume, with several of your custom policies running at once. Ask for tail latency as well as the average.

2. False positives on your traffic. Alice's 2025 benchmark summary reported a false positive rate of 5.4% on the company's own test set. That set included benign prompts with risky keywords but safe intent. Run a sample of your own benign prompts of that kind and compare the result.

3. Languages at runtime. WonderFence supports detection in 20+ languages. WonderBuild testing is described as covering 120+ languages. Ask which of your markets' languages the runtime guardrail covers, then test those languages directly.

4. Custom policy turnaround. In one case study, the company says it built five custom policy enforcement models within 48 hours for an investment firm. Hand over some of your written policies. Time how long a working detector takes to arrive, and ask how its accuracy is measured.

5. Agent coverage. Alice says WonderSuite covers prompt injection, unsafe tool calls, data leakage, and multi-step exploits. Ask to see a blocked tool call inside your own agent framework, and watch what the agent does after the block.

6. Third-party CX platforms. The company says it connects through existing third-party CX agent extensions. Ask which platforms are supported today, and what the extension can see and block on each one.

7. Audit trail. WonderFence's page states that every decision is logged and that guardrails map to the EU AI Act, ISO 42001, NIST, MITRE ATLAS and OWASP. Ask for a sample log export and for the mapping of one of your policies. Have your compliance team check both.

8. Multi-vendor observability. The same page says WonderFence consolidates guardrails from multiple vendors and models into one observability layer. If you already run other guardrails, ask which ones are supported and how their events arrive.

9. Drift testing in production. WonderCheck offers scheduled, ongoing, and on-demand testing along with guardrail validation. Ask how often tests would hit your production endpoint, what they add to your token spend, and who triages the findings.

10. Where your data goes. An Apax Digital executive described a loop in which "model behavior in production feeds back into both" tests and guardrails. Ask three things:

• whether your prompts and responses enter Rabbit Hole or train shared detectors;
• whether you can opt out;
• how retention works.

The company also lists SOC 2 and ISO 27001. Ask for the reports and confirm their scope.

Timeline

The dates below come from Alice's own pages, an investor database and press coverage. They run from the company's founding as ActiveFence to its partnership work this October. Most entries fall in 2026, the year of the rebrand and the largest funding round. Milestones already covered in earlier sections are referred to briefly here, not repeated.

The chart counts the dated milestones in this timeline by year, showing how many fell in 2026.

Chart data: Milestones cited in this profile; most from multiples.vc: Alice Valuation, Funding & Investors | Multiples.

• 2018: The company was founded. Its funding announcement says it was "Founded in 2018 and headquartered in New York and Tel Aviv" (Alice).
• July 27, 2021: ActiveFence emerged from stealth with $100 million across two rounds. These were a Series B led by CRV and Highland Europe and a previously undisclosed Series A led by Grove Ventures and Norwest Venture Partners (Multiples). The same profile put the post-money valuation at over $500 million.
• September 7, 2023: Alice acquired Spectrum Labs, the most recent of the two acquisitions Multiples lists. The other is Rewire.
• January 2026: ActiveFence rebranded as Alice (Wowtale). The company's page says the change reflected its "expanded focus on securing GenAI applications, AI agents, and foundation models" (Alice).
• May 2026: Alice ran its ENT-IPI indirect prompt injection benchmark. It tested eight models as enterprise agents across 147 adversarial scenarios and reported a mean AFR of 0.75 (Alice). The later re-test is covered in the research section.
• August 2026: Alice raised $140 million in a round led by Apax Digital (Multiples). The company says the round took total funding to $280 million (Alice).
• October 15, 2026: Alice announced a partnership with Inflection AI and AI21 on NVIDIA Nemotron safety, according to a news banner on its site. The dataset work with Inflection AI described earlier came out of this collaboration.

Several of these entries rest on Alice's own blog and news pages. They are the company's account of its work, not independent confirmation. The benchmark dates, in particular, describe tests Alice designed and scored itself. Readers tracking executive changes at the company can follow /moves. Other companies on our record in the same categories are listed at /vendors.