Nightfall AI

AI-native, API-first data loss prevention: ML/LLM detectors find PII, secrets, PHI and IP across SaaS apps, browsers and GenAI tools, and block or redact before data leaves.

One-liner — A cloud-native DLP platform that uses machine-learning detectors (not regex/agents) to find and stop sensitive data leaking into SaaS apps, browsers, and GenAI tools like ChatGPT.

Categories — dlp

What it does

Nightfall is a data loss prevention and insider-risk platform built around an AI-native detection engine. Instead of the regex/keyword rules and heavy endpoint agents of legacy DLP, it uses machine learning plus LLMs (and computer vision/OCR for images and screenshots) to classify sensitive content — PII, PHI, PCI/payment data, credentials and secrets, plus contextual business data like source code, customer lists, financial projections and board materials — claiming >95% precision (vendor marketing).

It connects to SaaS apps via API to scan data at rest and in motion, offers a lightweight browser extension to govern what employees paste/upload into AI tools, and exposes the detection engine as cloud-hosted APIs/SDKs (the “Nightfall Developer Platform”) so teams can embed scanning into their own apps and pipelines. Recent direction (Jan 2026 “AI Browser Security”) extends enforcement across three layers — browser, endpoint, and SaaS — under one policy framework, and adds an autonomous DLP triage analyst (“Nyx”).

Where it sits in the stack

Primary category: dlp (Data layer). Its job is preventing sensitive-data egress: it inspects content at the points where data leaves a sanctioned zone (a SaaS app, the browser, a prompt to an external LLM) and blocks/redacts. Its risk role is preventing sensitive-data leakage and blocking exfiltration — it does not screen untrusted input (prompt injection). It overlaps the data-security neighborhood: lighter-touch and more egress/leak-focused than full microsoft-purview-style suites, and adjacent to DSPM (cyera, bigid) which focuses on discovery/posture of data at rest rather than inline interception.

Deployment & architecture

• API / SaaS connectors — native API integrations to SaaS apps (Slack, GitHub, Google Drive, Jira, etc.), scanning at rest and in motion; no endpoint agent required for SaaS coverage.
• Browser extension — lightweight extension (Chrome Web Store) that intercepts file uploads, clipboard paste, form submissions and screenshot sharing into ChatGPT, Gemini, Claude and other sites, redacting or blocking before transmission. Notably it does this without an inline proxy or SSL inspection, which lowers deployment friction versus proxy-based CASB/SWG DLP.
• Endpoint — newer coverage of desktop AI apps, cloud-sync tools, Git, USB, and printing.
• Developer platform — cloud-hosted detection APIs/SDKs to embed scanning in custom apps.
• Detection engine: ML + LLMs + computer vision/OCR.

Positioning & differentiators

Nightfall’s pitch is “DLP rebuilt for the AI/SaaS era”: API-/browser-native and ML-driven rather than agent-heavy and rule-driven. Differentiators it emphasizes (marketing) are fast out-of-the-box deployment, high-precision ML detection that reduces false positives, and the no-proxy browser approach for governing GenAI usage. Versus nearest neighbors: cyberhaven leads with data-lineage/origin tracking; mind is another AI-era DLP entrant; prompt-security and lasso-security approach the GenAI-leak problem from the AI-runtime/guardrail side rather than classic DLP. Large platforms (microsoft-purview, forcepoint, netskope) bundle DLP into broader suites.

Ownership, funding & M&A

Independent, venture-backed. Founded 2018 in San Francisco by Rohan Sathe (now Co-Founder & CEO) and Isaac Madan (Co-Founder); note that the 2022 Series B announcement named Madan as CEO, so leadership framing has shifted over time. Funding: $40M Series B on 2022-08-10 led by WestBridge Capital, with Bain Capital Ventures, Venrock, Pear VC and Next Play Capital; third-party trackers (Crunchbase/ PitchBook) put cumulative funding around $60M. No acquisition found — the seed registry carried no M&A flag, and nothing in research indicates one; ownership set to independent / confidence medium (no primary cap-table doc reviewed). Funding_total is from aggregators, not vendor-confirmed.

CTO / hedge-fund lens

DLP is broadly Day-1 for a regulated asset manager (preventing leakage of MNPI, client PII, and positions). Nightfall fits a shop that wants to govern GenAI/SaaS data leakage specifically without standing up proxy-based DLP or rolling endpoint agents — the browser extension and API connectors are quick to deploy. It is relevant to controlling what staff paste into ChatGPT/Claude and to scanning Slack/Drive/GitHub for leaked secrets and PII. It is not a comms-surveillance/SR 11-7 tool and does not cover model risk; pair it with archiving/surveillance (behavox, theta-lake) and, if you run internal LLM apps, with runtime guardrails. Caveat for the smallest funds: it is a dedicated platform spend, and a shop already on Microsoft E5/Purview or Netskope may get “good-enough” DLP bundled.

Competitors / alternatives

cyberhaven, mind, prompt-security, lasso-security, microsoft-purview, forcepoint, netskope, cyera

Open questions / to verify

• Vendor-confirmed cumulative funding and any post-2022 round (only $60M aggregate from trackers).
• Current employee count and revenue scale.
• Whether endpoint coverage requires an agent (newer “AI Browser Security” endpoint layer).
• Confirm current CEO/leadership (Sathe vs Madan) from a primary source.

Sources

• Nightfall — About — fetched 2026-06-28 — supports: founders, positioning, investor list, customers; confidence: med (vendor).
• Nightfall raises $40M Series B — fetched 2026-06-28 — supports: $40M Series B 2022-08-10, lead/investors, HQ San Francisco, deployment, legacy-DLP differentiators; confidence: high (vendor primary on funding).
• Nightfall DLP for Browsers / ChatGPT GenAI DLP — fetched 2026-06-28 — supports: browser-extension behavior, no-proxy, ML/OCR detection, GenAI redaction; confidence: med (vendor).
• Nightfall expands data protection with AI Browser Security (SiliconANGLE) — fetched 2026-06-28 — supports: Jan-2026 three-layer launch, no-proxy approach, CEO Rohan Sathe quote, legacy-DLP positioning; confidence: high (trade press).
• Funding aggregate (~$60M): Crunchbase/PitchBook/Tracxn (third-party trackers; not cached) — confidence: low/med.

History

• [2026-06-28] Stub created from seed registry.
• [2026-06-28] Researched; established founded 2018, HQ San Francisco, founders Rohan Sathe (CEO) & Isaac Madan, $40M Series B (2022, WestBridge) / ~$60M total per trackers, independent (no M&A). Documented API/SaaS + browser-extension + developer-API deployment and AI-native ML/LLM detection; positioned vs legacy DLP and GenAI-leak neighbors. Set status: researched, confidence medium. 4 sources cached.