vlno

**Product and the concrete problem it solves.** vlno is addressing a specific failure mode in the transition from chatbots to autonomous software: an agent can be given a legitimate goal and then encounter hostile instructions hidden inside a web page, email, PDF, retrieved document, or tool response. Because the malicious text is presented as data rather than as an explicit user prompt, conventional instruction filters and gateway guardrails can miss it. The resulting risk is not merely an incorrect answer. An agent with access to files, code, payment systems, identity providers, or operational APIs can be manipulated into exfiltrating information, changing state, or taking an action that its human operator never authorized. vlno's thesis is that organizations need to harden the model itself, not only surround it with runtime controls. The company's public product is therefore a security-training layer for open-weight and agentic models: it measures how a model behaves under adaptive attack, produces the examples and trajectories needed to change that behavior, and keeps re-testing as the model or attack surface changes. This is particularly relevant to sovereign AI programs that want the control and economics of open models without accepting an unmeasured robustness gap.

**Core technology and how it actually works.** The public architecture describes a continuous attack-and-hardening loop rather than a one-time red-team report. First, an adaptive attacker generates indirect prompt-injection scenarios tailored to the customer's agentic workflow and executes them against sandboxed enterprise surfaces. The system measures an attack-success rate and identifies the conditions under which the agent confuses an instruction with untrusted content. Second, vlno converts successful attack trajectories into training data, including reinforcement-learning and preference-optimization material, or into a hardening LoRA that the customer can apply inside its own fine-tuning pipeline. Third, the modified checkpoint is tested again, and its robustness is re-certified when a new model version, fine-tune, or attack class appears. The joint reference architecture with Wand AI places this capability at two control points: admission testing before a model enters an open-model registry, and weight-level hardening for models that do not meet the required threshold. The artifact is training data or a LoRA, not the customer's weights or workflow content, which is designed to keep sensitive material inside the customer's trust boundary. This is a materially different position from an inference proxy: runtime filters still have a role, but vlno aims to make the model less likely to follow the malicious instruction in the first place.

**Market, customers, and go-to-market.** vlno sits at the intersection of AI security, post-training infrastructure, and sovereign compute. Its immediate buyer is likely to be a frontier-model team, an enterprise AI platform group, or a government and regulated-industry program that wants to deploy an open-weight model with measurable security evidence. The customer does not need to replace its orchestration layer: the advertised outputs are intended to plug into an existing fine-tuning path, while the public benchmark provides a low-friction way to measure a model before procurement or production approval. The August 2026 Wand AI integration gives vlno a concrete channel into sovereign deployments, where model control, local hosting, and accountable security posture are procurement requirements rather than optional features. Other plausible buyers include defense contractors, intelligence organizations, banks, healthcare systems, and critical-infrastructure operators that cannot send operational context to a third-party frontier API. Public sources do not identify paying customers, annual recurring revenue, contract sizes, or a formal sales pipeline, so the commercial stage should not be overstated. The best near-term go-to-market motion is ecosystem-led: become the robustness gate for sovereign model registries and the hardening component in agent platforms, while using the public benchmark to establish a common measurement vocabulary with security and ML teams.

**Traction, validation, and financing posture.** The strongest disclosed validation is technical and ecosystem-based rather than financial. vlno's own site says it is already hardening agents used in real enterprise environments and working with leading companies on governed deployments, but it does not name those companies or publish independent benchmark results. Its public partnership with Wand AI is more concrete: the two companies describe an architecture in which Wand operates the sovereign agentic stack and vlno supplies admission testing, adaptive attack generation, hardening artifacts, and continuous re-certification. The partnership also identifies a real buyer problem: governments and regulated enterprises may prefer open weights for sovereignty and cost, while security teams need evidence that those models can withstand manipulation. Crunchbase lists vlno as an active private company in Tel Aviv with the vlno.ai domain, and public LinkedIn material identifies Hertzel Tokgoz-Kuriel, also referred to in company material as Hertzel Kuriel, as co-founder and CEO. No public source reviewed for this record discloses a funding round, valuation, total capital raised, customer count, patents, certifications, or independently reproducible attack-success benchmarks. That absence is not a defect to hide; it is the central diligence constraint. The company has a credible public ecosystem entry and a defined technical product, but the record should distinguish partnership availability and company-stated production work from audited scale.

**Founders and team background.** vlno presents itself as being built by people who previously hardened models inside leading frontier labs and who have experience in adversarial research, model evaluation, and reinforcement-learning-based post-training. The company has publicly named Hertzel Tokgoz-Kuriel as co-founder and CEO in the Wand integration announcement, while the official site describes a small senior team spanning adversarial research, platform engineering, ML/post-training, and operations. Public material also associates Ismail Kharoub with the company's sovereign-AI reference-architecture announcement, although his exact corporate title is not established in the sources used here. That profile is strategically relevant because the technical challenge is not generic application security: it requires understanding how model behavior changes under data poisoning, adversarial instruction search, tool-use evaluation, fine-tuning, and deployment-time serving differences. The team's claimed frontier-lab experience is a credible founder-market-fit signal, but it remains largely self-described and does not substitute for published biographies, named prior employers, peer-reviewed work, or third-party performance evidence. Headcount is not disclosed beyond the official description of a small senior team. Diligence should therefore test whether the company has enough research depth to maintain adaptive attackers, enough systems engineering to integrate with customer training stacks, and enough security-program experience to translate an attack-success metric into a procurement-grade assurance artifact.

**Competitive dynamics.** vlno competes against several different approaches rather than one direct incumbent. Model-evaluation and red-team firms find vulnerabilities but generally return reports, not modified weights. Runtime AI-security vendors place filters, policy engines, or observability in front of model calls and can stop some attacks without changing the underlying behavior. Frontier labs such as Anthropic, OpenAI, Google DeepMind, and Meta conduct their own safety training and red teaming, creating a make-versus-buy threat for the largest model builders. AI-security platforms such as Robust Intelligence, HiddenLayer, Protect AI, and Lakera compete for adjacent model testing, model supply-chain, or prompt-injection budgets. vlno's proposed edge is the closed loop between adaptive attack discovery and weight-level remediation, combined with a deployment model that can keep sensitive data and model artifacts inside a sovereign environment. Its distinction is meaningful only if the hardening generalizes beyond the exact attacks used for training; otherwise it risks optimizing a benchmark while leaving the agent vulnerable to a new attacker. The company also faces a channel conflict with platform vendors that may treat robustness as a feature of their own model registry or agent runtime. Sustainable differentiation will require a trusted measurement protocol, strong transfer across models and frameworks, low operational friction, and evidence that customers improve robustness without sacrificing capability or latency.

**Defense, security, and resilience relevance.** vlno has credible dual-use relevance because the core capability applies to both commercial AI and high-assurance national systems. In a defense or intelligence setting, an open model may be attractive because the operator needs local control over weights, data, compute, and policy, but an agent that consumes battlefield reporting, intelligence feeds, maintenance documents, or tool output also faces a large indirect-instruction attack surface. Weight-level robustness can complement runtime authorization, sandboxing, provenance, and human approval by reducing the probability that hostile content changes the agent's interpretation before those controls are invoked. The same pattern applies to critical infrastructure, emergency management, healthcare, and financial systems where an agent may be allowed to query or update sensitive operational state. The Wand reference architecture explicitly describes ministries, regulated enterprises, and sovereign infrastructure as target contexts, which makes the defense and resilience adjacency more than a generic claim. It still does not prove a fielded military deployment, government contract, security clearance, or certification. Strategic value is therefore best described as enabling infrastructure for trustworthy sovereign AI, not as an existing defense product. Key security questions include whether the hardening survives adaptive attackers, whether training artifacts can introduce new backdoors, how the system handles multilingual and multimodal content, and how a customer proves that a model update has not invalidated its robustness certificate.

**Growth stage, trajectory, and diligence risks.** vlno is classified as early because it is publicly described as a stealth-era company with a small team, no disclosed financing or headcount, and an initial ecosystem partnership rather than a transparent record of scaled commercial deployment. Its trajectory could be important: if open-weight models become the default for sovereign and regulated AI, a repeatable robustness gate could become a required piece of national compute infrastructure in the same way that vulnerability scanning and identity controls became standard in enterprise software. The upside depends on turning a compelling security thesis into a measurable, trusted workflow that works across model families and customer-owned environments. The major diligence risks are concentrated. First, the public evidence is mostly company and partner material, with no independent benchmark replication or named customer references. Second, adversarial training can overfit to known attack classes while missing novel attacks, and a claimed attack-success rate is meaningful only when the attacker budget, model serving path, sample distribution, and confidence interval are disclosed. Third, model hardening can degrade useful capabilities or create hidden bias, and LoRA or post-training artifacts may be difficult to govern across versioned deployments. Fourth, the market could be absorbed by frontier labs, cloud providers, model registries, or runtime security vendors. Fifth, sovereign programs have slow procurement and high assurance burdens. vlno merits close monitoring because it targets a foundational security layer for agentic AI, but the next proof points should be independent evaluations, named production customers, repeatable integration evidence, disclosed financing and team depth, and a demonstrated ability to harden models without materially reducing capability.