AI Physical Security
Intelligence Report

Pulsar VLM is not an analytics overlay. It is a reasoning system trained specifically on physical security threat signatures across 150+ threat categories. Where legacy video analytics detect an object class ("person detected"), Pulsar reasons about the scene: who is present, what they are doing, whether the behavior is anomalous relative to the location and time context, and what threat category applies if any. The output is not a pixel-match alarm. It is a contextualized threat assessment with a four-step reasoning trace the operator can review.

ARR doubled in FY26 with 140%+ net revenue retention, meaning existing customers are expanding deployments faster than Ambient is adding new logos. That metric is the strongest signal of product-market fit in the enterprise SaaS market.

Securitas Technology global reseller agreement closes the distribution gap that kept Ambient a known quantity among practitioners but limited in field sales reach. Securitas has the integrator relationships, the service contracts, and the enterprise security account footprint to carry Pulsar into large-enterprise accounts that Ambient's direct team cannot reach cost-effectively.

CoreBastion assessment: Ambient AI is the preferred AI analytics platform for data center and CNI physical security programs at scale. The VLM approach is structurally superior to rule-based analytics for high-camera-count perimeter and interior monitoring. The Securitas partnership de-risks the integration and support question that previously prevented some enterprise procurement teams from moving forward.

On the specific combination Mistabra sells, no. Nobody else is running continuous adversarial simulation against a digital twin of a physical facility, across an entire portfolio, on a subscription, with the resulting score wired into insurance underwriting. That combination is genuinely unoccupied.

On the underlying technique, the answer is that it has existed for over a decade and it is accredited. ARES Security has been building 3D digital twins of sites and running thousands of Monte Carlo adversary simulations through its AVERT suite since 2012. AVERT is DHS SAFETY Act designated, DoD and DoE accredited, and reported in use across roughly two thirds of the North American commercial nuclear fleet. Sandia National Laboratories has been doing it longer through Scribe3D, PathTrace, and the EASI lineage that underpins performance-based physical protection assessment worldwide, in 28 countries, licensed free to approved partners.

Any investor who spends an hour on diligence will find both. A category-creator claim that does not survive that hour costs more credibility than it buys.

A second peer, found on the Q3 review: RhinoCorps. Simajin/Vanguard has run agent-based physical security combat simulation inside the DOE complex for over 15 years, is SAFETY Act approved, is named in the Nuclear Power Plant Security Assessment Guide, and through PACRAT (licensed from PNNL) blends physical and cyber pathway analysis in one model. It runs thousands of Monte Carlo trials unattended once configured. It is the single hardest entry for a category-creation claim to get past, and it is less well known than ARES, which makes it more dangerous in diligence rather than less.

The asymmetry to carry into every conversation. ARES has DoD and DoE verification and validation testing plus DHS certification. RhinoCorps has 15 years of DOE program use and NRC guidance recognition. Sandia is the methodology. Everything currently known about Mistabra’s capability comes from Mistabra, in confidential preview, with no published validation. That is a normal position for a preview-stage company and not a criticism, but it means this comparison is claims measured against verified capability. Two rankings exist here: on delivery model Mistabra leads and nothing is close; on demonstrated capability it sits behind four federally validated tools. Lead with the first and be ready for the second.

The distinction that does hold up. AVERT, Vanguard, and the Sandia tools are analyst-operated project instruments. A trained assessor builds the model, defines the design basis threat, runs the study, and delivers a report. That is a consulting engagement with software attached, priced and scheduled accordingly. Mistabra’s claim is a delivery model claim, not a physics claim: continuous rather than episodic, portfolio-wide rather than site-by-site, subscription rather than engagement, operator-run rather than analyst-run, and scored in a form an underwriter will actually price against. Positioned that way the claim survives diligence. Positioned as "nobody has ever simulated an attack on a building" it does not.

Every platform in this segment produces a number. Where the number comes from is the only question worth asking, and most buyers never ask it.

Assessment platforms produce asserted scores. A human walks the site, answers a structured question set, and the platform applies scoring math to those answers. Circadian Risk, RiskWatch, EasySet, and Resolver all work this way. The workflow, the audit trail, and the remediation tracking are real value. The score is not independently reproducible: send two competent assessors to the same facility and you get two different numbers, because the input is judgment. Change nothing about the site and change the assessor, and the posture appears to change.

Simulation platforms produce derived scores. The analyst or operator sets the geometry, sensor placement, delay elements, and response times. The result falls out of the model whether anyone likes it or not. Mistabra, ARES AVERT, and the Sandia tools work this way. Two people running the same model get the same probability of interruption. That is what makes the output defensible in front of an auditor, a board, or an underwriter, and it is why an insurer can price against it.

Practical consequence. Framework-mapped assessment tools reward documented controls rather than demonstrated performance. A site can pass an ASIS or NERC CIP-014 aligned assessment cleanly and still be trivially defeatable, because nothing in the process ever tested whether the control stops an adversary. That gap is the segment’s real opening, and it is a stronger argument than any competitive comparison, because it indicts the status quo rather than a rival product.

Both were carried in an earlier draft of this segment and both fail the test. Naming them here is deliberate: a category boundary that excludes nothing is not a boundary.

Resolver (Kroll). Incident management, investigations, and case management with GRC layered on top. Founded 2000, acquired by Kroll in 2022. Its real strength is chain-of-custody investigation workflow, and its physical security assessment capability is one module inside a corporate security suite. It is backward-looking by design: it documents what happened and manages the response. It never produces a facility posture number, and it does not model an adversary. It competes for corporate security budget, which is worth knowing, but it is not in this category.

EasySet. A physical security assessment report generator. An assessor walks the site with a mobile app, answers guided questions, selects from a prewritten library of vulnerabilities and solutions, and the platform builds a branded PDF. It does produce an Asset Vulnerability Risk Score on a 1 to 100 scale, but the vendor states plainly that the score combines documented vulnerabilities with the assessor’s own risk rating and mitigation priorities. That is assessor judgment with arithmetic applied, and EasySet is candid about it. It is the tool a consultant uses to produce the deliverable, which makes it part of the status quo this category sells against rather than a competitor within it.

The generic claim has no answer to this. The unbundled version does, and it is the single most useful paragraph in an investor conversation.

It has not been built because the accredited tools require a trained analyst and a formally defined design basis threat before they produce a number. That requirement caps them at nuclear plants and defense installations that can justify a six-figure engagement per site. Removing the analyst from the loop is the actual product problem, and it only became tractable recently. The insurance linkage is a separate problem that requires a carrier partner willing to price a novel score, which is why almost nobody gets that far.

The caveat worth carrying into the room. This gap is real but it is not a moat. ARES already holds the engine, the accreditation, the reference customers, and the twin library. The only thing between them and this position is a decision to productize AVERT as a subscription. Frenos has now publicly demonstrated that the model sells in a neighboring domain, with ARR up more than tenfold since the start of 2025. Treat the whitespace as a head start measured in quarters, not a defensible position measured in years.

Lead with the delivery model, not the invention. The strongest version of the pitch concedes the prior art immediately and then explains why it never reached the market: the accredited tools require a trained analyst, a defined design basis threat, and a per-site engagement budget, which caps them at high-consequence facilities that can justify the cost. That is why physical security still buys assessments at roughly $18,000 to $20,000 a site, episodically, covering a fraction of a portfolio.

Then make the redistribution argument. This is not a new budget line. It is an upgrade to spend that already exists, and it frees the human red team budget to concentrate on the small number of sites that genuinely need boots on the ground.

Then close on the insurance channel, because it is the only part of this story that no competitor in any of the three domains currently has. A physical readiness score an underwriter will price is a different kind of asset than a security report, and it moves the buying decision out of the security budget and into finance and risk.