CultureAI raises €9M: Founder & CEO James Moore on how the UK startup aims to mitigate employee security risks

Manchester-based CultureAI, a human risk management platform, announced on Wednesday that it has secured $10M (approximately €9M) in a Series A funding round led by Mercia Ventures and Smedvig Ventures.

Existing investors, including Passion Capital and Senovo, also participated in the round.

The UK company will use the funds to invest in the evolution of its product and expand its team across all departments, aiming to double headcount over the next 12 months.

Additionally, it plans to increase its market profile and presence in the US.

What does Culture AI solve, and how?

Despite many companies investing heavily in awareness and training programmes over the years, Forrester predicts that 90 per cent of data breaches in 2024 will involve human error as infrequent security training doesn’t change employee behaviour.

And here’s where CultureAI comes into play!

“Security compliance is required for meeting specific standards and regulations. However, continuously forcing employees to sit through irrelevant, out-of-context security awareness training can leave employees feeling disengaged, and eager to click through as quickly as possible,” explains James Moore, the founder and CEO of CultureAI, when discussing how CultureAI is mitigating the risk of data breach to Silicon Canals. “Understanding individual needs and providing tailored coaching is important.”

The UK-based company’s platform enables organisations to understand the risk individually rather than at an organisational level only. 

It tracks over 40 real-time employee behaviours, empowering security teams to observe individual, departmental, and organisational changes.

“It’s then possible to meaningfully target employees with the automated, relevant coaching at the point of risk, to where they are working,” adds Moore.

CultureAI believes that even well-trained employees can make mistakes and as a result, it offers Automated Interventions to address risks as they occur.

The company also ensures employees are only contacted when immediate action is required or if there is critical information, they need to know to mitigate risks. This approach ensures minimal disruption for those who are already following best practices.

Provides tailored “just-in-time education”

According to Moore, CultureAI‘s platform leverages real-time data and advanced analytics to monitor and analyse employee behaviour, identifying learning gaps and opportunities.

Unlike traditional security awareness training programmes that rely on static, one-size-fits-all content, CultureAI provides tailored “just-in-time education”.

As a result, employees receive immediate, context-specific alerts and guidance based on their actions, which increases engagement and effectiveness.

“Our platform allows security teams to move beyond static course content and the simplistic ‘more training’ approach to risky behaviour. Instead, they can implement Automated Interventions to fix risks directly or deploy Nudges that empower employees to fix risks with a single click,” adds Moore.

The company’s analytics and reporting tools enable organisations to track behavioural shifts over time drill down into specific security behaviours.

Additionally, the platform reduces the “mean time to resolve” security issues by identifying previously unnoticed risks and facilitating automated fixes, says Moore.

Challenges

“The biggest challenge we’ve faced in growing our business has been in distancing ourselves from the security awareness training status quo,” explains Moore.

“We’ve successfully stood head and shoulders from the crowd by showcasing the art of the possible with behavioural data and advanced analytics. Once organisations realise they can identify and mitigate the majority of employee-created risks in real-time, they rarely continue searching for traditional training content and hoping employees follow the advice,” he adds.

Tackling new cybersecurity threats

Moore explains how to tackle the new cybersecurity threats: “We’re witnessing a rise in diverse emerging threats, from poisoned tenants and SAMLjacking to the unauthorised training of large language models (LLMs) on sensitive data disclosed by employees. The common thread among these threats is employee involvement.”

The UK company aims to combat these threats by ingesting and analysing telemetry from various sources, including popular web browsers, to identify when employees are at risk and intervene immediately.

The investor

Mercia Ventures is a proactive venture capital investor that makes equity investments of up to £10M across all sectors, specialising in Software, Consumer, Healthcare, and Deep Tech. As of 30 September 2023, Mercia Asset Management PLC has c.£1.5B of assets under management. 

Adam Lovell, Investor at Mercia Ventures, says, “CultureAI is at the forefront of developments in the emerging field of human risk management. With a deep understanding of the challenges that companies face, James and his team have developed a holistic solution that can secure businesses against a wide range of cyber threats. We believe the company is poised to achieve break-out growth. The funding will help it to further target a global audience and establish itself as a market leader.”

Smedvig Ventures helps B2B tech teams by investing between €4-8M in rounds of up to €20M across Europe. 

Joe Knowles, Partner at Smedvig Ventures, adds, “It is widely accepted that human error is the most prevalent vector for cyber-attacks and is poorly protected against by ineffective training programmes. Advanced analytics applied to real-time behavioural data presents an original approach for CISOs to control human cyber risk. CultureAI is pioneering this with its market-leading software, offering immediate visibility and mitigation of vulnerabilities. James has an incredible reputation as a thought leader in the space and we are excited to partner with him and his team alongside Mercia Ventures.”

Aaron Paddison, Associate Director – of Cyber Security at Peninsula Group says, “We recognised blanket training was having very little real impact when it came to improving employee security behaviours and we wanted a more targeted solution. CultureAI has been a game-changer for us in terms of understanding what our people are doing. Rather than relying on training modules, which people immediately forget, we can intervene as and when a risk is occurring.”