Outtake Gets $40M to Grow Automated Threat Response

A startup led by a former Palantir engineer raised $40 million to enhance its automated digital risk protection and expand its open-source intelligence capabilities.

See Also: Cloud Security and the Evolving Role of the Firewall

The ICONIQ-led Series B round will help New York-based Outtake use agents and multimodal artificial intelligence models to detect and remediate digital risk across the internet, ranging from impersonations to complex threat campaigns, said founder and CEO Alex Dhillon. Outtake’s use of automated and engineering-based integrations for remediation stands in contrast to rivals who rely on human labor and relationships.

“We were a very lean team,” Dhillon told Information Security Media Group. “Despite that, we have insane traction. That’s why now was like, ‘Hey, the market’s exploding. People want our product. It’s time to step up when it comes to the go-to-market aspect of our house.'”

Outtake, founded in 2023, employs 44 people and has raised $60 million, having last completed a $16.5 million Series A funding round in April 2025 led by Charles River Ventures. The company has been led since its inception by Dhillon, who previously spent nearly five years at Palantir, culminating a role as an experimental engineer for AI (see: Human Threat Intel Anchors ZeroFox’s Security Vision).

Why Engineering-Led Integration Beats Human Relationships

The last two years have seen a rapid acceleration of attacks powered by generative AI, making brand impersonation, phishing and socially engineered scams more scalable and sophisticated, Dhillon said. Lead investor ICONIQ isn’t focused on a quick exit or small-scale success, and instead aligns with Outtake’s ambition to build a public-market-ready, platform-scale cybersecurity firm, Dhillon said.

“They partner with companies that are absolutely breaking out, that have strong public market potential,” Dhillon said. “They asked a lot of hard questions. They talked to almost all our customers. But I’d say they’re very sophisticated investors who really look for public market outcomes and that align with our own vision.”

Outtake’s platform for digital risk protection, or DRP, identifies and takes down impersonation and phishing attacks, fake websites, social media accounts and more, Dhillon said. Many rivals offer open-source intelligence, or OSINT, as a generic feed of external threat data, but Outtake turns it into an investigation and automation engine by mapping relationships between data points and enabling immediate, meaningful actions.

“OSINT really emerged as a way to make our DRP better than anyone else’s DRP,” he said. “Most DRP solutions just look for the one fake and return the one fake. Open-source intel allows you to say, ‘Okay, great, I know what else it’s connected to.’ OSINT might actually give you a heads up on an incoming attack. That’s one of the ways that we move so fast.”

Unlike most digital risk protection vendors who rely on overseas human labor and ad hoc relationships with takedown platforms, Dhillon said Outtake prioritizes engineering-led integration. The platform builds direct, programmatic connections to infrastructure providers including Cloudflare, AWS, GoDaddy and social platforms, ensuring faster, more scalable and more reliable takedowns, Dhillon said.

“Are you able to pull together the right set of evidence that actually explains why this needs to be remediated? And two, is that so high quality that you are actually a trusted partner?” Dhillon said. “At this point, we can cover even the long tail of websites often within one to two days. And we integrate via engineering rather than relationships, which is, unfortunately, a common thing in our industry.”

Why Multimodal Models Beat Keyword-Based Text Search

When threats are delivered through an API or platform-to-platform integration, they can be automatically reviewed, triaged and acted upon by systems on the receiving end, often without requiring human intervention, Dhillon said. In contrast, traditional relationship-driven models break down when individuals leave companies or roles, creating reliability issues over time, he said.

“That human might move jobs in a year, and suddenly, the integration is not working anymore,” Dhillon said. “That’s just not how you build a generational cybersecurity company. So, we just absolutely refuse to make that our MO.”

Traditional cybersecurity vendors often rely on keyword-based text search to detect threats, but this model misses a vast swath of malicious content, especially as over 80% of internet traffic is now made up of images, videos and multimedia, Dhillon said. Outtake can identify a phishing scam where a logo is embedded in an image or a video walkthrough is being used to lure users into a malicious scheme.

“A failure for the majority of threat intel providers is that they basically run all their searches just based on text and keywords,” Dhillon said. “In a world where 80% of internet traffic is image and video content, you’re obviously just actually not seeing most things. Multimodal models are obviously going to find at a much higher rate the things you actually care about.”

In DRP, Dhillon cited ZeroFox as the most common competitor, recognizing its role in establishing the category but also emphasizing that Outtake often wins in direct competition due to its automation-first approach. Outtake encounters Recorded Future and Dataminr around open-source intelligence, but Dhillon views Outtake as differentiated in how it turns threat intelligence into action.

“From a DRP perspective, we’ll hear of ZeroFox the most,” Dhillon said. “I’m proud to say that we’ve also, I think, beaten them. On the OSINT side, we sometimes hear of Recorded Future, we hear of Dataminr – both great companies. But again, customers get really excited because of that multimodal workflow orchestration capability that seems quite distinguished.”