The biggest single owner of AI-security patents in the world is not a security vendor. It is State Grid Corporation of China, an electricity utility. That one fact reframes the whole landscape, and points to where the open frontier actually sits: the model, prompt, and agent layer.
The biggest single owner of AI-security patents in the world is not a security company. It is not Palo Alto, CrowdStrike, or even Microsoft. It is State Grid Corporation of China, an electricity utility, sitting on 612 patent families at the intersection of artificial intelligence and cybersecurity. That one fact reframes how to read this entire landscape. AI security is no longer a product category owned by vendors. It has become an operational necessity owned by whoever runs critical infrastructure.
We mapped the field this week in Minesoft Origin, more than 17,000 patent families pairing AI or machine learning with cybersecurity, and the shape of the data tells a clearer strategy story than any vendor press release. Two findings matter most. The biggest owner is an infrastructure operator, not a vendor. And the part of the field still worth filing into is no longer threat detection. It is the model, prompt, and agent layer, where the patent ground is thin and the curve is bending right now. The first finding tells you how the field changed. The second tells you what to do about it.
In 2015, the field saw 158 new families. By 2024, that number hit 3,264. The curve is a clean hockey stick, and the inflection lands right around 2020, exactly when machine learning crossed from research demos into shipped security products. Anomaly detection got a neural network. Malware classification got a model. Intrusion detection stopped being purely rule-based.
One caveat worth stating plainly: the 2025 bar looks like a dip, but it is a publication-lag artifact. Patent applications take 18 months or more to publish, so the most recent years always fill in later. Read 2025 as incomplete, not as a slowdown. The trend is still up and to the right.
Here is the leaderboard that should make every security CEO look twice. State Grid Corporation of China leads with 612 families. China Southern Power Grid, another utility, sits at 240. Between them, two electricity companies hold more AI-security IP than almost any pure-play vendor on the planet.
The Western names are exactly who you would expect, just smaller. Cisco leads the vendor pack at 282 families, Microsoft at 272, and Darktrace at 220. IBM, BlackBerry, and Sophos cluster behind them. And then there is Bank of America at 146, a reminder that the heaviest filers now include the companies that have the most to lose, not just the ones selling the tools.
That mix is the real signal. When utilities and banks file patents alongside security vendors, AI security has stopped being a niche product line. It is infrastructure. The organizations protecting power grids and payment systems are inventing their own defenses and locking them down.
Break the field into sub-areas and the strategic map gets sharper. AI-driven threat detection, the established core, holds 25,659 families. That is a mature, crowded, well-defended space. If you file there, you are filing into a wall of prior art owned by incumbents with a decade head start.
The interesting movement is in the newer, smaller layers. LLM security, defending large language models against prompt injection, jailbreaks, and data leakage, already shows 6,267 families, and almost all of that volume is recent. Adversarial machine learning and model security add another 5,460, covering protection against data poisoning and adversarial inputs. Zero trust is a focused 2,061. Two years ago, the LLM-security category barely existed in the patent record. Now it is one of the fastest-filling spaces in the entire field.
Vendors are already turning these ideas into products. Cisco filed an application on advanced countermeasures against prompt-injection attacks in LLMs, building a semantic fingerprint of each prompt and scoring how close it sits to known malicious intent. Microsoft filed on signing prompts with a per-session secret, so that an instruction injected mid-stream gets caught and blocked because it lacks the signature. Both filings are described here at title and abstract level only. This is landscape triage, not a claim-scope analysis, so read them as evidence that the category is being productized, not as a statement about what either patent legally covers.
Geography sharpens the picture one more time. China holds 8,681 families, roughly half the entire set. The United States is second at 3,763, about 22 percent. India is third. Together those three offices account for around 85 percent of all filings.
But the Chinese lead is not the same kind of lead the US has. China’s volume is driven heavily by power-grid operators and universities, which produces a high count of infrastructure-protection and academic filings. The US profile is vendor-led, concentrated in companies that sell security as a product. Same field, two very different filing cultures. One is defending national infrastructure at scale. The other is building a commercial market.
The strategic takeaway is simple to state and hard to act on. Do not file where the field already peaked. File where the curve is still bending.
For founders, that means the model, prompt, and agent layer. The patent ground there is still thin, and 2024 to 2026 filings are landing right now, which is the window where staking a position still buys you defensible space. The mature threat-detection core is a fight you will lose against Cisco, IBM, and Microsoft. The agent-security layer, by contrast, barely existed two years ago, and the market is funding it hard. Geordie AI just raised $30 million to secure AI agents. Aryon Security raised $29 million on preventive cloud controls. The capital is flowing toward exactly the layers where the IP record is still open.
For investors, the question to ask any AI-security startup is whether its moat is speed or substance. Shipping first is a lead, not a wall. The wall is built from defensible IP around the actual invention, the detection method, the agent-constraint mechanism, the model-protection technique. In a category this hot, the lead evaporates in 18 months. The IP does not.
For acquirers, the utilities and banks on the leaderboard are a tell. The most valuable AI-security IP may not be sitting inside the obvious vendors. It may be locked inside the infrastructure operators who built defenses for themselves and never sold them.
The headlines this year are about funding rounds and product launches. The patent data tells a quieter, more durable story. A Chinese power utility leads the field. Banks file alongside vendors. The mature core is closed, and the frontier, model, prompt, and agent security, is wide open and filling fast.
If you are building, investing, or buying in AI security, the move is the same. Map the portfolio to where the value and the risk actually sit, before a competitor or an acquirer does it for you. The press release tells you what a company says it is doing. The patent record tells you what it actually owns.
Patent counts are extended patent family level from Minesoft Origin, retrieved June 15, 2026. This is landscape-level triage, not claim-scope analysis. Funding figures are sourced to SecurityWeek (Aryon, June 10, 2026) and Fortune (Geordie AI, May 28, 2026). This analysis is for strategic planning purposes and does not constitute legal advice. For legal opinions on patentability, validity, or infringement, consult qualified patent counsel.
Work with ipCapital Group
From invention to monetization, our team has guided 2,000+ engagements across the full IP lifecycle. Start with a free 30-minute discovery call.
Written by
Seth Cronin