A trust board somewhere in England is, this week, reviewing the findings of a patient safety investigation. The relevant information exists. A discharge summary sits in one system, a medication record in another, a staffing gap in a third, and a safeguarding flag in a fourth. Nobody disputes that the data is there. What is missing is the connective tissue that would have let someone see the pattern before the incident, not after it. This is the unglamorous, recurring failure mode of the NHS: not an absence of information, but an absence of a trustworthy way to join it up.

This week's news that Prevalent AI, a UK cybersecurity company founded by veterans of GCHQ and Darktrace, has taken £16.14 million from Integrity Growth Partners after nine years of refusing outside capital, is not obviously an NHS story. Its product currently serves banks, telecoms firms and insurers, and it is expanding into financial crime, not health. But the shape of the problem it solves, and the way it has chosen to solve it, describes almost exactly the fault line running through NHS digital reform.

Prevalent AI builds what it calls a sovereign knowledge graph: a continuously updated map that pulls together an organisation's internal tools, security platforms, cloud logs and identity systems into one coherent structure. Two design choices matter more than the marketing language. First, the graph is hosted under the customer's control rather than on a shared third-party cloud. Second, it is built deterministically, the same way every time, precisely so that it does not inherit the hallucinations and drift that large language models introduce when asked to infer relationships between records. Paul Stokes, the company's chief executive, is blunt about this: letting an AI construct the graph would produce "assumptions and deviations" that are not accurate.

That combination, customer-hosted infrastructure and a refusal to let generative AI touch the underlying data model, is the precise answer to the objection that has dogged the NHS's own attempts at this kind of reconciliation. The Federated Data Platform, built with Palantir, has faced sustained criticism less because trusts doubt the value of joined-up data than because control of that data sits with an external commercial partner, and because clinicians and campaigners have struggled to get clear answers about what is inferred, retained or shared. The argument was never really about ambition. It was about sovereignty and legibility.

Prevalent AI's customer base, organisations with between five thousand and over one hundred thousand staff spread across regions, sits at a scale comparable to individual NHS trusts and integrated care boards, if not the system as a whole. Its pitch to those clients, that the reconciliation layer can be delivered without surrendering the infrastructure or accepting a black box, is a structural template rather than a direct offer. There is no evidence Prevalent AI intends to enter health. The relevance here is emerging and indirect, not a pipeline deal in waiting.

Even so, it should sharpen how NHS leaders and policymakers frame the next wave of data platform procurement. The system does not lack vendors willing to centralise its information. It lacks a demonstrated model that reconciles fragmented data while leaving accountability and custody where clinicians and the public can see it. Gartner's estimate that global security spending will reach around £176 billion this year, and that a large share of agentic AI projects will be cancelled for cost and unclear value, is a warning as much as a market signal. Enterprises, including public ones, are discovering that the constraint was never model intelligence. It was always the mess underneath.

For NHS leaders, the lesson is not to wait for a health-specific version of this technology to arrive. It is to interrogate the next data platform proposal on the same two questions Prevalent AI has built its business around: who controls the infrastructure, and how was the map of the data actually made. Those questions, asked with more discipline than they have been so far, would do more for public trust than another round of reassurance about anonymisation. The NHS does not need a cleverer platform. It needs one it can actually verify.