AI agent security has become one of the most pressing concerns for modern enterprises. As AI agents gain access to the same sensitive corporate data and systems as human workers—while operating at machine speed—companies face new and complex vulnerabilities. Sequoia Capital is betting big on this shift, backing startup Cymphony as it emerges with $30 million in funding to help organizations keep their growing AI workforce in check.
The funding includes a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, valuing the New York- and Tel Aviv-based startup at more than $100 million post-investment. The round follows a previously undisclosed seed investment from Sequoia.
Why AI agent security is now a boardroom priority
Unlike human employees, AI agents do not necessarily go through the same access and identity controls. Yet they have access to multiple systems and handle large amounts of corporate data. This makes it difficult for enterprises to track who—or what—has access to sensitive information.
According to Cymphony co-founder and CEO Shy Dekel, this represents a fundamental shift in how organizations must think about security.
“Enterprise security was designed for human employees,” Dekel said in an exclusive interview. “More and more, there start to be independent entities that are practically joining the workforce, but they’re no longer people.”
Recent incidents have underscored the urgency of AI agent security. In July, OpenAI disclosed that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems at AI platform Hugging Face. Then late last week, OpenAI-linked agents made thousands of edits to a German programming wiki, using parts of the site to communicate and share ways to evade restrictions.
How Cymphony addresses AI agent security risks
Cymphony is tackling the AI agent security gap by giving security teams a single view of employees, AI agents, and other nonhuman identities—including the systems and sensitive data they can access. At the core of its platform, the two-year-old startup has built what it calls a “workforce graph,” which brings together identity, data, and activity signals.
The startup says it is already identifying risks inside large companies. At one U.S. public company, Cymphony found approximately 85,000 files that had become accessible to AI tools and agents. The company helped close the exposure and verified that none of the files had been accessed through those AI systems.
In another case, Dekel told TechCrunch that an external collaborator had installed an unsanctioned instance of Anthropic’s Claude that used the collaborator’s existing access to scan thousands of sensitive files.
Beyond identifying risks, Cymphony uses AI agents to investigate incidents, prioritize what security teams should address, and automate some remediation—including correcting access permissions. The platform can operate largely automatically, though customers can also opt for a managed service that brings Cymphony’s security experts into the loop for more complex cases.
Why Sequoia doubled down on Cymphony
Sequoia’s initial bet on Cymphony came before the startup had settled on the problem it wanted to solve. When the venture firm led its seed round more than two years ago, Cymphony had no product or even a clear product direction, according to Sequoia partner Bogomil Balkansky.
The investment was largely a bet on Dekel and his co-founders, Idan Berkovits and Edi Gotlieb—all three of whom came through Talpiot, the Israeli military’s highly selective technology and leadership program. Sequoia was already familiar with the program through previous cybersecurity investments, including Wiz.
“We just saw three amazing young people with the kind of pedigree that we at Sequoia have experienced a lot of success with,” Balkansky said.
Nonetheless, Sequoia wanted to see more than the founders’ pedigree by the Series A. Cymphony delivered, having built a product, signed a double-digit number of enterprise customers, and reached seven figures in annual recurring revenue within its first year of sales. Customers include KKR, Syngenta, Cass Information Systems, and Athennian.
Sequoia has also been using Cymphony’s product internally since early in its development. Balkansky noted the quality and range of customers, and that existing customers are expanding their use of the platform, as key reasons the firm decided to invest again.
The competitive landscape for AI agent security
Cymphony is entering an increasingly crowded market as cybersecurity companies strive to address risks emerging from the growing use of AI agents. Competitors include established players expanding their offerings around identity, data, and AI, such as Microsoft, Okta, CyberArk, Wiz, and Varonis.
However, Balkansky believes Cymphony’s approach stands out by treating identity and data security as part of the same problem. This distinction becomes more important as companies deploy more AI agents across their operations. Unlike human employees with relatively stable roles and permissions, agents can take different routes to complete tasks, acquire new capabilities, and, in some cases, create other agents—making their access harder to govern with security systems designed around people.
“Agents are very different actors,” Balkansky said, arguing that existing identity tools were not designed for agents that can change their behavior and capabilities at runtime.
Dekel told TechCrunch that Cymphony is already replacing some existing security products at customers. At one enterprise, the company helped consolidate two existing tools and eliminated the need to buy a third.
However, Balkansky sees Cymphony’s role, at least for now, as more complementary than replacement. “Nobody’s going to get rid of their Okta,” he said, adding that customers are largely adopting Cymphony as an additional layer today. Over time, however, he told TechCrunch that the startup could begin displacing some point solutions, particularly in areas such as data loss prevention.
What’s next for Cymphony and AI agent security
Cymphony has approximately 30 employees across Tel Aviv and New York. Most of its customers are currently in North America, though Dekel told TechCrunch that the startup is beginning to see demand from enterprises in Europe, the Middle East, and Africa.
As Cymphony moves beyond its Series A and expands among large enterprise customers, it now must prove that AI agent security can become a market of its own rather than a feature offered by larger security platforms. Balkansky believes spending in the area will grow as companies put more AI agents to work.
“If companies are not spending money on agent security, I don’t know what else they’ll be spending money on in the next five to 10 years,” he said.
