When OpenAI-linked agents recently made somewhere between 15,000 and 18,000 edits to a programming coordination site, according to Tom's Hardware, the incident barely registered as a blip in the tech press. For Shy Dekel, it was vindication.
Dekel's startup, Cymphony, disclosed that it has raised $25 million in a Series A round co-led by Sequoia Capital and SMBC Fin Atlas Beyond Fund. The round brings total capital to $30 million, including a $5 million seed investment from Sequoia that occurred prior to the Series A, according to CTech. More telling than the money, though, is the problem Cymphony is racing to solve: enterprises have little visibility into what their AI agents are actually doing.
"The security industry keeps treating AI as another application to secure, but that's the wrong model to use," Dekel said in a statement.
The New York and Tel Aviv-based company sells a platform that maps access privileges for both human employees and AI agents inside corporate systems. Its "Workforce Security Graph" tracks identities, permissions, data flows, and activity without requiring software installations on individual devices. According to the company's materials, the system deploys in under a day and includes an AI assistant called Maestro that can investigate risks through natural language queries, then revoke access or alert file owners.
It's a pitch tailored to a brewing anxiety in corporate IT departments. Companies are deploying autonomous AI agents to handle routine tasks across their systems, but legacy security tools were built to monitor applications, not semi-independent software that can access data in unpredictable ways. Gartner projected in May that 40 percent of enterprises will demote or decommission autonomous AI agents by 2027 after discovering governance gaps following security incidents.
The breaches are already piling up. In July, Hugging Face posted a technical timeline on its blog detailing an incident in which a compromised internal credential allowed an agent swarm to execute thousands of actions and access limited datasets. Days before Cymphony's announcement, reports surfaced that OpenAI-related agents had made somewhere between 15,000 and 18,000 edits to a programming coordination site, according to Tom's Hardware.
Cymphony claims it hit seven-figure annual recurring revenue and signed double-digit enterprise customers within its first year of sales, according to TechCrunch. The outlet also reported that the round valued the company north of $100 million post-money, though Cymphony declined to confirm the figure. Named customers include private equity giant KKR, agricultural technology company Syngenta, Cass Information Systems, and Athennian. Sequoia acknowledged in a blog post Tuesday that it "is also a happy customer."
The three co-founders bring résumés steeped in Israeli intelligence. Dekel, the CEO, headed the cyber department in Unit 8200, Israel's signals intelligence division. Co-founder Idan Berkovits, now chief product officer, worked in the Prime Minister's research group and received an Israel Defense Prize. Chief technology officer Edi Gotlieb held hardware roles at Apple and Israel's Ministry of Defense. All three graduated from Talpiot, an elite military technology program.
The company employs between 23 and 30 people, according to reports published Tuesday. It plans to use the new capital to accelerate product development, expand engineering and go-to-market teams, and scale its U.S. operations.
Cymphony is hardly alone in chasing this opportunity. Incumbent security vendors have moved quickly to add agent governance features. Okta rolled out non-human identity capabilities for AI agents over the summer, according to support documentation. Varonis introduced "Agent Intent-Based Access Control" in August, per a company release. Microsoft shipped a flurry of updates between March and July, including Agent 365, Entra Agent ID, and Zero Trust guidance for AI systems. Cloud security provider Wiz published agentic AI guidance and launched workflow agents in the spring.
Whether the market can support a standalone vendor focused exclusively on agent security remains an open question, particularly as established players bundle similar features into broader platforms. But investors are placing bets that the governance problem runs deeper than a feature update can fix.
"AI agents represent the next shift, and the companies that provide visibility and control have the opportunity to become foundational platforms," Sequoia partner Bogomil Balkansky said in the release. Logan Allin, managing partner at SMBC Fin Atlas Beyond Fund, framed it as an evolution of insider threats: "With both human and increasingly agentic threats, insider risk is being redefined in enterprises."
SMBC Fin Atlas Beyond Fund is a $300 million corporate venture fund created by SMBC Group and Fin Capital in mid-2024, according to SMBC's announcement.
The timing of Cymphony's raise suggests the founders are betting that a wave of agent-related security incidents will force enterprises to rethink their approach before incumbents can fully adapt. Whether that window stays open long enough for a startup to carve out defensible territory is the $100 million question.
