The landscape · Cybersecurity
Cybersecurity: what AI is really doing
Brief me in 2 minutes
AI in Cybersecurity.
AI in cybersecurity now cuts both ways at production scale. Starting on September 25, one attacker's AI agents went after more than 1,200 websites and got into about 100 companies for roughly $50 a breach in tokens, while frontier models helped Wiz turn decade-old PHP bugs into working exploits, and exploitation attempts were reported before PHP's fix existed. Defenders are buying the same machinery (Armadin raised $255.5 million at more than $2.5 billion to aim attacker-style agent swarms at its customers' own networks), but the autonomous defender that needs no human is still a pitch: finding holes got cheap, fixing them did not.
The game: we show you 6 things happening. You call each one real now, early or mostly hype. Then the receipts.
Shift 1 of 6
Attackers hand whole intrusion campaigns to AI agents, at about $50 a breach
Real now
About 100 companies, Deere and Cummins among them, were breached by agents running unattended, which is about as deployed as a crime gets.
How it works. An attacker points a swarm of AI agents at a target list and walks away: the agents probe each site, try to find a way in and keep going around the clock, so the human's only remaining costs are choosing targets and paying the token bill. Starting on September 25, one campaign ran this way against more than 1,200 websites, got into about 100 companies including Deere, SharkNinja and Cummins, and spent about $5,000 of DeepSeek and Claude Code tokens.
Overstated: The figure researchers gave Reuters is the total, about $5,000 in tokens, and it is not an audited cost. The $50 is Fortune working that total out per successful breach in its own sentence, which it does not credit to the researchers, and it spreads the bill over the successes only: the agents attempted to break into over 1,200 websites and successfully breached about 100 companies.
Shift 2 of 6
Frontier models turn decade-old bugs into working exploits, so finding holes is cheap and fixing them is the bottleneck
Real now
Critical PHP flaws were found and turned into working exploits with frontier models: Wiz showed a working unauthenticated exploit against the latest WordPress, Drupal and Joomla images at the time of testing, and exploitation attempts were reported before fixed PHP versions existed.
How it works. A model works through the long chain of steps a human team would find impractical: it proposes a flaw, writes an exploit, runs it, reads the failure and adapts to each target's memory layout until it works. Wiz used Google's and OpenAI's frontier models this way to turn memory bugs that had sat in PHP for more than a decade into PHP2Shell, an exploit script that Wiz showed running code without authentication on the latest WordPress, Drupal and Joomla container images at the time of testing.
Overstated: The week-versus-months comparison is Wiz describing its own work, and the reports were of exploitation attempts, not a count of breached servers. The bigger deflation comes from an AI bug-hunter itself: AISLE's COO and CISO says there was never a shortage of known vulnerabilities to fix, and the problem was the fixing.
Shift 3 of 6
Defenders buy the attacker's agents: autonomous penetration testing draws the biggest checks
Real now
Horizon3's chief revenue officer says it approached $100 million in annual recurring revenue last year with 120% growth, which is customers paying, even though Armadin named none of the customers behind its production claims.
How it works. Horizon3's NodeZero and Armadin's agent swarms attack a customer's own environment the way an intruder would, continuously; Armadin's agents chain weaknesses into validated attack paths that can run from the perimeter to cloud compromise, and the security team gets those paths to break. It is the attackers' new machinery from the shift above, pointed inward with permission, instead of a human firm testing a slice of the network once a year.
Overstated: Armadin says its agents already run in production for Fortune 500 enterprises and government customers but names none, and its valuation passed $2.5 billion seven months after it left stealth. Even Horizon3's revenue chief says the annual tests by human security firms won't disappear; customers now want monthly or weekly scans on top.
Shift 4 of 6
Securing the AI tools employees already run, now that their supply chain is under attack
Early
The attacks are real now that LiteLLM was poisoned, but the defenders are young: Pluto's CEO says it only started selling in April and has more than 30 enterprise customers.
How it works. Pluto's CEO says a newly announced AI tool can show up inside a company's environment within two hours of its release, and Pluto watches those tools, the skills, extensions and MCP servers they rely on, and the apps and agents staff build. Startups like Pluto and AIR sit on the endpoint or between an agent and its tools, watching prompts, commands and permissions, and can block a risky add-on, stop an agent's action mid-task or make it ask for confirmation.
Overstated: Watching agents is harder than the pitch decks say: METR and Redwood Research staff, given deep internal access in a three-week exercise from July 21 to August 11, found that OpenAI's own Codex agents could in principle slip its sandboxing and review; OpenAI says the vulnerabilities affecting its production safeguards have since been patched, which METR says it has not evaluated. A vendor promising complete visibility into your agents is promising more than the lab that builds them had.
Shift 5 of 6
Security operations centers hand alert triage and first response to AI agents, as long as the model agrees to answer
Early
Exaforce names Replit and Guardant Health among its 20 customers, and every efficiency figure in this shift comes from the vendor selling it.
How it works. Instead of an analyst pivoting tool by tool through hundreds of alerts, Mave says its agents query a company's existing security tools, reconcile the results into one account of what happened, remove the false positives and carry out approved response actions under rules set by the security team. The analyst gets a verdict with the evidence attached instead of a queue.
Overstated: Both figures are the vendors' own, and an AI defender is only as available as its model provider allows: in October, the OpenAI model running OpenCode's defense began refusing its requests mid-attack, and OpenCode could continue after asking OpenAI to admit it to Daybreak Blue, an application-only program for verified security professionals.
Shift 6 of 6
AI-written phishing and live deepfake calls push defense toward AI readers and identity checks
Real now
The attacks and the email defenses are both in production, Ocean reviews billions of emails a month for Kayak and Headspace, even though the live video identity check is new and only covers people enrolled with World.
How it works. AI can pull together a target's coworkers, active projects and recent travel to write a convincing spear-phishing email instantly, Savi's co-founder says a voice can be cloned from three seconds of public audio, and fraud crews have faked a CFO and colleagues on a live video call to get wires approved. Defenders answer with AI agents that read every message the way a suspicious analyst would (AegisAI, Ocean) and with live identity checks: Zoom and World mark a participant as a verified human only when a registered face scan, a live scan and the video feed all match.
Overstated: The more-than-half figure is AegisAI's co-founder's own claim, not an independent measurement, and World's check only covers people who already registered with its Orb; World and Zoom say existing frame-by-frame deepfake detection is becoming unreliable.
The scary part
What happens to jobs in Cybersecurity
What AI is already taking:
- Reading every inbound email for AI-crafted spear-phishing and impersonation before it reaches an inbox TechCrunch ↗
- Running the network penetration test that human security firms run once a year TechCrunch ↗
- Clearing the false positives out of a security team's alert queue and flagging which alerts belong to an active attack campaign PR Newswire (Mave) ↗
- Developing a working exploit for longstanding memory bugs: Wiz says a single researcher with frontier models did in a week what would previously have taken a world-class team months Wiz ↗
What stays human:
Fixing stays human for now: AISLE's COO and CISO says there was never a shortage of known vulnerabilities to fix and the problem was the fixing, while Mave says its agents carry out approved response actions under rules set by the security team. Judgment on a genuinely new attack pattern stays human too, because deciding whether something never seen before is an attack or noise is where a model trained on past attacks has the least to go on.
Get better · 15 minutes
Remediation under pressure: knowing which systems you own, which run versions too old to get a fix, and how to patch or shield them within hours without breaking production, because finding the hole is now the cheap part.
Try this this week:
Open the list of extensions, skills, plugins and MCP servers installed in your own Claude Code or Copilot setup, then search each one in Pluto's free Plutonium catalog (plutonium.pluto.security) and note its risk rating; treat anything rated risky or not listed as not yet vetted. About 15 minutes for a typical setup.
Your move
Agent and AI-tool security is crowded and well funded (AIR, HiddenLayer, Zenity, Noma, Pluto, Glow), and attacker-style testing now has two heavyweights in Horizon3 and Armadin. The harder problem is the fix: AISLE's COO and CISO says there was never a shortage of known vulnerabilities to fix; the problem was the fixing. A product that measurably shortens the time from an AI-found bug to a tested, deployed patch has a clearer story than one more scanner.
Price named customers, not momentum: Armadin raised $255.5 million at more than $2.5 billion seven months out of stealth while citing only unnamed Fortune 500 and government customers, whereas Pluto's CEO says it has more than $2 million of ARR and names Oscar Health, Workato, Sixt and AlphaSense. In any autonomous-defense pitch, ask what happens if the model refuses mid-incident: the OpenAI model running OpenCode's defense began refusing its requests mid-attack, and OpenCode could continue after asking OpenAI to admit it to Daybreak Blue, an application-only program for verified security professionals.
This quarter, time your own patch window on a real case: PHP2Shell exploitation attempts were reported before PHP's fix existed, so measure how long your internet-facing PHP servers took to be patched or shielded after the release, list any running versions too old to get the fix, and agree in advance who may take a server offline without a meeting. Repeat it on the next critical advisory and track the number.
Learn remediation, not just detection: reading an AI-generated vulnerability report, reproducing it safely in a lab, and shipping a fix without breaking production. First step: read Wiz's PHP2Shell write-up end to end and write down, for one server you run, how you would know it was vulnerable and how you would patch or shield it within a day.
What's actually changing
- 1
Attackers hand whole intrusion campaigns to AI agents, at about $50 a breach
How it works. An attacker points a swarm of AI agents at a target list and walks away: the agents probe each site, try to find a way in and keep going around the clock, so the human's only remaining costs are choosing targets and paying the token bill. Starting on September 25, one campaign ran this way against more than 1,200 websites, got into about 100 companies including Deere, SharkNinja and Cummins, and spent about $5,000 of DeepSeek and Claude Code tokens.
Why it matters. At roughly $50 a successful break-in, a target no longer needs to be big to be worth attacking, and the attacker's work ends once the agents are sent off.
What's overstatedThe figure researchers gave Reuters is the total, about $5,000 in tokens, and it is not an audited cost. The $50 is Fortune working that total out per successful breach in its own sentence, which it does not credit to the researchers, and it spreads the bill over the successes only: the agents attempted to break into over 1,200 websites and successfully breached about 100 companies.
DeepSeekAnthropicDeereSharkNinjaCummins
3 receipts
- Starting on September 25, a hacker set an army of AI agents loose on more than 1,200 websites over the following few weeks.
Starting on Sept. 25, a hacker set loose an army of AI agents that attempted to break into over 1,200 websites over the following few weeks
Fortune, 21 Oct 2026 ↗ - The agents breached about 100 companies, including Deere, SharkNinja and Cummins, according to Reuters, which first reported the incident.
The agents successfully breached about 100 companies, including farm equipment maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins, according to Reuters, which first reported the incident
Fortune, 21 Oct 2026 ↗ - Researchers told Reuters the campaign cost about $5,000 in DeepSeek and Claude Code tokens; Fortune's next sentence, in its own words, puts that at roughly $50 per successful breach.
It cost about $5,000 worth of tokens from a combination of DeepSeek and Anthropic's Claude Code models, researchers told Reuters. That's roughly $50 per successful breach.
Fortune, 21 Oct 2026 ↗
- Starting on September 25, a hacker set an army of AI agents loose on more than 1,200 websites over the following few weeks.
- 2
Frontier models turn decade-old bugs into working exploits, so finding holes is cheap and fixing them is the bottleneck
How it works. A model works through the long chain of steps a human team would find impractical: it proposes a flaw, writes an exploit, runs it, reads the failure and adapts to each target's memory layout until it works. Wiz used Google's and OpenAI's frontier models this way to turn memory bugs that had sat in PHP for more than a decade into PHP2Shell, an exploit script that Wiz showed running code without authentication on the latest WordPress, Drupal and Joomla container images at the time of testing.
Why it matters. The patch window collapsed: PHP2Shell details leaked hours before the fix shipped and researchers reported exploitation attempts before fixed versions existed, so how fast a team patches now matters more than how obscure its bugs are. AI labs want the defensive version too: Cohere has signed a letter of intent to buy the bug-hunting startup AISLE.
What's overstatedThe week-versus-months comparison is Wiz describing its own work, and the reports were of exploitation attempts, not a count of breached servers. The bigger deflation comes from an AI bug-hunter itself: AISLE's COO and CISO says there was never a shortage of known vulnerabilities to fix, and the problem was the fixing.
WizGoogle DeepMindOpenAICalifAISLECohere
3 receipts
- Wiz says that with frontier AI models, a single researcher did in a week what would previously have taken a world-class team months.
With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.
Wiz, 21 Oct 2026 ↗ - PHP2Shell details leaked hours before the release, and researchers reported exploitation attempts before fixed versions were available.
The patch window collapsed: Details leaked hours before the release, and security researchers reported exploitation attempts before fixed versions were available
Recorded Future, 21 Oct 2026 ↗ - AISLE's COO and CISO Jaya Baloo says there was never a shortage of known vulnerabilities to fix, even before AI; the problem was the fixing.
There was never a shortage, even before AI, of vulnerabilities we knew we needed to fix. That was always there. The problem was the fixing
BankInfoSecurity, 23 Oct 2026 ↗
- Wiz says that with frontier AI models, a single researcher did in a week what would previously have taken a world-class team months.
- 3
Defenders buy the attacker's agents: autonomous penetration testing draws the biggest checks
How it works. Horizon3's NodeZero and Armadin's agent swarms attack a customer's own environment the way an intruder would, continuously; Armadin's agents chain weaknesses into validated attack paths that can run from the perimeter to cloud compromise, and the security team gets those paths to break. It is the attackers' new machinery from the shift above, pointed inward with permission, instead of a human firm testing a slice of the network once a year.
Why it matters. If an attacker can run an agent swarm for about $50 a breach, testing a slice of the network once a year leaves the other eleven months to the attacker. Investors are paying for the continuous version: Horizon3 and Armadin raised more than half a billion dollars between them in 2026.
What's overstatedArmadin says its agents already run in production for Fortune 500 enterprises and government customers but names none, and its valuation passed $2.5 billion seven months after it left stealth. Even Horizon3's revenue chief says the annual tests by human security firms won't disappear; customers now want monthly or weekly scans on top.
Horizon3.aiArmadin
3 receipts
- Horizon3 approached $100 million in annual recurring revenue last year with 120% year-over-year growth.
The company approached $100 million in annual recurring revenue last year with 120% year-over-year growth, and expects to accelerate growth this year, Hartley said.
TechCrunch, 3 Aug 2026 ↗ - Horizon3's revenue chief says most companies hire human security firms for annual tests and those won't disappear.
Most companies hire human security firms to run annual tests and those won't disappear, he continued.
TechCrunch, 3 Aug 2026 ↗ - Armadin raised $255.5 million in a Series B co-led by Andreessen Horowitz and Accel at a valuation of more than $2.5 billion.
Cooley advised Armadin, an AI-native cybersecurity company building effective autonomous security, on its $255.5 million in Series B funding co-led by Andreessen Horowitz and Accel that brings the company's valuation to more than $2.5 billion.
Cooley, 1 Oct 2026 ↗
- Horizon3 approached $100 million in annual recurring revenue last year with 120% year-over-year growth.
- 4
Securing the AI tools employees already run, now that their supply chain is under attack
How it works. Pluto's CEO says a newly announced AI tool can show up inside a company's environment within two hours of its release, and Pluto watches those tools, the skills, extensions and MCP servers they rely on, and the apps and agents staff build. Startups like Pluto and AIR sit on the endpoint or between an agent and its tools, watching prompts, commands and permissions, and can block a risky add-on, stop an agent's action mid-task or make it ask for confirmation.
Why it matters. The threat stopped being theoretical: a poisoned LiteLLM release, a widely used library for routing apps to LLMs, carried malware built to harvest cloud logins, developer secrets and AI service keys from anyone who installed it. Incumbents are paying up for the data side of the same problem: Proofpoint agreed to buy Varonis for about $6.3 billion, in a deal expected to close in the first half of 2027, subject to shareholder and regulatory approvals.
What's overstatedWatching agents is harder than the pitch decks say: METR and Redwood Research staff, given deep internal access in a three-week exercise from July 21 to August 11, found that OpenAI's own Codex agents could in principle slip its sandboxing and review; OpenAI says the vulnerabilities affecting its production safeguards have since been patched, which METR says it has not evaluated. A vendor promising complete visibility into your agents is promising more than the lab that builds them had.
Pluto SecurityAIRHiddenLayerZenityNoma SecurityLiteLLMProofpointVaronis
3 receipts
- A malicious LiteLLM release pushed to PyPI and Docker carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it.
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it.
Help Net Security, 22 Oct 2026 ↗ - Proofpoint, owned by Thoma Bravo, agreed to acquire Varonis in an all-cash deal valued at about $6.3 billion.
Varonis will be acquired by Proofpoint, a portfolio company of Thoma Bravo, in an all-cash transaction valued at approximately $6.3 billion.
iTWire, 16 Oct 2026 ↗ - METR and Redwood Research found that OpenAI's Codex agents could in principle bypass Codex sandboxing and Auto-Review, during an exercise run in July and August.
We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take.
METR, 22 Oct 2026 ↗
- A malicious LiteLLM release pushed to PyPI and Docker carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it.
- 5
Security operations centers hand alert triage and first response to AI agents, as long as the model agrees to answer
How it works. Instead of an analyst pivoting tool by tool through hundreds of alerts, Mave says its agents query a company's existing security tools, reconcile the results into one account of what happened, remove the false positives and carry out approved response actions under rules set by the security team. The analyst gets a verdict with the evidence attached instead of a queue.
Why it matters. Analysts drowning in alerts get time back for the few that matter, and the promised savings are large: Exaforce claims as much as 90% less manual work, and Mave says it investigates every alert within minutes.
What's overstatedBoth figures are the vendors' own, and an AI defender is only as available as its model provider allows: in October, the OpenAI model running OpenCode's defense began refusing its requests mid-attack, and OpenCode could continue after asking OpenAI to admit it to Daybreak Blue, an application-only program for verified security professionals.
MaveExaforce7AIDropzone AIProphet SecurityOpenCodeOpenAI
3 receipts
- Mave says its agents query each security tool in its native language, reconcile the results into one account and investigate 100% of alerts within minutes.
It queries each tool in its native language, reconciles the results into one account of what happened, and investigates 100% of alerts within minutes.
PR Newswire (Mave), 22 Oct 2026 ↗ - Exaforce claims its AI platform can reduce manual, time-consuming SOC tasks by as much as 90%.
Exaforce claims its AI platform can reduce manual, time-consuming tasks by as much as 90%.
TechCrunch, 12 May 2026 ↗ - The OpenAI model running OpenCode's defense began refusing its requests mid-attack, and OpenCode could continue after asking OpenAI to admit it to Daybreak Blue, an application-only program for verified security professionals.
But the company was able to continue after asking OpenAI to admit it to the company's Daybreak Blue, an application-only program that allows verified cybersecurity professionals to use its most advanced tools.
Fortune, 21 Oct 2026 ↗
- Mave says its agents query each security tool in its native language, reconcile the results into one account and investigate 100% of alerts within minutes.
- 6
AI-written phishing and live deepfake calls push defense toward AI readers and identity checks
How it works. AI can pull together a target's coworkers, active projects and recent travel to write a convincing spear-phishing email instantly, Savi's co-founder says a voice can be cloned from three seconds of public audio, and fraud crews have faked a CFO and colleagues on a live video call to get wires approved. Defenders answer with AI agents that read every message the way a suspicious analyst would (AegisAI, Ocean) and with live identity checks: Zoom and World mark a participant as a verified human only when a registered face scan, a live scan and the video feed all match.
Why it matters. AegisAI's co-founder says AI-crafted attacks now get past existing controls more than half the time, and deepfake fraud losses already average more than $500,000 per corporate incident by industry estimates, so a wire approved on a video call alone is approved on something that can be faked live.
What's overstatedThe more-than-half figure is AegisAI's co-founder's own claim, not an independent measurement, and World's check only covers people who already registered with its Orb; World and Zoom say existing frame-by-frame deepfake detection is becoming unreliable.
AegisAIOceanSavi SecurityWorldZoom
3 receipts
- AegisAI's co-founder says AI-crafted attacks now bypass existing controls more than half the time, roughly twice as often as before.
AI-powered attacks bypass existing controls more than half the time now, which means they're almost twice as effective as they used to be.
TechCrunch, 23 July 2026 ↗ - One estimate puts deepfake-fraud losses above $200 million in the first quarter of last year, and security industry reports put the average loss per corporate incident above $500,000.
financial losses from deepfake-enabled fraud exceeded $200 million in just the first quarter of last year, according to one estimate, and the average loss per corporate incident now tops $500,000, according to security industry reports.
TechCrunch, 17 Apr 2026 ↗ - World and Zoom say older deepfake detection, which analyzes video frames for manipulation, is becoming unreliable as video-generation models improve.
because video models are getting better, those frame-by-frame detection methods are increasingly unreliable
TechCrunch, 17 Apr 2026 ↗
- AegisAI's co-founder says AI-crafted attacks now bypass existing controls more than half the time, roughly twice as often as before.
Who's doing it
14 companies to know, 13 with a round we can source. Newest first where dated.
Search these companies in the startup database ↗ · Explore all research tools
AISLEautonomous vulnerability discovery and remediation
AI products that identify and fix security weaknesses in critical software; co-founded by Avast's former CEO.
Latest · 15 Oct 2026Cohere signed a letter of intent to acquire AISLE, a Prague-based AI security company that builds tools to identify software vulnerabilities. BetaKit ↗
Pluto Securitysecurity for the AI tools, agents and vibe-coded apps employees use
Watches the AI tools, skills, extensions and MCP servers employees use and the apps they vibe-code, and can stop an agent mid-task or make it ask for confirmation.
Latest · 13 Oct 2026Pluto's CEO says it began selling in April and has crossed $2 million in annual recurring revenue with more than 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense. TechCrunch ↗
$34M Series A, 13 Oct 2026 source ↗
Armadinautonomous offensive security (AI agent swarms)
Kevin Mandia's startup, running swarms of AI agents that attack a customer's own environment like an adversary and chain weaknesses into validated attack paths.
Latest · 1 Oct 2026Armadin says it already runs agentic attack campaigns in production for Fortune 500 enterprises and government customers, seven months after leaving stealth; it did not name them. Pulse 2.0 ↗
$255.5M Series B, 1 Oct 2026 source ↗
Comp AIagentic security and compliance automation
AI agents draft security policies, collect audit evidence, and continuously check whether a company still meets compliance controls after it deploys new AI agents.
Latest · 17 Sept 2026Comp AI has raised $37.5 million in total funding to date, most recently a $34 million Series A. TechCrunch ↗
$34M Series A, 17 Sept 2026 source ↗
HiddenLayerAI model, agent, and supply-chain security
Protects AI models, agents, and workflows from adversarial attacks, prompt injection, and malicious code hidden inside AI file formats.
Latest · 2 Sept 2026One of HiddenLayer's customers is apparently a leading frontier model provider with more than 700 million weekly users, which TechCrunch's reporter says sounds like OpenAI or Anthropic. TechCrunch ↗
$100M Series B, 2 Sept 2026 source ↗
AIRAI agent supply-chain security (skills, plug-ins, MCP servers)
Sits between an AI agent and the tools it uses, continuously vetting skills, plug-ins, and MCP servers and blocking ones that fail its security checks.
Latest · 1 Sept 2026AIR's CEO says its platform filters out about 27% of the add-ons and skills it finds online, weeding out ones that turn risky after approval. TechCrunch ↗
$50M two seed rounds, 1 Sept 2026 source ↗
Noma SecurityAI application and agent security
A unified platform for discovering and securing the LLMs, RAG pipelines, and AI agents a company's employees actually use.
Latest · 1 Sept 2026Noma offers discovery, access controls and runtime monitoring for agents, MCP servers and skills. TechCrunch ↗
$100M Series B, 31 July 2025 source ↗
Horizon3.aiautonomous penetration testing / vulnerability discovery
Runs AI agents (NodeZero) that continuously and safely probe a company's own network for exploitable vulnerabilities the way an attacker would.
Latest · 3 Aug 2026Horizon3 says it has run 310,000 production security tests with zero disruptions under its fully autonomous "AI Hackers" platform. TechCrunch ↗
$250M Series E, 3 Aug 2026 source ↗
ZenityAI agent security and governance
Security and governance tools for AI agents, coding agents, and MCP servers running across a company's SaaS and cloud environment.
Latest · Aug 2026Zenity raised a $125 million Series C in August 2026. TechCrunch ↗
$125M Series C, Aug 2026 source ↗
AegisAIAI-native email / anti-phishing security
AI agents that read incoming email like a suspicious analyst would, to catch AI-crafted spear-phishing that rule-based filters miss.
Latest · 23 July 2026AegisAI says its tech has been adopted by dozens of customers, including crypto payments company Mesh, AI startup LangChain, and privacy compliance platform Lokker, within a year of launch. TechCrunch ↗
$36M Series A, 23 July 2026 source ↗
GlowAI-era endpoint security
An endpoint security platform that uses AI agents to map the software, AI agents, and developer tools running on employee devices, and blocks risky ones before they install.
Latest · 22 July 2026Glow's CEO says its platform has already prevented malicious npm packages from being installed in customer environments and flagged devices with missing or degraded endpoint protection. TechCrunch ↗
$180M Series A, 22 July 2026 source ↗
Savi Securityconsumer AI-scam and deepfake defense
A consumer app and live-call agent that listens for the behavioral tells of an AI-generated scam call, voice clone, or deepfake kidnapping hoax in real time.
Latest · 7 July 2026Savi launched a paid iOS and Android app for consumers that screens texts, voicemails and incoming calls for scams. TechCrunch ↗
$7M seed, 7 July 2026 source ↗
Oceanagentic email security
An agentic email security platform built to catch AI-generated phishing that mimics a person's real writing and organizational context.
Latest · 19 May 2026Ocean is already reviewing billions of emails each month for customers including Kayak, Kingston Technology, and Headspace. TechCrunch ↗
$28M seed (total, at stealth exit), 19 May 2026 source ↗
ExaforceAI-native SOC / detection and response
Runs four AI agents, its "Exabots," that triage security alerts and let analysts query for threats in plain English.
Latest · 12 May 2026Exaforce has added 20 customers since bringing its product to market, including Replit and Guardant Health. TechCrunch ↗
$125M Series B, 12 May 2026 source ↗
Your move
Our read, built on the receipts above.
Agent and AI-tool security is crowded and well funded (AIR, HiddenLayer, Zenity, Noma, Pluto, Glow), and attacker-style testing now has two heavyweights in Horizon3 and Armadin. The harder problem is the fix: AISLE's COO and CISO says there was never a shortage of known vulnerabilities to fix; the problem was the fixing. A product that measurably shortens the time from an AI-found bug to a tested, deployed patch has a clearer story than one more scanner.
Price named customers, not momentum: Armadin raised $255.5 million at more than $2.5 billion seven months out of stealth while citing only unnamed Fortune 500 and government customers, whereas Pluto's CEO says it has more than $2 million of ARR and names Oscar Health, Workato, Sixt and AlphaSense. In any autonomous-defense pitch, ask what happens if the model refuses mid-incident: the OpenAI model running OpenCode's defense began refusing its requests mid-attack, and OpenCode could continue after asking OpenAI to admit it to Daybreak Blue, an application-only program for verified security professionals.
This quarter, time your own patch window on a real case: PHP2Shell exploitation attempts were reported before PHP's fix existed, so measure how long your internet-facing PHP servers took to be patched or shielded after the release, list any running versions too old to get the fix, and agree in advance who may take a server offline without a meeting. Repeat it on the next critical advisory and track the number.
Learn remediation, not just detection: reading an AI-generated vulnerability report, reproducing it safely in a lab, and shipping a fix without breaking production. First step: read Wiz's PHP2Shell write-up end to end and write down, for one server you run, how you would know it was vulnerable and how you would patch or shield it within a day.
What's next
- 20 Nov 2026 The UK ICO's call for evidence on agentic AI closes. TLT's summary says organisations must assess security risks arising from an agentic system's capabilities, connections and data processing, and the answers will inform the ICO's forthcoming statutory code of practice on AI and automated decision-making. tlt.com ↗
- 7 Dec 2026 Deadline set in FedRAMP's June 2026 notice for mandatory adoption of its new vulnerability detection and response (VDR) and vulnerability evaluation and reporting (VER) rules, to align with CISA's directive BOD 26-04. fedramp.gov ↗
Other industries
- FinanceBanks move agentic AI from chatbots to running back-office and dealmaking work
- Software engineeringSpaceX owns Cursor and starts rewiring it: one Grok bundle, and OpenAI's models on the way out
- HealthcareAmbient scribes go from pilot project to clinical infrastructure
- LegalLegal AI vendors go from research assistant to agent that produces the deliverable
- Real estateLeasing AI graduates from answering the phone to acting inside the property system
- Sales and marketingCustomers start sending their own AI agents, and vendors race to build the front door for them
- Jobs, HR and recruitingAI runs the first-round interview, not just the resume filter
- InsuranceClaims move from adjuster-first to AI-first, humans supervise the exceptions
- Consulting and accountingAI-written client reports become a recurring, public Big Four embarrassment
- Retail and e-commerceAgent checkout retreats to a cart, and the banks guard the last tap
- EducationNYC and LA ban AI for students, not for teachers
- Media and creativeAI video's money goes to the app that resells the models, not the lab that trains them
- Manufacturing and roboticsHumanoid robots move from demo livestreams to paid warehouse shifts
- Transport and robotaxisRobotaxis go from demo to metered fare, and Waymo starts borrowing to scale
- Energy and data-centre powerGrid rules get rewritten mid-buildout, state by state
- GovernmentGSA turns AI adoption into a government-wide subscription, then swaps 'free' for metered contracts
- Agriculture and foodDriverless tractors learn to run the tools behind them, through open platforms and retrofit kits