Two numbers. Eighty-five thousand files. One unapproved agent.
The setup is mundane, and that is precisely why it should worry you. Inside a large enterprise โ the kind that employs a security operations center, a CISO, and a compliance budget that outspends most startups' total raise โ a contractor installs a Claude instance that nobody authorized. Not a jailbroken model. Not an exotic attack. A stock, consumer-accessible AI tool. It begins to scan documents. Thousands of them. Sensitive ones. Weeks pass before a human notices.
The second number comes from the same reporting cycle: 85,000 files, sitting open, reachable by exactly the category of software the enterprise had spent three years insisting it governed.
Nothing was exfiltrated. Nothing was ransomed. The breach that never happened is the headline, and the near-miss is the entire story.
I have audited contracts that failed for less. In 2017 I caught a reentrancy bug in the Zcoin token contract roughly four hours before its generation event and published the warning on my own blog because there was no institution moving fast enough to warn anyone. The lesson was never about the bug. The lesson was that the failure mode is almost always visibility, not severity. Nobody is looking in the right place, and the code runs anyway.
Now a two-year-old company called Cymphony has raised $25 million in Series A funding to fix a version of that problem โ and the round tells us something considerably larger than one startup's fortunes. It tells us that the enterprise AI boom has hit a wall it did not build into its own timeline: the trust infrastructure for autonomous software does not exist yet, and the market is starting to pay for it in real dollars.
Context: Why This Round Matters More Than The Company
The mechanics first. Cymphony closed a $25 million Series A, bringing cumulative funding to roughly $30 million and pushing its post-money valuation past $100 million. The round was led by Sequoia, with strategic participation from SMBC's Fin Atlas Beyond Fund โ the venture arm of Sumitomo Mitsui Banking Corporation. Existing customers reportedly include KKR, Syngenta, and Cass Information Systems. The first-year ARR is described, with deliberate vagueness, as "seven figures."
The founding team is three Talpiot graduates โ the Israeli military program that has become the single most reliable talent pipeline in global cybersecurity. Wiz came out of that pipeline. So did Waze. The Wiz comparison is being made loudly and openly, and that is not an accident; it is a valuation anchor.
The core product is something the company calls a "workforce graph" โ a unified data model that maps identities, data assets, and behavioral telemetry onto a single surface, and then points machine learning at the resulting graph to surface anomalies. On paper, it sounds like a security data lake with an identity graph bolted on. In practice, its ambition is narrower and sharper: it wants to be the control plane for non-human identities inside the enterprise.
Here is the why-now, and it is the part that actually matters.
IDC and Lenovo have both published data around the same structural failure: 88% of enterprises with agent initiatives have never moved a single one into production. Gartner's estimate is even blunter โ more than 40% of agentic AI projects will be canceled by the end of 2027. Read those two numbers together and a picture emerges that has nothing to do with model capability. GPT-class reasoning is not the bottleneck. Retrieval, tooling, and orchestration are increasingly commoditized. The bottleneck is governance โ the uncomfortable, unglamorous problem of proving to an auditor, a regulator, and a board that an autonomous agent cannot do something it was never supposed to do.
That is a security problem wearing an AI costume. And it is the problem Cymphony is selling into.
Capital has already found the category. Roughly $435 million has flowed into AI-agent security startups in about five months. Cymphony is the third significant round inside three weeks, following AIR and Zenity. When you see that density of capital arrive at a category nobody had a name for eighteen months ago, you are watching a market being born โ and markets that get born this fast also get crowded, repriced, and consolidated equally fast.
I have watched this exact movie in three different verticals.
Core: The Architecture That Nobody Repurposed
Start with the underlying problem, because the product only makes sense once the failure is precise.
Enterprise security was architected around a single assumption: that the actor on the other end of a request is a human being, moving at human speed, working human hours, and responding to friction. That assumption is embedded in everything โ in IAM policies written for a person logging in from a laptop, in DLP rules that look for a person emailing a file, in CASB tooling that assumes an employee clicks a link. Every one of those controls is calibrated against a human's tolerance for inconvenience.
AI agents break all four assumptions simultaneously. They hold credentials but no patience. They move at machine speed. They operate continuously. And they express permissions in ways that no longer resemble a session โ they resemble a capability graph, where a single prompt can chain through six tool calls, three APIs, and two document stores before a human even encounters the log line.
The Cymphony positioning is exactly this. The agent, in the company's own framing, behaves "more like a high-speed data processor that often bypasses the guardrails built for humans." That single sentence is the entire market thesis, and it is correct. The point is not that agents are malicious. The point is that agents are indifferent to the control surfaces designed for human attention.
So what does the product actually do? Based on the disclosed cases, it does three things well: it discovers unknown AI tooling running inside the environment (shadow AI detection), it maps which identities and data sets those tools touch (permission graph construction), and it alerts when behavior diverges from expected patterns (telemetry-driven anomaly detection). In security-industry taxonomy, that is discovery plus observability plus triage. It is a real, valuable capability stack.
It is also incomplete โ and the incompleteness is the most informative thing about the entire round.
Both of the disclosed case studies emphasize finding the problem: "discovered 85,000 files were left open," "no one noticed the unauthorized Claude instance scanning files." Nowhere in the reporting does Cymphony claim to have stopped anything in real time. That distinction โ visibility versus enforcement โ is the difference between a monitoring company and a control company, and it changes the entire competitive calculus. A product that tells you an agent is behaving badly is substitutable. A product that can interrupt an agent mid-execution is infrastructure.
Let me put down where the missing pieces actually are, because this is where I start to wave the yellow flag.
The agent threat surface breaks down into at least four distinct attack classes, and the reporting addresses only the outermost layer:
First, prompt injection at the runtime. If an agent reads a document, and that document contains an instruction the agent obeys, the access control layer never sees it. The agent had permission. The document had permission. The malicious instruction is a legitimate payload inside a legitimate channel. This is not a hypothetical; it is the single most studied failure mode in agentic systems, and it is not mentioned anywhere in the funding narrative.
Second, the confused deputy problem across tool calls. Agents orchestrate tools, and tools rarely know whose authority they are honoring. An agent acting on behalf of a low-privilege user can invoke a high-privilege tool if the tool trusts the invoker rather than the user. This is not new โ it is a 1998-era security problem โ but agents multiply the invocation rate by several orders of magnitude.
Third, agent-to-agent lateral movement. As multi-agent architectures become standard, one compromised agent becomes a pivot point into the mesh. Nothing in the Cymphony disclosure suggests A2A traffic visibility.
Fourth, credential and context leakage. Agents hold API keys, session tokens, and โ crucially โ accumulated context windows. Those context windows contain enterprise data, and they persist in memory spaces that most security tools cannot see.
None of these are addressed in the public materials. That is not necessarily a product failure; it may simply be a marketing decision. But it means the first mover that solves inline enforcement โ real-time interception inside the agent's execution graph, not after the log line appears โ will be worth more than every discovery tool combined. Entropy increases until someone audits it, and right now the industry is only auditing after the fact.
The Crypto Lens Nobody Applied
Here is the angle I want to bring to this, and it is the one that runs through every serious conversation I have had with developers this year.
The enterprise AI agent problem is the crypto wallet problem wearing a different hat. For fifteen years I have watched the industry argue about who controls what, and the answer has always been the same: the private key is the identity, and the transaction is the permission. When you move that frame onto the enterprise agent, you realize the two domains are converging on the same unsolved problem โ how do you delegate authority to a non-human actor without handing it the keys to the treasury?
Consider what an autonomous on-chain agent actually is. It holds a signing key. It executes transactions without human confirmation. It reads the chain. It responds to market data. On the surface, it is indistinguishable from a traditional trading bot. Under the surface, it is a non-human identity with unilateral signing authority over real capital โ a far more dangerous construct than the enterprise productivity agent Cymphony is selling against.
In 2020 I spent two weeks reverse-engineering the Uniswap V2 bonding curve mechanics for a series of pieces arguing that centralized exchanges were structurally obsolete. The argument was correct. But one thing I underestimated was the speed at which automated agents would come to dominate the flow. By 2023, agentic MEV extraction had become a competitive race that human traders could not meaningfully enter. By 2025, that pattern has generalized: the on-chain economy is quietly becoming agent-only, and the human is increasingly a spectator with a governance vote.
When I published my 2025 AI-agent economy framework โ the one that argued 60% of on-chain volume by 2027 would be generated by autonomous agents rather than humans โ the reception was split. Half the audience found it speculative. The other half found it obvious. I now think both reactions were correct, and the reason is that the enterprise world is arriving at the same conclusion from a completely different direction. Cymphony's ARR is real; the agent economy thesis is not a crypto-native curiosity anymore. It is an enterprise procurement category.
So the crypto-native audience should read this funding round with more attention than it would normally give to a traditional cybersecurity raise, because the crossover is coming whether we plan for it or not.
When an agent holds a wallet key, every problem Cymphony solves becomes a problem crypto has to solve too. Shadow AI in the enterprise becomes shadow agents on the chain. Session key scoping in account abstraction primitives like ERC-4337 and ERC-7579 is the blockchain's answer to the enterprise workforce graph โ a way to grant bounded, revocable, time-limited authority to software that cannot be trusted to hold permanent control. The corporate IAM industry and the on-chain account abstraction research community are, without knowing it, building the same primitive in two different vocabularies.
Which is why I am preparing a deeper piece on the convergence of agent authorization models โ session keys on-chain, workforce graphs off-chain โ because I believe the enterprise security industry will end up importing its agent-control patterns from the crypto industry rather than the other way around. Crypto figured out fifteen years ago that the only durable way to delegate authority is through constrained cryptographic scope. The enterprise is still trying to solve it with access reviews and quarterly attestations.
Rewriting the rules before the bug writes them is not a security slogan โ it is a design philosophy, and in this convergence zone, crypto is ahead of the enterprise for once.
Core: The Math That The Round Does Not Disclose
Now the money, because the numbers are doing something that the narrative is politely hiding.
Start with the valuation implied by the disclosed figures. A $25 million Series A typically represents 15% to 25% of post-money equity in a healthy security SaaS raise. A post-money of $100 million-plus is consistent with that structure. Nothing unusual.
But when you layer the ARR disclosure onto the valuation, the picture becomes considerably more interesting.
"Seven figures" spans $1 million to $9.9 million. That is a 10x range, and the difference between one end of that range and the other is the difference between a defensible valuation and an extravagant one:
If first-year ARR landed at $1 million, the price-to-sales ratio on this round is approximately 100x. That is not a fundamentals valuation. That is a pure narrative multiple, and it is only sustainable if the growth rate justifies it. No growth rate was disclosed.
If ARR landed at $5 million, the multiple drops to roughly 20x โ high for a normal software company, standard for a high-growth security SaaS in a hot category.
If ARR landed at $9.9 million, the multiple compresses to about 10x, which is defensible and unremarkable.
The valuation is not "reasonable" or "aggressive." It is undefined until you know which end of the range the ARR landed on, and the fact that the disclosure was framed as a range rather than a number is itself information. Founders who have a strong number publish it. Founders who have a weaker number hedge. I have written three funding-cycle pieces that made this exact argument, and each time, when the precise figures eventually surfaced, they landed closer to the lower end than the higher one.
There is a second layer to this that the reporting does not touch at all: ARR quality.
A first-year security SaaS company that hits seven figures through design partners and deep ecosystem relationships has cash. Whether it has a business depends on three metrics that were not disclosed. Net revenue retention โ the measure of whether customers expand โ is the difference between a company that scales and a company that churns quietly at renewal. Gross revenue retention tells you whether customers leave. Customer acquisition cost payback tells you whether the growth is expensive or efficient.
None of these were mentioned. Not one.
And they matter more than usual in this specific segment, because the disclosed customer list โ KKR, Syngenta, Cass, and Sequoia's own internal security team as a reference deployment โ reads like a network acquisition pattern. KKR is a peer of the investors. Syngenta is a global enterprise. Cass is a public company. Sequoia using the product internally is a powerful endorsement, but it is also exactly the kind of endorsement that a well-connected team in the Israeli cybersecurity diaspora can arrange without ever proving product-led acquisition. The channel is real. The question is whether the channel is the product.
I have spent the last six years watching crypto companies raise on the strength of their cap table and then discover, painfully, that the cap table is not a customer acquisition strategy. The same pattern is now visible in AI security. SMBC's strategic participation is not a financial bet โ it is a distribution deal dressed up as an investment. That is fine, and it is smart, but it means the growth curve over the next eighteen months will tell us almost nothing about whether the product can win in an open market. Everything will be moving through warm channels.
The final piece of the math that deserves attention is the density of the capital itself. Five months, $435 million, three significant rounds in three weeks. There is no historical precedent in enterprise security for that rate of capital concentration at the seed-to-Series-A boundary. Two interpretations are equally valid:
Interpretation one โ the market is correctly pricing a mandatory new category, because every enterprise deploying agents will need to buy this within twenty-four months, and the first movers will capture enormous value.
Interpretation two โ the market is overcapitalizing a category whose total addressable market has not yet been independently measured, and the inevitable correction will be ugly for everyone except the acquirers.
I have reported on both interpretations in adjacent categories โ token launches, NFT marketplaces, DeFi protocols โ and the resolution has never been neutral. When capital arrives this fast, it does not distribute evenly. It concentrates into a handful of winners and leaves the rest as acquisition fodder. Volatility is the tax on uncertainty, and right now the agent-security category is charging that tax in full.
Contrarian: The Tool Is The New Attack Surface
Now the part that is not in the press release, and it is the observation I cannot shake.
Cymphony's workforce graph aggregates identity, data, and behavioral telemetry into a single model. That is exactly what makes it valuable โ and it is exactly what makes it the most dangerous system in the customer's environment.
Read that again slowly, because it is the thesis of this section.The product whose job is to see everything is now a single point of compromise that, once breached, hands an attacker a complete map of every identity, every data asset, and every permission edge inside the enterprise.
I have audited systems with this architecture before. In 2022, when I broke down the Terra/LFG reserve strategy within four hours of the UST depeg, the core insight was that the reserve was not a buffer โ it was a crystallization point that, once destabilized, took down the entire system rather than insulating it. Concentrated trust does not distribute risk. It amplifies it. The workforce graph has the same structural property. It is a honey pot that manufactures its own attackers.
Security vendors rarely say this out loud, but it is the defining paradox of the entire industry: every visibility product is also a target. SIEMs, EDR agents, identity providers โ all of them hold privileged access to the environment they protect. Cymphony's graph is more dangerous than most, because it does not merely observe events; it models authority. An attacker who gets inside it does not need to compromise individual systems. They can reason about which identity to hijack to reach which asset, the way a penetration tester reads a network diagram.
Nothing in the disclosed materials suggests the company has published a threat model for its own infrastructure. Nothing suggests zero-knowledge handling, data minimization, or a cryptographic isolation guarantee for the graph itself. These may exist. They are simply not part of the story being told, and in security, the story that is not told is usually the story that has not been solved.
There is a second contrarian angle, and it is uncomfortable for the founders: the Wiz narrative is a ceiling dressed as an aspiration.
The comparison is being made because Wiz was acquired by Google for $32 billion โ the single most successful outcome in modern security startup history. Citing that precedent does two things simultaneously. It anchors the valuation narrative to an extraordinary exit. And it signals, quietly, that the expected path is acquisition rather than independent public company.
That is not a criticism of Cymphony. It is a structural read of the category. The independent survival question for any agent-security startup is whether the category is a product or a feature. Microsoft Purview, Palo Alto's Cortex, CrowdStrike's Falcon, and Google's own agent platform teams are all capable of building agent governance natively into their stacks โ and they have the distribution to make it default. If they do, the standalone agent-security vendor loses its reason to exist as an independent entity. The only defense is depth that cannot be replicated: proprietary data flywheels, deep vertical integration in a regulated industry, or a technical moat in inline enforcement that the platforms cannot match. Discovery and alerting are not that moat. Discovery is a feature. Enforcement is infrastructure. Only one of those survives a platform vendor's roadmap.
The third contrarian observation is about the people, and it deserves to be said plainly. Workforce graphs do not only model non-human identities. They model human behavior with AI tools. In the disclosed cases, the alert that fired was about a contractor installing an unapproved tool. That is a legitimate security finding in most jurisdictions. It is also, in the European Union, a potential labor-law and privacy-law complication. Whether enterprises are prepared to build an employee-AI-usage monitoring layer is not a technical question โ it is a governance question that regulators have not yet answered, and companies that deploy monitoring infrastructure ahead of that answer leave themselves exposed.
I have been in this industry long enough to be certain of one thing: every security tool that expands its aperture eventually runs into a privacy boundary, and the boundary always moves. Cymphony's market is not just enterprises. It is enterprises operating under a regime that will look very different in 2027 than it does today.
Takeaway: Watch The Fourth Round, Not The Third
What actually matters here is not Cymphony's $25 million. It is the signal that a category nobody had named eighteen months ago is now getting funded at a pace that enterprise security has not seen since the cloud migration years.
The short-term indicators will look like this. If the company publishes a precise ARR and a net retention number in the next two quarters, the fundamental case is stronger than it looks. If the disclosure stays vague, the valuation is narrative-driven and vulnerable to the first serious down round in the category. If Microsoft or Palo Alto ships a native agent-governance module inside their existing cloud security suites, the independent-agent-security thesis takes a structural hit that no amount of funding can fully offset.
The signals worth tracking over a longer horizon are sharper. Watch for the first acquisition of an agent-security startup by a platform incumbent โ that event, whenever it happens, marks the transition from a category to a feature. Watch for Gartner's 40%-cancellation prediction to be verified or falsified in the field, because that number is the entire demand-side case for this market. Watch for account abstraction primitives on-chain to mature into the enterprise IAM conversation, because the convergence I sketched earlier is not speculative โ it is a fifteen-year pattern finally crossing domains.
The truth is hidden in the gas fees, and this time the gas fees are being paid in enterprise procurement budget. Whether you are watching L2 fragmentation, DAO governance multi-sigs, or a Tel Aviv cybersecurity startup mapping non-human identities at KKR, the same problem is underneath all of it: we built systems that move faster than the humans who are supposed to safely control them, and we are only now starting to build the trust layer that catches up.
Cymphony is one bet on that layer. It is not the only one, and it will not be the last.
The question worth asking over the next eighteen months is not whether agent security becomes a real category. It will. The question is whether the category belongs to the companies that solve enforcement, or to the platforms that simply absorb it. The pool remembers what the ticker forgets โ and the ticker will forget a lot of these raises long before the industry finds out which side of that line the winners stand on.