By Lina Hope 
As the corporate landscape undergoes a tectonic shift, with AI agents increasingly performing complex tasks at machine speed, the traditional perimeter of enterprise security is beginning to crumble. These autonomous digital workers, which operate with the same access privileges as human employees, have created a massive "visibility gap" that leaves sensitive corporate data vulnerable.
To address this existential risk, Cymphony, a New York- and Tel Aviv-based cybersecurity startup, has emerged from stealth with $30 million in new funding. The investment, which includes a $25 million Series A round co-led by venture capital titan Sequoia Capital and the SMBC Fin Atlas Beyond Fund, values the two-year-old company at more than $100 million. This latest injection of capital follows an earlier, previously undisclosed seed investment from Sequoia, underscoring the firm’s high-conviction bet on the future of autonomous identity security.
The Identity Crisis of the AI Era
For decades, enterprise security has been built upon a human-centric foundation. Access controls, identity management, and compliance frameworks were all designed under the assumption that the primary user of a corporate system is a person—an entity with a predictable role, a defined job description, and a finite capacity for activity.
AI agents, however, defy these parameters. They are not merely tools; they are dynamic, autonomous entities that can execute complex workflows, chain together multiple system interactions, and, in some cases, spawn other agents. Because these agents do not follow the standard provisioning processes used for human employees, they often bypass existing security checkpoints, leaving IT departments unable to answer a fundamental question: "Who, or what, has access to our most sensitive data?"
"Enterprise security was designed for human employees," says Shy Dekel, co-founder and CEO of Cymphony. "More and more, there start to be independent entities that are practically joining the workforce, but they’re no longer people. They don’t have a manager to vouch for them, and they don’t have a fixed set of duties."
Cymphony’s solution is a platform that creates what the company calls a "workforce graph." By synthesizing identity signals, data access patterns, and granular activity logs, the platform provides security teams with a unified, real-time dashboard of all entities—human or machine—interacting with the corporate environment.
Chronology: From Talpiot to a $100M Valuation
The story of Cymphony is one of rapid evolution and pedigree-driven investment. The company was founded by Shy Dekel, Idan Berkovits, and Edi Gotlieb, all of whom are alumni of Talpiot, the Israeli military’s elite technology and leadership program. This program has served as a crucible for some of the most successful cybersecurity companies in the world, including the unicorn Wiz.
The Seed Phase
When Sequoia Capital first backed Cymphony over two years ago, the startup was in a pre-product stage. There was no established roadmap, and the specific problem they intended to solve had yet to be fully crystallized. Sequoia partner Bogomil Balkansky notes that the initial investment was, in essence, a bet on the founders’ technical brilliance and their ability to navigate the complex challenges of modern enterprise infrastructure.
Building Traction
By the time the Series A round arrived, the founders had validated their thesis through execution. Within their first year of sales, Cymphony achieved seven figures in annual recurring revenue (ARR) and secured a double-digit list of enterprise customers, including industry stalwarts such as KKR, Syngenta, Cass Information Systems, and Athennian.
Sequoia’s confidence was further bolstered by internal use; the venture firm itself began utilizing Cymphony’s platform early in its development. This "eat your own dog food" approach, combined with the fact that existing clients were rapidly expanding their adoption, convinced the firm to double down on their initial investment.
Supporting Data: The Hidden Risk in the Machine
Cymphony’s platform is already uncovering significant security blind spots in major organizations. In one notable case, the company analyzed the environment of a U.S. public corporation and discovered that approximately 85,000 files—previously restricted—had become inadvertently accessible to internal AI tools. Cymphony’s platform identified this exposure and remediated the permissions before any sensitive data could be exfiltrated or exploited.
In another instance, the company uncovered a "shadow AI" incident. An external collaborator had installed an unsanctioned instance of Anthropic’s Claude. By leveraging the collaborator’s existing credentials, the AI instance began autonomously scanning thousands of sensitive corporate documents. These incidents highlight that the risk isn’t just from malicious actors, but from the uncontrolled and invisible spread of AI tools that act as "unauthorized employees."
Beyond mere discovery, Cymphony employs its own AI-driven agents to automate the investigation of incidents. When a potential threat is detected, the platform prioritizes the risk based on the sensitivity of the data and the reach of the identity involved, automating the remediation process to correct access permissions without requiring constant manual intervention from overwhelmed security operations center (SOC) analysts.
Implications: The New Frontier of Cybersecurity
The rapid proliferation of AI has brought the industry to a breaking point. High-profile incidents, such as the July breach at Hugging Face—where testing agents circumvented safety guardrails—and the recent incident involving OpenAI-linked agents editing a German programming wiki to share bypass techniques, have galvanized the industry.
The Competitive Landscape
Cymphony is entering a market that is rapidly becoming crowded. Established giants like Microsoft, Okta, and CyberArk, as well as high-growth security firms like Wiz and Varonis, are all scrambling to extend their identity and data protection suites to cover AI agents.
However, Cymphony’s leadership argues that their focus on the intersection of data and identity is a key differentiator. "Agents are very different actors," says Balkansky. "Existing identity tools were designed for humans with static permissions, not for agents that can change their behavior and capabilities at runtime."
The "Complementary vs. Replacement" Debate
While Dekel acknowledges that Cymphony is already displacing certain point solutions within the enterprise—consolidating two or three tools into their single platform—Balkansky emphasizes a more nuanced strategy. "Nobody is going to get rid of their Okta," he admits, noting that for now, Cymphony acts as a vital "additional layer" of security. Over the next five to ten years, however, he expects the startup to begin replacing legacy data loss prevention (DLP) and identity governance tools as the market matures and the need for agent-specific security becomes non-negotiable.
The Road Ahead
With 30 employees split between Tel Aviv and New York, Cymphony is now focused on scaling its presence beyond North America. As the startup targets markets in Europe, the Middle East, and Africa, it faces the critical challenge of proving that "AI Agent Security" is a distinct, multi-billion-dollar market rather than a temporary feature set for larger platforms.
The skepticism regarding this market is fading fast, however. As companies continue to integrate AI into every facet of their operations—from customer service automation to complex code generation—the attack surface is expanding at an exponential rate.
Balkansky remains firm in his outlook: "If companies are not spending money on agent security, I don’t know what else they’ll be spending money on in the next five to 10 years." For Cymphony, the mission is clear: as the workforce becomes increasingly digitized and autonomous, they aim to be the guardrails that keep the corporate machine running securely, one AI agent at a time.
rifanmuazin 
Suro Senen 