Sequoia doubles down on Cymphony as AI agents create new enterprise security risks

As AI agents summation entree to the aforesaid delicate firm information and systems arsenic quality workers portion operating astatine instrumentality speed, enterprises are prone to caller information risks. Storied task steadfast Sequoia Capital is betting large connected that shift, backing startup Cymphony arsenic it emerges with $30 cardinal successful backing to assistance companies support their increasing AI workforce successful check.

The backing includes a $25 cardinal Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, valuing the New York- and Tel Aviv-based startup astatine much than $100 cardinal aft investment. The circular follows a antecedently undisclosed effect concern from Sequoia.

AI agents bash not needfully spell done the aforesaid entree and individuality controls arsenic employees, but they person entree to aggregate systems and grip ample amounts of firm data. This makes it hard for enterprises to way who has entree to what.

Cymphony is trying to code that spread by giving information teams a azygous presumption of employees, AI agents, and different non-human identities, including the systems and delicate information they tin access. At the halfway of its platform, the two-year-old startup has built what it calls a “workforce graph”. This brings unneurotic identity, data, and enactment signals.

“Enterprise information was designed for quality employees,” Cymphony co-founder and CEO Shy Dekel (pictured above, center) said successful an exclusive interview. “More and more, determination commencement to beryllium autarkic entities that are practically joining the workforce, but they’re nary longer people.”

Cymphony says it is already uncovering those risks wrong ample companies. At 1 U.S. nationalist company, the startup said it recovered astir 85,000 files that had go accessible to AI tools and agents. Cymphony stated it helped adjacent the vulnerability and verified that nary of the files had been accessed done those AI systems.

In different case, Dekel told TechCrunch that an outer collaborator had installed an unsanctioned lawsuit of Anthropic’s Claude that utilized the collaborator’s existing entree to scan thousands of delicate files.

Beyond identifying risks, Cymphony uses AI agents to analyse incidents, prioritize what information teams should address, and automate immoderate remediation, including correcting entree permissions. The level tin run mostly automatically, Dekel said, adding that customers tin besides opt for a managed work that brings Cymphony’s information experts into the loop for much analyzable cases.

Why Sequoia doubled down

Sequoia’s archetypal stake connected Cymphony came earlier the startup had settled connected the occupation it wanted to solve. When the task steadfast led its effect circular much than 2 years ago, Cymphony had nary merchandise oregon adjacent a wide merchandise direction, Sequoia spouse Bogomil Balkansky told TechCrunch.

The concern was mostly a stake connected Dekel and his co-founders, Idan Berkovits (pictured above, right) and Edi Gotlieb (pictured above, left), each 3 of whom came done Talpiot, the Israeli military’s highly selective exertion and enactment program. Sequoia was already acquainted with the programme done erstwhile cybersecurity investments, including Wiz.

“We conscionable saw 3 astonishing young radical with the benignant of pedigree that we astatine Sequoia person experienced a batch of occurrence with,” Balkansky said.

Nonetheless, Sequoia, Balkansky said, wanted to spot much than the founders’ pedigree by the Series A.

Cymphony had built a product, signed a double-digit fig of endeavor customers, and reached 7 figures successful yearly recurring gross wrong its archetypal twelvemonth of sales, the startup told TechCrunch. Its customers see KKR, Syngenta, Cass Information Systems, and Athennian.

Sequoia has besides been utilizing Cymphony’s merchandise internally since aboriginal successful its development, Balkansky said. He noted the prime and scope of Cymphony’s customers, and that existing customers are expanding their usage of the platform, arsenic among the cardinal reasons the task steadfast decided to put again.

Cymphony is entering an progressively crowded marketplace arsenic cybersecurity companies strive to code risks emerging from the increasing usage of AI agents.

Recent incidents person added to those concerns. In July, OpenAI disclosed that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems astatine AI level Hugging Face. Late past week, OpenAI-linked agents made thousands of edits to a German programming wiki, utilizing parts of the tract to pass and stock ways to evade restrictions.

Balkansky acknowledged that scores of companies are already positioning themselves astir AI and cause security. He said, however, that Cymphony’s attack stands retired by treating individuality and information information arsenic portion of the aforesaid problem.

That distinction, Dekel and Balkansky some argue, becomes much important arsenic companies deploy much AI agents crossed their operations. Unlike quality employees with comparatively unchangeable roles and permissions, agents tin instrumentality antithetic routes to implicit a task, get caller capabilities, and, successful immoderate cases, make different agents, making their entree harder to govern with information systems designed astir people.

“Agents are precise antithetic actors,” Balkansky said, arguing that existing individuality tools were not designed for agents that tin alteration their behaviour and capabilities astatine runtime.

Cymphony is besides successful a contention against established information companies that are expanding their offerings astir identity, data, and AI, including Microsoft, Okta, CyberArk, Wiz, and Varonis.

Dekel told TechCrunch that Cymphony is already replacing immoderate existing information products astatine customers. At 1 enterprise, helium said without disclosing specifics, the institution helped consolidate 2 existing tools and eliminated the request to bargain a third.

However, Balkansky sees Cymphony’s role, astatine slightest for now, arsenic much complementary than replacement. “Nobody’s going to get escaped of their Okta,” helium said, adding that customers are mostly adopting Cymphony arsenic an further furniture today. Over time, however, helium told TechCrunch that the startup could statesman displacing immoderate constituent solutions, peculiarly successful areas specified arsenic information nonaccomplishment prevention.

Cymphony has astir 30 employees crossed Tel Aviv and New York. Most of its customers are presently successful North America, though Dekel told TechCrunch that the startup is opening to spot request from enterprises successful Europe, the Middle East, and Africa.

That said, arsenic Cymphony moves beyond its Series A and expands among ample endeavor customers, it present has to beryllium that AI cause information tin go a marketplace of its ain alternatively than a diagnostic offered by larger information platforms. Balkansky believes spending successful the country volition turn arsenic companies enactment much AI agents to work.

“If companies are not spending wealth connected cause security, I don’t cognize what other they’ll beryllium spending wealth connected successful the adjacent 5 to 10 years,” helium said.