Sequoia Capital has invested $25 million in Cymphony, a startup working to control security risks created when AI agents gain the same access to corporate systems and sensitive data as human employees, according to a report published by TechCrunch on September 9, 2026. The funding, which includes a Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, values the New York- and Tel Aviv-based company at more than $100 million after the investment. The round follows an earlier seed investment from Sequoia that had not been publicly disclosed.
At one U.S. public company, Cymphony discovered roughly 85,000 files that had become accessible to AI tools and agents, the startup reported. The company said it helped shut down the exposure and confirmed that none of the files had been accessed through those AI systems. In a separate incident, an external collaborator had installed an unauthorized instance of Anthropic's Claude that used the collaborator's existing permissions to scan thousands of sensitive files, CEO Shy Dekel told the outlet. Cymphony has built a product, signed more than ten enterprise customers—including KKR, Syngenta, Cass Information Systems, and Athennian—and reached seven figures in annual recurring revenue within its first year of sales, the startup said. The two-year-old company now employs about 30 people across Tel Aviv and New York, with most customers currently located in North America.
"Enterprise security was designed for human employees," Cymphony co-founder and CEO Shy Dekel said. "More and more, there start to be independent entities that are practically joining the workforce, but they're no longer people." AI agents don't always go through the same access and identity controls as employees, but they have access to multiple systems and handle large volumes of corporate data, making it difficult for enterprises to track who has access to what, the report states. Cymphony is attempting to close that gap by providing security teams a unified view of employees, AI agents, and other nonhuman identities, along with the systems and sensitive data they can access. At the heart of its platform, the startup has constructed what it calls a "workforce graph" that combines identity, data, and activity signals.
The challenge grows as companies deploy more AI agents across their operations because, unlike human employees with relatively stable roles and permissions, agents can take different paths to complete a task, gain new capabilities, and sometimes create other agents, making their access harder to govern with security systems built around people, the report explains. "Agents are very different actors," Sequoia partner Bogomil Balkansky said, noting that existing identity tools weren't designed for agents that can change their behavior and capabilities while running. Cymphony uses AI agents to investigate incidents, rank what security teams should address, and automate some fixes, including correcting access permissions, with the platform able to operate largely automatically or through a managed service that brings in Cymphony's security experts for more complex situations. The startup is also replacing some existing security products at customers—at one enterprise, the company helped merge two existing tools and removed the need to purchase a third, Dekel said. Sequoia's initial bet on Cymphony came before the startup had decided on the problem it wanted to tackle, with the venture firm leading its seed round more than two years ago when Cymphony had no product or even a clear product direction, Balkansky told the outlet.
Balkansky acknowledged that many companies are already positioning themselves around AI and agent security but said Cymphony's approach stands out by treating identity and data security as part of the same problem. Cymphony faces competition from established security companies expanding their offerings around identity, data, and AI, including Microsoft, Okta, CyberArk, Wiz, and Varonis. Balkansky sees Cymphony's role, at least for now, as more complementary than replacement—"Nobody's going to get rid of their Okta," he said, adding that customers are largely adopting Cymphony as an additional layer today, though over time the startup could begin displacing some focused solutions, particularly in areas such as data loss prevention. "If companies are not spending money on agent security, I don't know what else they'll be spending money on in the next five to 10 years," Balkansky said. As Cymphony moves past its Series A and grows among large enterprise customers, it now has to demonstrate that AI agent security can become a market of its own rather than a feature offered by larger security platforms. The pressure will intensify as traditional security vendors adapt their existing customer relationships and product suites to address the same risks, forcing Cymphony to prove its specialized approach delivers enough value to justify standing alone.