The phrase "AI sprawl" has become a staple of tech conversations and executive strategy discussions as organizations begin rolling out AI agents at scale. Yet for CISOs tasked with securing countless agents suddenly active across their networks, a different kind of sprawl is emerging: an influx of vendors promising to help. A quick scan of public Crunchbase and PitchBook listings reveals at least two dozen companies offering some flavor of AI agent security. Some focus on vetting the tools agents rely on, others aim to help businesses govern what data their agents can access. Still others, such as CrowdStrike, are developing detection and response controls on the devices where agents operate, while a further group concentrates on identifying and remediating unauthorized AI usage. The offerings naturally vary, but their pitches around discovering and governing agents tend to sound remarkably alike—featuring knowledge graphs, continuous monitoring, runtime security, tool access, MCP vetting, and similar capabilities. Some vendors are even retooling their products to ride the wave.

Until last year, AI security startup Reco primarily sold software for mapping and protecting SaaS and AI platforms. It has since repositioned itself around a broader solution that leverages a context graph to link agents with apps, people, accounts, and permissions—giving security teams visibility into what an agent can reach and the ability to revoke access it doesn't require. According to Reco co-founder and CEO Ofer Klein, the most significant shift over the past year that pushed the startup to widen its focus was that companies are building and deploying AI agents faster than they can track them. At one Fortune 100 customer, he noted, Reco's platform uncovered 21,000 agents the company was unaware of. At a large financial services customer, the startup claims it identified an agent created by a former employee that could access Salesforce and share that data with a domain the company couldn't see.

Klein isn't the only one emphasizing how urgent it is for companies to secure this sprawl. Chris Sestito, co-founder and CEO of security startup HiddenLayer, told me earlier this month that once agents reach production, the scale of their costs and risks shifts from theoretical to "full scale really quickly," and that more than 50 of his customers have AI agents in production interacting with critical systems and sensitive assets. Another AI startup, Cymphony, said that at one U.S. public company, it discovered roughly 85,000 files that had become accessible to AI tools and agents.

There's little question that a great many investors are eager to back companies that can profit from helping businesses find and secure all these agents, and Reco has tapped into that demand: the startup announced Tuesday that it raised $55 million, adding to a $30 million Series B from February. AT&T, a customer, participated in the extension through its venture arm, alongside Forestay and Quadrille Capital. Klein said the company's valuation has "more than doubled" since the Series B was first announced in February, and he loosely placed it in the "high hundreds of millions" range, though he declined to share specifics. Annual recurring revenue currently sits in the "double-digit millions of dollars," he said, and he expects it to triple this year. The startup has over 100 customers, with financial services firms making up roughly 40% of the business.

Reco's wager, it seems, is that its existing coverage of SaaS apps—and the AI agents those apps increasingly provide—will help it differentiate itself from competitors. The company currently integrates with more than 280 apps, and Klein says new integrations can be added within days. He explained that the platform uses browser and network signals to detect agents outside the apps it connects to directly within companies, and it includes controls for inspecting prompts and tool calls. The startup will direct the new funding toward hiring, sales, partnerships, and customer support. This latest round brings Reco's total capital raised to $140 million.