As AI agents increasingly gain access to the same sensitive corporate data and systems as human employees—while operating at machine speed—enterprises are facing a new class of security vulnerabilities. Sequoia Capital is making a significant bet on this shift, backing startup Cymphony as it launches with $30 million in funding to help companies manage their expanding AI workforce.

The funding round includes a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, placing the New York- and Tel Aviv-based company’s valuation at over $100 million post-investment. This follows an earlier, previously undisclosed seed investment from Sequoia.

Unlike human workers, AI agents don’t always pass through the same access and identity controls. Yet they can reach multiple systems and process vast amounts of corporate data, making it difficult for organizations to track who—or what—has access to sensitive information. Cymphony aims to close that gap by providing security teams with a unified view of employees, AI agents, and other non-human identities, along with the systems and data they can reach.

At the heart of its platform, the two-year-old startup has built what it calls a “workforce graph,” which combines identity, data, and activity signals into a single framework.

“Enterprise security was designed for human employees,” said Cymphony co-founder and CEO Shy Dekel (pictured above, center) in an exclusive interview. “More and more, there start to be independent entities that are practically joining the workforce, but they’re no longer people.”

Cymphony says it is already uncovering these risks inside large organizations. At one U.S. public company, the startup identified roughly 85,000 files that had become accessible to AI tools and agents. Cymphony said it helped close that exposure and confirmed that none of the files had been accessed through those AI systems.

Beyond identifying vulnerabilities, Cymphony uses AI agents to investigate incidents, prioritize which issues security teams should address first, and automate some remediation—including correcting access permissions. The platform can run largely on its own, Dekel noted, though customers can also choose a managed service that brings Cymphony’s security experts into the loop for more complex situations.

**Why Sequoia doubled down**

Sequoia’s initial investment in Cymphony came before the startup had even settled on the specific problem it wanted to solve. That early bet was largely on the founders—Dekel, Idan Berkovits (pictured above, right), and Edi Gotlieb (pictured above, left)—all of whom came through Talpiot, the Israeli military’s highly selective technology and leadership program. Sequoia was already familiar with the program through prior cybersecurity investments, including Wiz.

“We just saw three amazing young people with the kind of pedigree that we at Sequoia have experienced a lot of success with,” said Balkansky.

Still, by the Series A stage, Sequoia wanted to see more than just the founders’ credentials. Cymphony’s customer base now includes KKR, Syngenta, Cass Information Systems, and Athennian. Sequoia has also been using Cymphony’s product internally since early in its development, Balkansky said. He pointed to the quality and range of customers, along with existing clients expanding their use of the platform, as key reasons the venture firm decided to invest again.

Cymphony is entering an increasingly crowded field, as cybersecurity companies race to address risks tied to the growing adoption of AI agents. Recent incidents have added urgency to those concerns. In July, OpenAI disclosed that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems at AI platform Hugging Face. Late last week, OpenAI-linked agents made thousands of edits to a German programming wiki, using parts of the site to communicate and share ways to evade restrictions.

Balkansky acknowledged that many companies are already positioning themselves around AI and agent security. He argued, however, that Cymphony’s approach stands apart by treating identity and data security as part of the same challenge. That distinction, both Dekel and Balkansky contend, becomes more critical as organizations deploy more AI agents across their operations.

Unlike human employees with relatively stable roles and permissions, agents can take different paths to complete a task, gain new capabilities, and in some cases create other agents—making their access far harder to govern with security systems designed for people.

“Agents are very different actors,” Balkansky said, noting that existing identity tools were not built for agents that can change their behavior and capabilities at runtime.

Cymphony is also racing against established security vendors expanding into identity, data, and AI, including Microsoft, Okta, CyberArk, Wiz, and Varonis. At one enterprise, Balkansky said without sharing specifics, the company helped consolidate two existing tools and removed the need to purchase a third.

Still, Balkansky sees Cymphony’s role, at least for now, as more complementary than replacement. “Nobody’s going to get rid of their Okta,” he said, adding that customers are largely adopting Cymphony as an additional layer today.

Cymphony currently has about 30 employees spread across Tel Aviv and New York. As it moves beyond its Series A and expands among large enterprise customers, the company now has to prove that AI agent security can become a market of its own—rather than just a feature offered by larger security platforms. Balkansky believes spending in this area will grow as companies put more AI agents to work.

“If companies are not spending money on agent security, I don’t know what else they’ll be spending money on in the next five to 10 years,” he said.