Pluto Security exits stealth with $42M to monitor employee AI tools and agents

Pluto emerges from stealth with $42 million

Pluto Security, a startup building security tooling for enterprise AI usage, has come out of stealth with $42 million in total funding, TechCrunch reports. The company only began selling its product in April and has already passed $2 million in annual recurring revenue with more than 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense, according to CEO and co-founder Shahar Bahat.

The funding consists of an $8.5 million seed round led by TLV Partners, which also drew investment from the founders of cybersecurity firm Armis, followed by a $34 million Series A led by Jump Capital. Skinos, the venture firm of Check Point co-founder Shlomo Kramer, Ansa Capital and other angel investors also participated.

Most detected risk comes from non-developers

Speaking to TechCrunch, Bahat said a newly released AI tool can show up inside a corporate environment within roughly two hours of launch. About 60% of the risks Pluto detects across its customer base sit in applications "vibe-coded" by non-developers: finance departments are the biggest source, followed by marketing and legal, with actual developers ranking only fourth.

The publication cites one illustrative find: a finance employee at a Fortune 500 company had vibe-coded an app for managing customer information and churn, and it was left exposed to the internet.

Bahat said the severity of risk varies with a CISO's mindset and how eagerly an organization adopts AI, but problems surface regardless. In her words, there was not a single proof of concept where the team entered an environment and found nothing malicious, and some uncovered extension packages or skills were under active live attack at the time.

From user behavior to agent behavior

Pluto's core bet is that legacy security software is ill-suited to the AI era, and that proper defense requires watching what AI agents do in real time, alongside tracking what employees build and deploy. "We're moving from user behavior to agent behavior," Bahat said.

The product monitors the AI tools employees use, the skills, extensions, MCP servers and other components those tools depend on, and the apps and agents being created. The company says it can identify risky components, flag dangerous agent activity, and enforce security policies without stopping employees from using or building with AI.

On the technical side, Pluto connects to endpoint security and device management systems, or deploys its own sensors directly onto devices. It gathers information including prompts, commands, running processes, permissions and prior user activity, and runs lightweight models on endpoints to assess what an agent is trying to do.

A distinguishing capability is intervention during a task. If an agent attempts to gain permissions beyond what a user intended, the system can block the action or insert instructions into the session that push the agent to ask for confirmation first. "We can inject context back to the session, and this way I can change how the agent is working," Bahat explained.

A free scanner feeds the pipeline

Pluto also takes an unusual go-to-market approach. In April it launched Plutonium, a free platform that lets anyone check risks tied to publicly available AI skills, connectors and add-ons, alongside an MCP scanner and a catalog of verified components. Bahat claims thousands of security professionals use it, and that the community around the platform has become a meaningful source of feedback and prospective customers. She said 70% of Pluto's sales pipeline now comes from inbound interest, though she did not break down how much of that arrives directly through Plutonium.

The company plans to spend the new capital on product development, expanding its security research efforts and growing its US presence. It currently employs 40 people across the US and Israel.

Why it matters

Pluto is part of a fast-emerging crop of security startups raising large rounds on the conviction that AI adoption has opened gaps existing tools cannot cover. The finding that finance, marketing and legal staff, rather than developers, generate most detected risk shows the problem is organizational rather than confined to engineering teams. As AI agents gain autonomy, security is shifting from monitoring logins and file access to interpreting agent behavior as it happens, effectively creating a new product category. Pluto's early ARR and named customers suggest enterprises are already paying for this, and its mid-session intervention approach, steering an agent rather than simply blocking tools, may become the template for letting AI usage continue without losing control.