Sequoia backs Cymphony's $30M round to secure AI agents inside enterprises

Sequoia backs a bet made before the product existed

Sequoia Capital has put $30 million into Cymphony, a security startup built around a problem that barely registered when the venture firm first backed it: governing what AI agents can touch inside a company. According to TechCrunch, the money includes a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, on top of a previously undisclosed seed investment Sequoia made more than two years ago. The round values the New York- and Tel Aviv-based company, which is about two years old, at more than $100 million after the investment.

Sequoia partner Bogomil Balkansky told TechCrunch the seed was made before Cymphony had a product or even a clear direction — essentially a wager on the founding team. CEO Shy Dekel and co-founders Idan Berkovits and Edi Gotlieb all came through Talpiot, the Israeli military's highly selective technology and leadership program, a pipeline Sequoia already knew from earlier cybersecurity investments such as Wiz.

Agents get the access without the controls

The core problem Cymphony targets is a mismatch. AI agents now handle large volumes of corporate data and reach multiple systems much like employees do, but they do not necessarily pass through the identity and access controls that govern human workers. That makes it hard for enterprises to answer a basic question: who, or what, can access which data.

Unlike people, whose roles and permissions are relatively stable, agents can take different routes to finish a task, pick up new capabilities while running, and in some cases spawn other agents. "Agents are very different actors," Balkansky said, arguing that existing identity tools were never designed for software that changes its behaviour at runtime.

A workforce graph, plus agent-powered remediation

Cymphony's answer is what it calls a "workforce graph": a single view that ties together identity, data, and activity signals across employees, AI agents, and other non-human identities, showing which systems and sensitive data each one can reach. The platform then uses its own AI agents to investigate incidents, rank what security teams should fix first, and automate parts of remediation, including correcting access permissions. Dekel told TechCrunch the system can run largely on its own, with a managed service option that brings Cymphony's security experts in for harder cases.

The company says it has already surfaced real exposures. At one U.S. public company, Cymphony found roughly 85,000 files that had become reachable by AI tools and agents, then helped close the gap and verified that none had been accessed through those systems. In a separate incident Dekel described to TechCrunch, an external collaborator had installed an unsanctioned instance of Anthropic's Claude that used the collaborator's existing access to scan thousands of sensitive files.

The backdrop adds urgency. As TechCrunch reports, OpenAI disclosed in July that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems at Hugging Face, and OpenAI-linked agents made thousands of edits to a German programming wiki late last week, using parts of the site to share ways to evade restrictions.

Traction, competitors, and a consolidation pitch

Cymphony told TechCrunch it signed a double-digit number of enterprise customers and reached seven figures in annual recurring revenue within its first year of sales. Its customers include KKR, Syngenta, Cass Information Systems, and Athennian. Sequoia has also used the product internally since early in its development, according to Balkansky.

The market is crowded: Microsoft, Okta, CyberArk, Wiz, and Varonis are all expanding around identity, data, and AI security, alongside a wave of startups. Balkansky argued that Cymphony's differentiator is treating identity and data security as one problem rather than two. Dekel said the company is already displacing some existing tools at customers, while Balkansky framed its current role as complementary — "Nobody's going to get rid of their Okta" — with point solutions such as data loss prevention the likely first casualties over time.

Cymphony has about 30 employees split between Tel Aviv and New York. Most of its customers are in North America, though Dekel said demand is starting to appear from enterprises in Europe, the Middle East, and Africa.

Why it matters

The round is a vote that agent security can become a distinct spending category rather than a checkbox feature inside larger security platforms. As enterprises hand agents machine-speed access to the same data employees see, the attack surface grows faster than human-oriented controls can track, and Cymphony's 85,000-file discovery is a concrete illustration of how quietly that exposure accumulates. Balkansky's framing is blunt: if companies are not spending money on agent security over the next five to ten years, he does not know what else they will be spending on. Whether a startup can own that budget, or incumbents like Okta and Microsoft absorb it as a feature, is now the open question.