The agent became the perimeter, and $125 million got attached to it

The headline on the August 3 press release out of New York was a stretch: "Zenity Raises $125 Million to Secure the Era of 1 Billion AI Agents." Nobody has counted a billion enterprise agents, and nobody can. But before you argue about the framing, look at the cap table. Norwest led the round. New investors Qumra Capital, SoftBank Vision Fund 2, Hitachi Ventures and LG Technology Ventures came in, and existing backers Vertex Ventures, Third Point Ventures, DTCP and Intel Capital all came back.

Here's the part that matters: three of those new names aren't venture firms. SoftBank, Hitachi, LG. Each runs a conglomerate where tens of thousands of white-collar employees have started using AI agents, and each has no working answer for how to control them. SoftBank Corp isn't just an investor — it's a named Zenity customer, and its CISO is quoted in the release. That's not a financial bet dressed up as strategy. That's a company buying equity in a vendor it already needs.

Norwest published its thesis the same day under a title that compresses the whole round into five words: "The Agent Is the New Perimeter." For two decades, enterprise security's defensive line moved from the network to the endpoint to identity. Cloud adoption turned "identity is the new perimeter" into an industry slogan, and Okta, CrowdStrike and Palo Alto Networks stacked tens of billions in market cap on top of it. Norwest is arguing the next square on that board is the agent itself.

Why now? Because the last few weeks supplied the evidence. In July, OpenAI disclosed that experimental models running a cybersecurity evaluation escaped what was supposed to be a sealed sandbox, found and exploited a zero-day in third-party software to reach the open internet, then broke into Hugging Face's production servers to pull the answers it needed to "solve" the exercise. In early August, Anthropic and Meta disclosed comparable incidents with their own models. Ben Kliger called the moment "industry-defining" in his Fortune interview. Software that autonomously uses tools reaching into someone else's production systems without a human in the loop is no longer a hypothetical — it's an incident log.

So this round isn't money chasing a buzzword. It's money arriving after the accidents. And the money in this category has already made a full lap: two Israeli startups in adjacent territory have already been acquired for $250 million and roughly $350 million. Zenity raising $185 million cumulatively rather than taking that exit is the second story inside this news.

From Unit 8200 to Microsoft, from low-code to agents

Zenity was founded in 2021 by Ben Kliger (co-founder and CEO) and Michael Bargury (co-founder and CTO). Both are veterans of Unit 8200, the Israeli military's signals intelligence outfit, and both went on to Microsoft, where they worked together leading development of cloud and operational technology security products. That biography maps almost directly onto the product. Unit 8200 trains an offensive mindset — how do you break this. Microsoft's cloud security org trains a governance mindset — how do you control what customers build inside a tenant they administer themselves. Zenity sits exactly on the intersection.

What the company sold at founding wasn't AI agent security. It was low-code/no-code security. The original problem was business users spinning up apps and automations on platforms like Microsoft Power Platform and Salesforce, wiring them into company data, and doing all of it outside IT's field of view — shadow IT's latest incarnation. The September 2023 Series A announcement, a $16.5 million round led by Intel Capital with Vertex Ventures and UpWest participating, is titled exactly that way: enhancing low-code/no-code security.

That starting point turned into extraordinary luck. By the time the $38 million Series B closed on October 29, 2024, the company had already repositioned around agentic AI security. Third Point Ventures and DTCP co-led, and Microsoft's venture arm M12 came in as a strategic investor, taking total funding past $55 million. The numbers Zenity published with that round read like a forecast in hindsight: the average large enterprise has roughly 80,000 AI agents, apps and automations built on low-code platforms, and more than 62% of them contain security vulnerabilities. The moment building a working business agent in Copilot Studio became about as hard as writing an Excel macro, a low-code governance company automatically became an agent governance company.

The current shape of the business, in numbers: more than 230 employees worldwide, about 150 of them in Israel. R&D is centered in Tel Aviv; go-to-market runs out of New York. Revenue tripled in each of the past two years and the company says it's on track to triple again this year. CTech reported that translates to "tens of millions of dollars" in annual revenue. Two consecutive triples means the base two years ago was in the low millions — impressive as a slope, but not yet a number that goes head-to-head with a large platform vendor on absolute scale.

The customer mix is the real asset. A majority of customers are Fortune 500 and Global 2000 organizations, spread across financial services, healthcare, pharmaceuticals, technology, energy and manufacturing. The most notable disclosed name is SoftBank Corp. Tadashi Iida, its Senior Vice President, CISO and CRO, said in the release that "Zenity enables us to confidently deploy AI agents across the enterprise, giving us the visibility and governance required to support innovation at scale." A customer becoming an investor is the strongest reference format that exists in enterprise security, because the company that signed the contract also wrote a check against it.

There's one more asset that doesn't show up in revenue: the research arm, Zenity Labs. We'll come back to it, because it's doing double duty as the company's marketing engine and its competitive argument.

What the platform actually does: block it before it runs

To understand Zenity's technical claim, you need the three phases this market has passed through. Kliger's framing to Fortune is precise: "We've seen several waves of AI security over the last decade, starting with models and securing prompts. But putting the agent at the center of security is unique."

Phase one was the model layer — training data poisoning, model theft, adversarial inputs. Phase two was the prompt layer, which is really data loss prevention with a new coat of paint: stop the employee from pasting the customer list into a chat window. The company that sold phase two most directly was Prompt Security, and it got acquired by SentinelOne for $250 million.

Phase three is now, and it's a different problem. Agents don't attach to a chat box; they attach to systems. They read mail, query the CRM, open tickets, approve payments, ship code. So the question isn't "how do I filter a bad sentence." It's: how do you catch a properly authorized agent that received a manipulated instruction and is now calling legitimate APIs in legitimate ways toward an illegitimate outcome? When every individual action is within policy but the sequence is the attack, conventional tooling raises no alert at all.

Zenity's answer is intent. The platform first analyzes how agents are embedded in the organization, which enterprise systems they interact with, and what business purpose they were built to serve. Then it watches actual runtime behavior continuously and checks whether those actions stay aligned with corporate policy and permissions. Norwest describes the architecture as continuous discovery, governance enforcement and step-level runtime detection, all tied together by intent — correlating an agent's configuration against what it actually does at runtime.

The word the company leans hardest on is "deterministically." The platform, per the release, allows, modifies or blocks actions before they execute, distinguishing legitimate operations from manipulated or compromised behavior. That word choice is positioning, not copywriting. The common approach in this category is to have an LLM judge another LLM's behavior — which makes the judge itself susceptible to prompt injection and makes false positives and negatives probabilistic. "Our guardrails are usually right" does not sell to a bank CISO. Zenity is saying it moves the policy enforcement point outside the probabilistic model.

Here's the declared coverage surface.

Layer What Zenity says it covers
SaaS-embedded agents Microsoft Copilot, ChatGPT Enterprise, Gemini, Claude, Salesforce Agentforce
Developer tooling Coding agents including Codex
Custom-built agents Systems built on AWS Bedrock and Google Vertex AI
Execution locations SaaS, endpoint (local devices), cloud
Functional pipeline Continuous discovery → governance enforcement → step-level runtime detection

Vendor neutrality is the load-bearing item in that table, because it mirrors what large enterprises actually look like. No company runs one vendor's agents. Marketing is on ChatGPT, engineering is on Claude, the document estate is locked into Copilot, and the data team stood up custom agents on Bedrock. A CISO trying to govern those four from four separate vendor consoles is governing nothing.

Now the funding history, laid out in sequence.

Date Round Amount Lead Cumulative
2021 Founded (Tel Aviv) — — —
September 2023 Series A $16.5M Intel Capital —
October 29, 2024 Series B $38M Third Point Ventures & DTCP (M12 participating) $55M+
August 3, 2026 Series C $125M Norwest ~$185M

CTech reported the round is mostly primary capital with roughly a $10 million secondary component. Valuation was not disclosed. Kliger would only say an IPO is "under consideration," while describing the moment as "one of those rare opportunities in the cybersecurity world to build a massive company." Stack those three facts — small secondary, undisclosed valuation, IPO on the record — and the plan clearly isn't a near-term sale.

Who actually gets paid in this deal

What Zenity buys with $125 million is time. The scarcest resource in this category right now isn't technology, it's sales coverage. The company named three uses of funds: accelerate product innovation, expand research capabilities, and strengthen presence in Europe and Asia-Pacific. That third one lines up exactly with the new cap table. SoftBank and Hitachi are Japan; LG is Korea. Fortune reported the company sees agent adoption accelerating in Japan, Korea, Singapore and Australia. Large Asian enterprise accounts are notoriously hard to open without local references and warm introductions, and Zenity just bought the introductions along with the capital.

What Norwest buys is an option on the category leader. Partner Assaf Harel's thesis post carries two numbers worth writing down. One: the agentic AI security market growing from $1.65 billion in 2026 to $13.5 billion by 2032, a 42% compound annual rate. Two: per Gartner's 2026 CIO and Technology Executive Survey, only 17% of organizations have deployed AI agents, while more than 60% expect to within two years. Which means roughly two-thirds of the market hasn't bought yet. In security software that window tends toward winner-take-most, because whichever vendor is standard at the moment of adoption collects five years of renewals.

Harel also cited customer outcomes that support the pitch: one Fortune 500 organization remediated "90% of vulnerabilities with two FTEs," and another "cut risk 80% across 150,000+ resources" while agent volume grew 180%. Those are vendor-supplied figures, so don't take the magnitudes literally. Take the shape instead — absorbing agent growth without adding headcount is the single most budget-approvable sentence a security vendor can hand a CISO.

What SoftBank, Hitachi and LG buy is supply security plus a learning seat. All three run groups with hundreds of thousands of employees across hundreds of subsidiaries, and all three have enterprise-wide AI programs in flight. For a CISO in that seat, being the person who blocked agent adoption is a career risk; being the person who let it happen under control is the goal. Equity buys early access and roadmap influence. And if you need Japanese or Korean regulatory requirements — cross-border data transfer rules, audit log retention, internal control documentation — reflected in a product, being an investor-plus-customer beats being a customer.

What existing backers get is a markup and partial liquidity. Intel Capital, Vertex, Third Point and DTCP put money in at $16.5 million and $38 million valuations, and the roughly $10 million secondary opened a real cash path for some holders. One name is conspicuously absent, though: M12, Microsoft's venture arm, which came into the Series B as a strategic investor, is not listed among either the new or returning investors in this announcement. Whether it retained its position isn't disclosed and can't be verified. Worth noting only because Zenity's own research team has repeatedly published vulnerabilities in Microsoft's agent products — a relationship with some built-in friction.

Which brings us to the most underrated asset in the deal. At Black Hat USA 2025, Bargury and threat researcher Tamir Ishay Sharbat presented "AI Enterprise Compromise: 0Click Exploit Methods," disclosing a family of zero-click exploit chains branded AgentFlayer. They demonstrated working attacks against OpenAI's ChatGPT, Microsoft Copilot Studio, Microsoft 365 Copilot, Salesforce Einstein, Google Gemini, and Cursor connected to a Jira MCP server. No user click required: with nothing but a target's email address, an attacker could hijack enterprise AI agents to exfiltrate data, impersonate users, manipulate workflows and move laterally across systems. OpenAI and Microsoft Copilot Studio shipped patches after responsible disclosure. Several vendors declined to fix anything, calling the behavior intended functionality. That last sentence is Zenity's entire sales pitch, because risk a platform vendor won't fix is risk the customer has to cover alone.

This market has already been sold twice — the $250M and $350M lessons

We have real data on how AI security startups end, and the answer so far is mostly acquisition.

Case one is Prompt Security. SentinelOne acquired the two-year-old Israeli startup in a cash-and-stock deal valued at $250 million. Prompt's platform monitored every interaction between enterprise systems and generative AI tools — employee browsers, coding assistants, in-house GenAI integrations — inspecting each prompt and response to catch sensitive data exposure, block harmful content and defend against GenAI-specific attacks. Two years old, modest capital raised, $250 million exit. That single transaction set the market's reference price.

Case two is Aim Security. Cato Networks, the Israeli SASE unicorn, made Aim its first-ever acquisition; CTech reported the price at roughly $350 million. Aim covered the AI development lifecycle end to end, from training ML models to building custom agents, spanning employee use of public AI apps, private AI apps and agents, and the agentic development lifecycle itself. Cato said it will fold Aim's capabilities into the Cato SASE Cloud Platform in early 2026 and offer migration to standalone Aim customers. The motive is the tell: Cato didn't treat AI security as a new business line so much as an existential patch — a SASE platform that can't inspect AI traffic puts its existing contracts at risk.

CTech also reported that right after the Prompt deal, acquisition offers clustered around Lasso Security, Aim and Pillar Security, with Check Point, Zscaler and F5 named among suitors. Aim subsequently sold. So the pattern is established: two-to-three-year-old companies in this space get absorbed into large platforms for a few hundred million dollars.

That's what makes Zenity's $125 million more than a financing event. It's a declaration that the company isn't for sale at that price. A five-year-old company taking cumulative funding to $185 million and choosing independence only pencils out if the target exit is at least double what Prompt and Aim fetched. There's a successful precedent: Wiz turned down acquisition offers in cloud security, kept raising larger rounds, and ultimately agreed to a roughly $32 billion deal with Google. There's also a failure precedent, and it's the one that should worry Zenity's board. Cloud access security brokers — CASB — looked like an independent category for a few years, then got absorbed as a feature of SASE platforms, and the companies that held out longest sold on the worst terms.

One variable decides which path this is: how far Microsoft, Google and OpenAI go in shipping agent security and governance as built-in features. Zenity's defense is the vendor-neutrality argument above. Microsoft can secure Copilot, but it has no incentive to govern Claude and Bedrock agents under the same policy engine. If that argument still holds in five years, this is the Wiz path. If it collapses, it's CASB.

Competitors already have their wallets open

The ground Zenity is standing on is crowded — arguably the most crowded square in 2026 cybersecurity.

The most direct rival is Noma Security, which raised a $100 million Series B led by Evolution Equity Partners, bringing total funding to $132 million. The product overlaps almost feature for feature: agent discovery, posture management, red teaming, runtime protection. Noma has reported 1,300% annual recurring revenue growth, which sounds more aggressive than Zenity's tripling until you account for the smaller base that multiple comes off. The real differentiation is narrative: Noma leads with the full AI development pipeline, Zenity leads with the runtime behavior of agents already deployed.

The second axis is platforms that bought their way in. SentinelOne swallowed Prompt; Cato swallowed Aim. Their counterplay isn't feature competition, it's bundling — telling an existing EDR or SASE customer they can get agent security in the same console with no new vendor review. Onboarding a net-new vendor at a large enterprise takes three to nine months of procurement, security review and legal, and removing that friction covers a lot of feature gap. That's the wall Zenity has to get through on every deal.

The third axis is the incumbent giants. Palo Alto Networks, CrowdStrike and Microsoft Security have all announced AI security lines. Microsoft is structurally advantaged in the obvious way: the company that builds Copilot can sell Copilot's audit trail and data boundary. Zenity's rebuttal is the multi-vendor reality, and Zenity Labs' history of publicly demonstrating zero-click exploits in Copilot Studio functions as live ammunition in that argument. The company manufactured its own counterexample to "the platform vendor's built-in controls are enough."

The fourth axis is the one people miss: the identity vendors. Okta and CyberArk are approaching the same problem under labels like agent identity and machine identity. Their logic is reasonable — an agent is ultimately a principal holding credentials, so extend the system that already governs human accounts. That framing is familiar to CISOs, which is a real advantage, but it doesn't answer what sequence of actions an agent executed and toward what intent. Identity tells you who came in; it doesn't tell you what they did once inside. The two approaches will eventually collide, and in that collision the vendor with the bundle usually wins the pricing conversation.

The quietest competitor is inaction. Gartner forecasts information security spending reaching $244.2 billion in 2026, up 13.3%. Analysis of the same data found enterprises spending roughly 17 times more on AI tools than on securing AI itself, with agentic AI adoption outpacing governance by about eight to one. That's a bullish TAM statement and a warning in the same breath: the budget line often doesn't exist yet. New-category security vendors lose more deals to "let's revisit next fiscal year" than to any named rival.

So what actually changes

For enterprise security teams, the practical value of this news isn't one more vendor on the shortlist. It's ammunition for a budget review. The Gartner figures Norwest cited — 17% deployed today, 60%-plus planning within two years — and the finding that AI tool spend outpaces AI security spend 17 to 1 are both directly quotable in an internal memo. The concrete task, though, comes before vendor evaluation: build the inventory. Count how many Copilot, ChatGPT Enterprise, Claude and homegrown agents are running inside your org, and enumerate what systems each one touches with what permissions. Even if you discount Zenity's Series B claim of 80,000 low-code artifacts per large enterprise with 62% carrying vulnerabilities as vendor marketing, counting your own number settles whether it's exaggerated in about a week.

For developers building agents, the change is the arrival of an external policy layer. Until now, agent safety has mostly meant writing "don't do that" into a system prompt. As products like Zenity's spread, a policy engine sits above the agent and every tool call gets an allow, modify or block decision before it executes. That's more friction, but it's also the thing that gets agents into production. A lot of agent projects today stall at the demo stage not because the technology fails but because they can't clear security review.

For investors, two things are worth tracking. First, the undisclosed valuation. Companies usually stay quiet about a mark on a $125 million round for one of two reasons: the multiple is high enough that they'd rather not paint a target, or it's below what the market assumes and they'd rather not discuss it. Tens of millions in revenue growing 3x would put standard 2026 cybersecurity multiples somewhere near unicorn territory, but that's an inference, not a disclosure. Second, the exit path. With Prompt at $250 million and Aim at roughly $350 million as observed comparables, staying independent requires Zenity to demonstrate a revenue trajectory justifying more than double that within the next 18 to 24 months. Kliger putting an IPO on the record is both a statement of confidence and a negotiating position for any acquisition conversation that follows.

For everyday users, the direct effect is close to zero — with one indirect consequence. The AI tools you use at work are more likely to start telling you no. Researchers have already demonstrated that a single calendar invitation can compromise a browser agent, and OpenAI has disclosed a model breaking out of its sandbox into a third party's production servers. Changes that reduce convenience usually arrive right after incident logs like those.

The core of this round, then, is timing rather than size. Zenity started in low-code governance and happened to be standing in exactly the right spot when agents exploded; its own research team proved the problem exists by breaking six major vendors' agents on a Black Hat stage; and it recruited three Asian conglomerates as investors within weeks of the first real autonomous-agent incidents going public. One question is left: is agent security a durable standalone category, or a checkbox inside a larger platform? The $125 million is a bet on the former.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? If you don't use AI tools at work, nothing directly. If your company has Copilot or ChatGPT Enterprise deployed, expect policy to drift toward more audit logging and more approval steps. This round is mainly a signal that money has started flowing behind that shift.

— Why is this happening now? In July, OpenAI disclosed that an experimental model escaped its sandbox and broke into Hugging Face's production servers; in early August, Anthropic and Meta disclosed similar incidents. Meanwhile Gartner's survey found only 17% of organizations have deployed AI agents while more than 60% plan to within two years. The incident logs and the adoption curve landed on top of each other.

— Is Zenity actually ahead of its competitors? On capital, yes. Cumulative funding of about $185 million exceeds Noma Security's $132 million, and no rival has SoftBank, Hitachi and LG as distribution channels into Asia. But revenue is still reported only as "tens of millions," and the bundling push from platforms that already bought their way in — SentinelOne with Prompt, Cato with Aim — is just starting. Calling the category leader now would be premature.

Sources

Numbers and criteria are as of announcement and may change. Investment calls are yours to make!