Cymphony AI Agent Security Gets Sequoia’s Backing, but the Platform Test Comes Next

Cymphony has raised $30 million as Sequoia Capital doubles down on a security problem created by AI agents with expanding access to corporate data. The Cymphony AI agent security platform promises one view of employees, agents, machine accounts, systems, and sensitive information.

That total includes a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund. The investment values the New York and Tel Aviv startup at more than $100 million after the round, according to the reported funding details.

The money matters, but the larger bet matters more. Cymphony must prove that securing autonomous software is a distinct enterprise category. It cannot remain another feature inside identity, data protection, or cloud security platforms.

Microsoft, Okta, CyberArk, Wiz, and Varonis already occupy parts of that territory. Other startups are building controls for agents, model context protocol servers, and nonhuman identities. Cymphony is entering a contest over who owns the security context surrounding an AI worker.

The startup’s answer is a “workforce graph,” which connects identity, data, permissions, and activity in one model. The concept addresses a practical gap. A company might know an agent exists and separately know that a file is sensitive, yet still miss the path connecting them.

That visibility becomes more important when agents inherit access from people, applications, and service accounts. Unlike an employee with a defined job, an agent can follow changing routes, use additional tools, and act at machine speed.

Sequoia believes that difference creates a new platform opportunity. The unresolved question is whether enterprise buyers agree, or whether incumbent vendors absorb the same functions into products they already sell.

Cymphony Emerges With $30 Million and a Specific Security Bet

Cymphony is not selling another inventory of AI tools. It is selling a map of what every human and nonhuman identity can actually reach.

The company formally launched on September 9, 2026, with $30 million in total funding. Its Series A accounts for $25 million, following a previously undisclosed seed investment led by Sequoia more than two years earlier.

Sequoia and SMBC Fin Atlas Beyond Fund co-led the new round. The financing gives Cymphony a post-investment valuation above $100 million.

Co-founders Shy Dekel, Idan Berkovits, and Edi Gotlieb built the company across New York and Tel Aviv. All three previously attended Talpiot, an Israeli military program focused on technology and leadership.

Cymphony now employs about 30 people. Most customers are in North America, although the company says demand is beginning to appear across Europe, the Middle East, and Africa.

The startup told TechCrunch that it signed a double-digit number of enterprise customers during its first year of sales. It also reported reaching seven figures in annual recurring revenue during that period.

Named customers include KKR, Syngenta, Cass Information Systems, and Athennian. Sequoia has also used the product internally since its early development.

Those figures come from Cymphony and have not received independent financial verification. Still, they help explain why Sequoia moved from a founder-led seed bet to a product and customer-led Series A.

Cymphony’s platform continuously maps employees, AI agents, service identities, applications, data stores, and access relationships. It then combines those relationships with observed activity and the sensitivity of available data.

The resulting workforce graph is intended to answer several questions at once. Security teams can examine who or what has access, which path grants that access, and whether the behavior creates an actionable risk.

Cymphony also uses agents inside its own product. These agents investigate findings, prioritize remediation, coordinate with relevant employees, and correct some permissions automatically.

Customers can use the software largely on their own. They can also select a managed service that involves Cymphony’s security specialists in more complex cases.

The company’s launch statement frames the problem as a shift from identifying exposures to completing security work. That distinction is central to its pitch.

Many security products generate alerts without resolving the underlying access path. Cymphony says its system can connect the risky identity, exposed information, observed action, and remediation workflow.

The launch therefore creates the article’s central tension. Enterprises clearly need better control over agent access, but need alone does not establish a standalone market.

Why Cymphony AI Agent Security Combines Identity and Data

An identity record cannot measure agent risk without data context, while a data label cannot reveal which agent can exploit an access path.

Traditional enterprise security divides those questions across different product categories. Identity systems manage accounts, authentication, roles, and permissions. Data security products classify information, monitor movement, and identify inappropriate exposure.

That separation was manageable when people performed most business activity. Employees had relatively stable roles, predictable work schedules, and recognizable access patterns.

AI agents weaken those assumptions. An agent can act for an employee, application, department, or automated process. Its effective permissions can come from several of those sources simultaneously.

An agent may also use OAuth grants, application programming interfaces, browser sessions, connectors, and inherited file permissions. Each route can appear legitimate when inspected separately.

The risk emerges from their combination. An approved agent might inherit an employee’s access to documents that were overshared years earlier. It can then search those documents faster than the employee ever could.

Cymphony’s workforce graph attempts to reconstruct that combined context. It connects the actor, delegated identity, reachable system, sensitive data, and resulting activity.

This does not replace authentication. It adds a layer that explains what authenticated identities can do across systems that maintain separate records.

Consider an employee who connects an AI assistant to SharePoint. The employee has valid credentials, while the assistant receives a valid authorization grant. SharePoint also contains files with permissive access inherited from an old project.

No individual component necessarily appears broken. The security failure lies in how the components interact.

Cymphony says it found roughly 85,000 files accessible to AI tools and agents at one publicly traded U.S. company. The startup says it helped close the exposure and verified that those systems had not accessed the files.

The customer was not identified, so outsiders cannot independently evaluate the investigation. The example remains useful because it illustrates the product’s intended unit of analysis: an exploitable access path, not an isolated alert.

In another case, an external collaborator reportedly installed an unsanctioned instance of Anthropic’s Claude. The instance used the collaborator’s existing access to scan thousands of sensitive files.

That scenario is harder than blocking an unapproved application. The collaborator already possessed legitimate access, while the AI system greatly increased the scale of possible discovery.

Cymphony has also described a customer where connecting ChatGPT to SharePoint exposed sensitive litigation documents to interns. The underlying cause was reportedly an accidental permission mistake.

These examples point to the same mechanism. AI does not need to defeat an access control when an existing permission already opens the door.

The Cymphony AI agent security thesis is that enterprises need continuous correlation across identity, data, and behavior. Occasional permission reviews cannot match agents that change tasks or capabilities during operation.

Sequoia makes the same argument in its investment thesis. It says identity and data security are no longer separable once autonomous systems begin acting for employees.

That position is plausible, but it remains an investor’s argument. Cymphony must show that its graph stays accurate across changing applications, connectors, accounts, and permission models.

A missing integration can hide an access path. Stale data can make a remediated problem appear active, or make a new exposure appear safe.

The graph is therefore not valuable simply because it gathers more information. Its value depends on whether it reconstructs current, meaningful relationships better than existing security systems.

AI Agents Turn Old Permission Mistakes Into Active Risks

AI agents make familiar access-control failures more consequential because they can search, combine, and act on exposed information without human browsing limits.

Overshared files, forgotten administrator accounts, and excessive application permissions are not new. Security teams have spent years managing those problems through identity governance, data loss prevention, and cloud access tools.

Agents change the operating conditions around those weaknesses. They can inspect more systems, execute more steps, and repeat tasks continuously.

An employee might never discover a sensitive folder buried inside a document repository. An AI assistant designed to gather information can find it during a routine request.

An employee might notice that a requested action seems unusual. An agent can proceed because its workflow interprets valid access as sufficient authorization.

This is where capability and risk become tightly linked. The features that make an agent valuable also expand the consequences of an incorrect permission.

Agents can call tools, retrieve documents, update records, write code, and trigger business processes. Each capability introduces another path between identity and corporate data.

Delegation creates another complication. An agent may act under an employee’s account, a shared service identity, or its own machine credential. Audit records can obscure which human request produced the final action.

Some systems also let agents invoke additional agents or acquire tools during a task. The resulting chain can cross several security boundaries before reaching a final resource.

A conventional role-based model assumes that administrators can define a stable set of permissions for a stable role. Agent behavior can shift according to prompts, context, available tools, and intermediate results.

That does not mean every agent acts unpredictably. It means permission alone provides an incomplete description of its effective risk.

Security teams also face a speed mismatch. A human reviewer might take hours to investigate an unusual access pattern. An automated system can process thousands of records during the same period.

Cymphony wants to close that gap with automated investigation and remediation. The company says its agents can trace access, rank exposures, and help correct permissions.

That design introduces a meaningful tradeoff. Enterprises might use one group of agents to control another group, gaining speed while creating a new privileged automation layer.

A remediation agent needs permission to modify accounts or access policies. Errors inside that system could interrupt legitimate work or remove access from critical services.

Organizations will therefore need approval boundaries, rollback procedures, and clear audit records. Automated remediation should remain explainable to the people responsible for each affected system.

This challenge fits the broader AI risk framework developed by the U.S. National Institute of Standards and Technology. Effective controls require ongoing measurement and management, not a single deployment decision.

For enterprise buyers, the immediate pressure falls on chief information security officers and identity teams. Business units want agents connected to useful internal data, while security teams remain accountable for the consequences.

Rejecting every connection slows adoption. Approving connections without context creates an exposure that existing dashboards may not reveal.

Cymphony’s pitch positions security as the mechanism that lets businesses deploy more agents. That framing is commercially attractive because it links control spending with AI adoption.

The harder question is whether Cymphony can consistently distinguish useful agent activity from harmful reach. An access path can be broad without being inappropriate, depending on the task and business context.

Customer-specific context matters. A financial analyst, legal contractor, software agent, and support assistant can touch similar systems for very different reasons.

Accurate risk scoring requires more than technical connectivity. It also requires reliable information about ownership, purpose, sensitivity, and expected behavior.

The company’s graph approach gives it a coherent way to combine those signals. Enterprise deployment will determine whether the graph contains enough context to support real decisions.

The Market Is Already Crowded Around the Same Control Point

Cymphony is racing to define a category while established vendors and other startups expand toward the same identity, data, and agent-security boundary.

Microsoft already controls identity, productivity, cloud, and security products inside many large companies. That distribution gives it several places to add agent-specific access monitoring.

Okta and CyberArk have deep positions in identity and privileged access. Wiz connects cloud resources, configurations, identities, and data through a security graph.

Varonis specializes in data access and exposure. Each company approaches the problem from a different installed base, but none needs to start from zero.

Cymphony argues that these categories leave gaps because they treat identities and sensitive information separately. Its platform aims to make their relationship the central object.

An incumbent can answer differently. A large vendor can add agent identities, behavioral signals, and data context to a platform that customers already operate.

That response would make procurement easier. Enterprises prefer avoiding another console, integration project, security review, and contract when an existing supplier offers adequate coverage.

Cymphony therefore needs more than a better visualization. It must find risks that incumbents miss, produce fewer low-value alerts, and shorten the path from detection to remediation.

The startup also faces emerging specialists. Astrix Security has focused on nonhuman identities and connections between applications. Operant AI has built runtime controls for agents and model context protocol traffic.

AIR has raised funding to help enterprises assess the skills and add-ons used by agents. Its approach treats agent components as a software supply chain that needs continuous verification.

The recent AIR financing shows that investors are backing several control points around agent deployment. The market has not settled on one architecture.

Some companies will prioritize runtime enforcement. Others will focus on identity lifecycle management, tool approval, data access, agent discovery, or auditability.

Cymphony is betting that a unified context graph can connect those concerns. It can then become the layer where security teams assess risk and coordinate action.

Sequoia partner Bogomil Balkansky describes Cymphony as complementary to major identity products today. He told TechCrunch that customers are not likely to remove Okta simply because they deploy Cymphony.

That admission clarifies the company’s current position. Cymphony is primarily an additional control layer, even when it consolidates selected point products.

Dekel says the platform has already replaced some tools at customers. At one unnamed enterprise, Cymphony reportedly consolidated two products and avoided the purchase of a third.

The claim lacks enough detail to compare coverage, implementation cost, or operating results. It nevertheless establishes the expansion path management wants investors and customers to consider.

Cymphony can begin as visibility for AI access. It can then move into identity hygiene, data exposure management, automated remediation, and selected data loss prevention functions.

That path also increases competitive pressure. Every adjacent function places the startup closer to a well-funded vendor with existing integrations and account relationships.

The central contest is not Cymphony against one named company. It is a standalone context layer against security suites that absorb agent controls.

Cymphony wins that contest if agent behavior creates relationships that suite vendors cannot model accurately. It loses if buyers accept agent support as another checkbox inside existing platforms.

The next stage will depend on deployment evidence. Customer expansion, measurable risk reduction, and replacement of existing spending matter more than the number of discovered identities.

A crowded market does not invalidate the need. It raises the standard for proving that the need supports an independent company.

Sequoia’s Second Investment Raises the Burden of Proof

Sequoia’s renewed backing validates Cymphony’s progress, but investor conviction cannot establish product accuracy or a durable enterprise category.

The venture firm led Cymphony’s seed round before the startup had a product or settled direction. Balkansky said the original decision rested heavily on the founders.

By the Series A, Sequoia had more evidence. Cymphony had built software, signed enterprise customers, generated recurring revenue, and expanded usage inside existing accounts.

Sequoia also became a customer. That gives the investor direct product experience, although it does not replace independent evaluation across larger and more complex environments.

The relationship creates a useful contrast. The seed investment was primarily a team bet, while the Series A reflects early commercial execution.

It also raises expectations. A valuation above $100 million assumes that Cymphony can grow beyond a small group of design partners and early adopters.

Large enterprises introduce difficult integration conditions. They operate multiple identity providers, acquired business units, legacy directories, custom applications, and regional data controls.

Their access records can contain duplicate identities, abandoned accounts, nested groups, and conflicting ownership data. Building a reliable graph across that environment requires persistent reconciliation.

Agent discovery creates another challenge. Sanctioned agents may live inside approved platforms, while unsanctioned systems arrive through browser tools, contractor accounts, and individual application connections.

Visibility will never be perfect. Cymphony must show that incomplete coverage still produces decisions that improve security.

False positives can undermine that goal. Security teams already manage large alert volumes, and another stream of theoretical access paths can become background noise.

False negatives create the opposite problem. A platform that claims unified visibility can produce misplaced confidence if important systems remain outside its integrations.

Automated remediation increases both stakes. Removing inappropriate access quickly can reduce exposure, but an incorrect change can disrupt a business process.

The company must therefore prove several things independently. It needs accurate identity matching, current data classification, meaningful behavioral context, and safe remediation controls.

It also needs evidence that customers keep using the product after the initial AI security project. Expansion among current customers is encouraging, but retention over several renewal cycles will provide a stronger test.

Cymphony’s public examples remain company-reported case studies. The unnamed organizations and limited technical detail make independent assessment difficult.

That limitation is normal for an early security company protecting customer confidentiality. Buyers should still ask for architecture reviews, reference calls, scoped trials, and measurable success criteria.

A useful evaluation would compare discovered exposures against existing tools. It would also measure investigation time, confirmed risk reduction, remediation accuracy, and application coverage.

The Cymphony AI agent security approach should not receive a lower evidence standard because agents are new. The novelty of the threat increases the need for careful validation.

Sequoia’s involvement helps Cymphony recruit, integrate, and enter enterprise accounts. It does not settle whether the startup becomes a system of record or a temporary overlay.

The company’s strongest argument is operational. Identity and data tools often leave security analysts responsible for reconstructing context across separate systems.

If Cymphony reliably completes that reconstruction and coordinates remediation, it can own a valuable workflow. If it primarily aggregates signals, incumbents can reproduce much of the experience.

That is the real burden created by the new financing. Cymphony must turn an intuitive security concern into repeatable, defensible customer results.

Three Signals Will Show Whether Cymphony Becomes a Platform

Customer expansion, incumbent responses, and independently demonstrated risk reduction will determine whether Cymphony owns a category or supplies a temporary feature.

The first signal is expansion inside named enterprise customers. Cymphony has reported a double-digit customer count and seven figures of annual recurring revenue during its first sales year.

Those are credible early-stage milestones, but they reveal little about deployment depth. The more important question is whether customers connect additional systems, identities, data stores, and agent platforms.

Broader deployments would strengthen Cymphony’s graph. They would also indicate that customers trust the platform with privileged visibility and remediation workflows.

Renewals will matter as contracts mature. Continued expansion would support the claim that agent access requires a persistent control layer, not a one-time security assessment.

The second signal is how incumbent vendors respond. Microsoft, Okta, CyberArk, Wiz, and Varonis all have plausible routes into this market.

New agent-specific identity objects, cross-platform access graphs, or automated remediation features would validate the problem while increasing competitive pressure.

If buyers receive sufficient controls through existing contracts, Cymphony’s standalone position weakens. If those controls remain fragmented, its unified model becomes more attractive.

Acquisitions would provide another clue. Larger vendors might buy specialists to accelerate capabilities, while customers could delay purchasing decisions during consolidation.

The third signal is independently verifiable security performance. Cymphony’s reported discoveries illustrate potential value, but the market needs repeatable evidence.

Buyers should look for documented reductions in excessive access, investigation time, unresolved findings, and exposure duration. They should also examine false positives and remediation reversals.

Coverage deserves equal attention. A graph that maps only selected applications cannot support a complete view, regardless of how clearly it presents connected data.

Cymphony must also show how it handles rapidly changing agents. An identity can acquire a new tool, receive delegated authority, or operate through a different employee context.

Continuous re-evaluation is essential because a safe authorization can become risky after another permission, application, or data source changes.

The company’s product direction matches a genuine enterprise problem. Organizations are granting software more authority while their existing controls remain organized around people and separate technology categories.

Yet a genuine problem does not guarantee one winning product model. Runtime gateways, identity platforms, data security tools, and context graphs can all capture part of the budget.

For security leaders, the practical response is to test access paths rather than accept category claims. Start with agents connected to sensitive repositories and business systems.

Identify which human identity authorizes each agent. Trace every delegated credential, reachable dataset, available tool, and action the agent can execute.

Then determine whether existing products can join those facts into one useful investigation. That gap, if it persists, defines the opportunity Cymphony wants to own.

For developers and knowledge workers, the issue is equally direct. An agent’s usefulness depends on context, but every additional source expands what the agent can expose or misuse.

Teams should treat agent access as delegated authority, not as a convenient integration setting. Owners need to understand what an agent can reach before relying on what it produces.

The next few months will show whether Cymphony converts its launch momentum into deeper production use. Customer expansion would strengthen Sequoia’s platform thesis.

Bundled incumbent features would weaken the standalone case. Independent evidence of faster, safer remediation would offer the clearest support for Cymphony AI agent security.

The question for enterprise buyers is no longer whether AI agents need controls. It is whether Cymphony can become the trusted map connecting every agent, identity, system, and sensitive file.