Onyx Security Raises $113M to Test Enterprise AI Governance

Onyx Security raised a $113 million Series B, putting its enterprise AI governance pitch across Google News while creating a much harder test. The company must now prove that software can supervise autonomous agents without becoming another source of errors, delays, or unchecked authority.

Bessemer Venture Partners led the round, with Cyberstarts, TCV, Conviction, FirstMark, Vintage, QuantumLight, and G Squared participating. The financing brings Onyx Security’s reported total funding to $153 million since its 2024 founding.

The round is notable because Onyx emerged from stealth only four months before announcing it. The company says revenue quadrupled during that period, although it has not disclosed an audited figure or comparable customer-retention data. The central contest is now clear: runtime control platforms must outperform scattered permissions, logs, model safeguards, and manual approval processes.

The $113M Round Turns a Security Thesis Into an Execution Test

Onyx Security has received enough capital to test whether AI agent governance can become a distinct enterprise software category.

The company announced the financing on July 29, 2026, from New York and Tel Aviv. Its Series B announcement identified Bessemer as the lead investor and listed seven other participating firms.

Onyx says the money will support new proprietary models and a wider enterprise sales operation. That plan follows its March launch with $40 million in seed and Series A financing.

The timeline matters. Onyx was founded in 2024 by Maxim Bar Kogan and Gil Elbaz, then operated quietly for about 18 months. It entered the public market with more than 70 employees and claimed multiple Fortune 500 customers.

The new round arrived before the company had completed a typical public-market learning cycle. Buyers, researchers, and competitors have had only several months to examine the platform’s results.

That speed separates this story from a routine fundraising announcement. Onyx Security funding now represents a bet on an operating layer that remains early, technically difficult, and weakly standardized.

The company calls its product a secure AI control plane. A control plane is a central layer that inventories agents, applies policies, and coordinates how those agents interact with enterprise systems.

Onyx says its platform discovers third-party and internally built agents across an organization. It then monitors their reasoning and actions while applying rules during execution.

Those controls can reportedly block an action, narrow an agent’s permitted scope, require human approval, or redirect the agent. This intervention happens before a downstream application accepts the requested action.

That distinction is important. Conventional monitoring often records an event after software has already acted. Onyx is selling the ability to evaluate and alter an agent’s behavior while the workflow remains active.

The company’s launch material described a Guardian Agent that supervises other agents. Onyx says proprietary models help that supervisor interpret agent reasoning, context, and intended actions.

This architecture places an AI-based system between another AI agent and the enterprise resource it wants to use. That resource might be a code repository, financial system, customer database, or workplace application.

The approach promises more contextual control than a static access rule. However, it also introduces a second reasoning system whose judgments must be evaluated, secured, and audited.

Onyx says enterprises in banking, technology, insurance, and energy already use its platform. It has not publicly identified most customers, disclosed deployment sizes, or published independent performance results.

Revolut is a named customer in the financing announcement. Uros Solar, its head of security engineering, said Onyx provides visibility and runtime controls across several coding-agent providers.

That example gives the product a concrete setting. A company may permit coding agents from different vendors while using one external layer to observe their requests and stop selected actions.

The Series B therefore funds more than customer acquisition. It funds an attempt to establish runtime supervision as infrastructure that enterprises purchase separately from models and agent platforms.

Google News coverage can amplify the size and speed of the round. It cannot answer whether the control layer detects unsafe behavior reliably under production conditions.

That unanswered question now defines Onyx’s next phase.

Why AI Agent Governance Is Becoming a Runtime Problem

Enterprise AI governance is moving from written policies toward controls that must operate during every consequential agent action.

Earlier generative AI systems mostly returned text for a person to review. The principal concerns included inaccurate answers, confidential prompts, copyright exposure, and inappropriate generated content.

AI agents change that risk profile because they can invoke tools. An agent may read email, query internal data, edit code, open a support ticket, or update a customer record.

Tool access converts an unreliable answer into a possible operational event. The difference between suggesting a database command and executing it can determine whether an error remains theoretical.

An agent can also chain several acceptable actions into an unsafe result. Reading a file, summarizing its contents, and sending a message may each appear harmless when evaluated alone.

Combined in the wrong context, those steps can expose protected information. This makes identity, purpose, sequence, and destination relevant to every authorization decision.

Traditional identity and access management still matters. It can determine which systems an account may reach and which operations that account may perform.

Yet agents create ambiguity inside those permissions. A valid account may request an allowed action for an invalid purpose after processing a manipulated document or instruction.

Prompt injection illustrates the problem. It occurs when untrusted content supplies instructions that redirect a model away from the user’s intended task.

An ordinary application can treat a document as data. An agent may interpret parts of the same document as commands, particularly when the application does not maintain strong trust boundaries.

The OWASP threat guide identifies goal hijacking, tool misuse, identity abuse, and cascading failures among emerging agentic risks. These issues extend beyond model accuracy.

The risk also grows as agents operate longer workflows. A small mistake near the start can influence later tool selections, permissions, and outputs.

Onyx’s response is continuous observation and intervention. Instead of trusting the agent until an alert appears, the platform evaluates behavior throughout the workflow.

That model resembles runtime application protection, but agent reasoning adds uncertainty. A security platform must infer whether an action aligns with the user’s goal, organizational policy, and current context.

Static rules remain valuable for clear restrictions. A company can forbid an agent from sending financial records outside an approved domain or merging code without review.

Harder cases require contextual judgments. An agent might usually access customer data, yet a request becomes suspicious when it follows instructions embedded in an external support ticket.

Onyx says its proprietary models address those cases. The company has not published enough independent testing to establish their false-positive rates, false-negative rates, or resistance to adversarial manipulation.

Those metrics matter because intervention has operational costs. A control that blocks too little leaves dangerous behavior untouched. One that blocks too much prevents employees from receiving the productivity gains they expected.

Latency presents another tradeoff. Every additional evaluation can delay a workflow, especially when an agent takes many steps or invokes several tools.

The system must also preserve enough context to make accurate decisions. That context can include sensitive prompts, internal documents, user identities, tool outputs, and security policies.

Governance software consequently becomes part of the organization’s sensitive data path. Buyers must assess how the platform stores, processes, separates, and audits that information.

The NIST AI framework supports a lifecycle approach covering governance, measurement, management, and risk mapping. Runtime controls can support that approach, but they do not replace it.

Organizations still need clear ownership, testing practices, incident response, and limits on acceptable uses. They must also decide which actions require deterministic rules rather than model-based judgment.

This is why AI agent governance cannot be reduced to a dashboard. Inventory and reporting help teams understand deployment, but they do not stop an unsafe action at the moment of execution.

Onyx is betting that enterprises will pay for both functions in one platform. The financing suggests investors expect that requirement to become urgent as agents gain broader permissions.

The bet will succeed only if runtime governance remains effective without turning every agent workflow into a queue of security reviews.

Google News Attention Raises Pressure on Security Incumbents and Agent Platforms

The Onyx round pressures established security vendors and AI providers to explain who owns the control point between an agent and its tools.

Large cybersecurity vendors already protect identities, endpoints, cloud workloads, applications, and data. Many can extend existing products to detect AI usage or govern access to selected models.

AI platforms also provide native safeguards. Model providers can restrict tool calls, define permissions, create audit logs, and require confirmation before sensitive operations.

Cloud providers control another layer. They manage service identities, network policies, data boundaries, and the infrastructure supporting enterprise agents.

Onyx argues that none of these layers offers a complete, vendor-neutral view. Its platform is designed to observe agents from multiple providers alongside systems built by internal engineering teams.

That neutrality is strategically valuable if enterprises keep using several models. A buyer may deploy separate agents for software development, customer service, research, and financial operations.

Each agent provider can offer its own controls, but security leaders may not want isolated policy systems. They often need one inventory and one enforcement model across the organization.

Google News visibility gives Onyx a strong category narrative. It does not grant ownership of the category, especially when adjacent vendors already hold enterprise relationships and telemetry.

Established security companies can add agent controls to platforms that customers already operate. They may connect identity data, data-loss prevention rules, cloud activity, and endpoint signals without introducing another management console.

Startups focused on AI security can respond faster to new agent architectures. Their challenge is proving that their products remain necessary after incumbent platforms add comparable features.

Agent vendors face a different conflict. Native controls can understand their own systems deeply, but enterprises may hesitate to let a provider police itself.

A separate control layer promises independent enforcement. It can theoretically apply one policy even when teams switch models or connect new tools.

However, an external layer depends on integrations. Its coverage may weaken when providers change interfaces, encrypt internal reasoning, or expose limited execution data.

The debate is not simply Onyx versus one competitor. It is an architectural contest between consolidated runtime supervision and controls distributed across existing infrastructure.

Distributed controls offer proximity. Identity systems understand users, cloud platforms understand resources, and model providers understand their agents.

Central supervision offers coordination. It can connect signals across these domains and evaluate a workflow as one sequence rather than unrelated events.

Both models can fail. Distributed controls may leave policy gaps between products. A central platform may become a bottleneck or a high-value attack target.

The Onyx Security funding round gives the startup time to build integrations before incumbents settle their strategies. It can also expand sales teams while buyers are still defining requirements.

Its March launch showed how early that market remains. Onyx said it had integrations with AI and security systems, but did not publish a comprehensive compatibility map.

The July announcement said dozens of AI providers had been integrated. It also referenced a June integration with Anthropic, without providing detailed public measurements of protection outcomes.

Those relationships can improve distribution and technical reach. They do not establish that Onyx catches attacks or mistakes that native controls would miss.

The SecurityWeek coverage placed Onyx within a growing security market for enterprise agents. That framing is more useful than treating the round as a general AI funding event.

The competitive question concerns where enforcement belongs. Buyers must decide whether control should sit inside each agent, at the identity layer, near the protected application, or above the entire environment.

Enterprises may ultimately combine these positions. Native restrictions can constrain the agent, identity systems can limit credentials, and runtime supervision can evaluate context.

Layered security reduces dependence on one decision point. It also increases integration work and creates uncertainty about which system has final authority.

Onyx must therefore show more than detection accuracy. It needs predictable behavior when its decision conflicts with a cloud policy, application rule, or human approval.

Security teams will also expect clear evidence after an intervention. They must understand which policy applied, what context influenced the decision, and how an operator can challenge an incorrect block.

That demand connects governance with organizational memory. Teams need searchable records linking agent actions, approvals, policies, and incidents. A structured AI knowledge base can help preserve that evidence, although it is not an enforcement system.

The stronger Onyx’s category becomes, the more quickly larger vendors will package similar promises. Its advantage must come from deployment results, not category language alone.

Google News attention may introduce the company to more buyers. Enterprise renewals will determine whether its control plane becomes infrastructure or remains an additional security product.

What the Funding Numbers Do Not Prove

A large financing round validates investor demand, but it does not validate Onyx’s technical claims or customer outcomes.

Onyx says revenue quadrupled after it emerged from stealth. The percentage sounds substantial because the comparison begins from an undisclosed early base.

The company has not published annual recurring revenue, contract duration, renewal rates, or the portion of revenue tied to trials. It has also not disclosed how many agents each customer governs.

That missing context does not negate the growth claim. It limits what outside readers can infer from it.

The same caution applies to customer counts. Onyx says dozens of leading enterprises use its platform, including Fortune 500 companies across several critical industries.

A deployment can range from a limited evaluation to organization-wide enforcement. Those arrangements have different implications for product maturity, security exposure, and recurring revenue.

Independent technical evidence remains limited. Onyx has described what its models do, but public materials do not provide benchmark design, attack coverage, or comparative performance.

Runtime AI security is particularly difficult to evaluate. A test must represent realistic tools, permissions, workflows, attacks, and legitimate edge cases.

A platform can perform well on known prompt-injection examples yet fail when an attacker spreads instructions across several documents. It may also miss a harmful workflow composed of individually acceptable steps.

False positives create a different risk. Employees can bypass controls they perceive as noisy, while administrators may weaken policies to reduce interruptions.

Human approvals are not a complete answer. Reviewers can develop alert fatigue, approve requests without sufficient context, or trust an agent-generated explanation too readily.

The supervisory-agent design deserves similar scrutiny. Onyx says its system uses proprietary models to interpret and redirect other agents.

A supervising model can bring contextual reasoning to policy enforcement. It can also hallucinate, misunderstand intent, or become vulnerable to manipulated input.

Companies should ask whether critical blocks rely on deterministic rules, probabilistic judgments, or both. They should also understand how Onyx tests updates before deploying new supervisory models.

Change management matters because a model update can alter policy behavior. A request allowed yesterday might be blocked today even when the written rule remains unchanged.

Auditors will need version records connecting each decision to the model, policy, evidence, and integration state used at that moment.

Buyers should also examine failure modes. If the Onyx service becomes unavailable, agents might stop, continue without supervision, or enter a restricted mode.

Each option carries costs. Failing closed can interrupt important work, while failing open allows activity without the promised governance layer.

Data handling creates another question. Effective supervision may require access to prompts, intermediate outputs, tool arguments, user identities, and proprietary documents.

That access makes the control plane a concentrated security target. Enterprises need strong isolation, retention limits, encryption, access controls, and incident reporting.

Onyx’s geographic footprint adds operational complexity, with teams in Israel, the United States, and Canada. Customers in regulated sectors will evaluate data locations and subcontractor arrangements alongside technical performance.

Regulatory alignment should not be mistaken for compliance certification. Software can help collect evidence or apply policies, but accountability remains with the organization deploying the agent.

The NIST generative AI profile emphasizes governance, predeployment testing, content provenance, and incident disclosure. It treats risk management as a process rather than a product feature.

That distinction matters for marketing claims. An organization cannot purchase an AI control plane and assume every use case has become safe, lawful, or appropriate.

The CTech funding report reported a $640 million valuation. Onyx did not include that figure in the main financing release, so readers should treat it as reported deal context.

Valuation can shape expectations without improving the platform. Investors now expect Onyx to grow quickly while defending a category that large security vendors can enter.

Rapid expansion can strain a security company. It must hire sales and engineering teams without weakening review processes or rushing integrations.

The startup also needs to avoid overpromising. Its public language sometimes frames the control problem as a broad question of keeping humans in control of increasingly capable AI.

That framing attracts attention but exceeds what any single enterprise platform can guarantee. Control depends on system design, user behavior, credentials, policies, vendors, and organizational oversight.

The company’s narrower promise is more testable. It says it can discover agents, observe their behavior, enforce policy, and intervene before selected actions complete.

Enterprises should test those functions under their own conditions. Useful evaluations should include adversarial documents, compromised credentials, ambiguous requests, chained tools, outages, and policy conflicts.

Teams should compare results against existing controls rather than an unprotected baseline. That comparison reveals whether a new platform adds meaningful coverage or duplicates current capabilities.

They should also track time saved. A governance product creates limited value if it requires continuous manual review or produces investigations that teams cannot resolve.

Funding establishes that Onyx can pursue these tests at greater scale. It does not establish their outcome.

Three Signals Will Decide Whether the Onyx Bet Holds

The next stage depends on measurable deployments, defensible integrations, and evidence that runtime intervention improves security without blocking legitimate work.

The first signal is customer expansion beyond initial deployments. Onyx must show that enterprises move from narrow evaluations into production environments covering more agents, users, and critical tools.

Named reference customers will matter more than a broad count. Detailed examples should explain which workflows were governed, which actions were stopped, and how teams measured operational impact.

Renewals will provide another useful indicator. A customer that renews after experiencing real incidents and false alarms offers stronger evidence than one beginning a trial.

If Onyx reports broader deployments and sustained renewals, its control-plane thesis becomes stronger. Continued reliance on undisclosed customers would leave adoption depth uncertain.

The second signal is independent technical validation. Onyx needs testing that examines detection, intervention accuracy, latency, and resilience across several agent providers.

The most credible evidence would include realistic tool chains and publish enough methodology for security practitioners to evaluate the conclusions.

No benchmark can represent every enterprise. Reproducible evaluations would still make product claims easier to compare with native safeguards and competing security layers.

Validation should cover attacks against the supervisory system itself. Researchers need to know whether manipulated context can mislead the control layer or hide malicious intent.

Public incident handling will matter too. A security vendor earns trust by documenting failures, correcting them quickly, and explaining how customers should assess exposure.

If independent tests show that runtime controls stop attacks without excessive disruption, the Series B narrative gains technical support. Weak or opaque results would strengthen the case for narrower deterministic controls.

The third signal is the response from security incumbents and agent platforms. Native governance features can reduce the need for an independent product or change where Onyx delivers value.

Model providers might expose richer policy hooks and execution data. Cloud platforms could combine agent identity, tool permissions, network context, and monitoring within existing services.

Security vendors may add cross-provider agent inventories and runtime enforcement to products already deployed across large companies.

Onyx can benefit from those developments when providers publish useful interfaces. It can also lose leverage if a platform offers sufficient native control at a lower integration cost.

The company’s vendor-neutral position will become more valuable if enterprises remain committed to multi-model environments. It becomes less distinctive if buyers consolidate around one cloud and one agent platform.

This is the core tradeoff behind the Google News headlines. Centralized governance promises consistent oversight, but it must integrate with systems that already control identity, data, applications, and models.

Onyx has capital, early customers, experienced investors, and a clear problem to address. It also operates in a market where technical standards, buying responsibilities, and competitive boundaries remain unsettled.

For developers, the round signals that production agents will face more policy checks and audit requirements. Tool calls, identity context, approval states, and trace records should become first-class design concerns.

Enterprise buyers should define success before purchasing another security layer. They can measure prevented actions, false blocks, review time, workflow latency, integration coverage, and incident-resolution speed.

Knowledge workers should care because agent governance will shape what workplace assistants can access and do. Controls may determine whether an agent can send messages, change records, or act without confirmation.

The immediate story is a $113 million investment. The lasting story will be whether Onyx turns probabilistic supervision into dependable enterprise control.

Watch the next customer disclosures, independent evaluations, and platform responses. Those signals will show whether Onyx is building durable infrastructure or filling a temporary gap.

Google News can keep the financing in view, but buyers should ask a stricter question: does the platform stop consequential mistakes while allowing legitimate agents to finish their work?