Reco AI Agent Security Gets $55 Million as the Vendor Race Crowds

Reco raised $55 million for Reco AI agent security, giving the company fresh capital as enterprises struggle to govern autonomous software across business systems.

The additional funding brings Reco’s total capital raised to $140 million. AT&T Ventures participated as both an investor and customer, while Forestay and Quadrille Capital also backed the financing. Reco plans to expand sales, partnerships, channels, and customer support.

The money is significant, but the timing matters more. Reco is repositioning beyond SaaS security while at least two dozen companies pursue parts of the agent-security problem. CrowdStrike, WitnessAI, HiddenLayer, Zenity, and other vendors approach the market from different starting points.

That creates the central tension behind the Reco funding round. Enterprises need visibility before agents gain more authority, yet buyers face overlapping claims from an increasingly crowded field. Reco must prove that its existing map of applications, identities, permissions, and data provides a defensible advantage.

The Reco Funding Round Backs an Expanded Security Bet

Reco is using the new financing to turn its SaaS security foundation into a broader control layer for enterprise AI agents.

Reco announced the financing on September 29, 2026. The company described it as an additional $55 million investment rather than a newly numbered funding round.

That distinction matters. Reco completed a $30 million Series B in February, bringing its funding at that point to $85 million. The latest capital followed less than eight months later and raised its disclosed total to $140 million.

Reco did not disclose a precise valuation for the new investment. CEO and co-founder Ofer Klein told TechCrunch that the valuation had more than doubled since February. He placed it in the “high hundreds of millions,” without providing a specific figure.

Klein also said annual recurring revenue had reached the double-digit millions and was expected to triple during 2026. Those figures remain company disclosures rather than independently audited results.

The company has more than 100 customers, according to Klein. Financial services organizations represent about 40% of its business, which gives Reco exposure to buyers with strict access, audit, and data-governance requirements.

AT&T’s participation adds a strategic dimension. The telecommunications company is not simply supplying capital. AT&T also uses Reco, giving the investment more practical weight than a conventional financial endorsement.

“As both an investor and customer, AT&T recognizes the growing importance” of understanding how agents interact with applications and data, AT&T Ventures head Vikram Taneja said.

The financing will support customer-facing expansion rather than a narrowly defined research program. Reco says it will hire across sales, partnerships, channel operations, and customer support as enterprises move agents into production.

That allocation suggests Reco believes the core technical proposition is ready for broader deployment. It also shows that distribution has become a major competitive variable in the AI agent security market.

A related partnership reinforces that strategy. One day before announcing the financing, Reco unveiled a ServiceNow integration covering ServiceNow’s Otto agents and platform configurations.

Reco says the integration maps each Otto agent’s identities, permissions, connected tools, and potential exposure. It also runs more than 170 ServiceNow-specific posture checks, then sends findings into ServiceNow workflows for remediation.

The announcements fit together. The Reco funding round supplies resources for distribution, while the ServiceNow partnership places Reco inside a platform where enterprises already manage operational work.

The immediate change is therefore larger than another cybersecurity investment. Reco is moving from monitoring SaaS applications toward governing agents that act across those applications.

That creates a harder product test. Discovering an application is useful, but tracking an agent requires understanding changing relationships among accounts, tools, sessions, permissions, and workflows.

Why Reco AI Agent Security Is Attracting Capital Now

Enterprises are giving agents operational access faster than many security teams can establish ownership, inventory, and enforceable controls.

An AI agent is software that can pursue a goal through tools, data, and automated actions. Unlike a conventional chatbot, an agent can interact with applications or initiate workflows with limited human involvement.

Those capabilities change the security problem. An employee normally has a recognizable identity, manager, device, and employment lifecycle. An agent can borrow a user’s authorization, use a service account, call an API, or operate through a browser session.

One agent can also cross several systems during a single task. It might read a support ticket, retrieve customer data, draft a response, and update a CRM record. Each step can appear legitimate when reviewed separately.

The combined path is more difficult to assess. An agent with modest permissions in several applications can create a larger exposure when those permissions connect.

This is why Reco emphasizes relationships rather than isolated assets. Its Reco Graph is a context graph, meaning a structured map connecting agents, people, applications, accounts, data, permissions, and actions.

According to the company, that graph helps security teams determine which agents exist, what they can reach, and which access should be removed. Reco says its platform supports more than 280 application integrations and 1,000 detection controls.

The platform also uses browser and network signals to find agents beyond directly integrated applications, Klein told TechCrunch. Reco says it can inspect prompts and tool calls, which are requests an agent sends to models or connected services.

The demand case includes striking customer examples, though readers should treat them as vendor claims. Klein said Reco found 21,000 previously unknown agents at one Fortune 100 customer.

At a large financial-services company, Reco reportedly identified an agent created by a former employee. The agent could access Salesforce and transmit information to a domain that the organization could not see, according to Klein.

These examples illustrate why basic software inventories can fail. A company might know that Salesforce is approved while missing the agent, authorization grant, or external destination attached to it.

The problem extends beyond Reco’s customer base. HiddenLayer CEO Chris Sestito said more than 50 of his customers had agents in production touching sensitive assets and critical systems.

Cymphony separately said it found about 85,000 files exposed to AI tools and agents at one public company. Those numbers are company-reported observations, not representative industry samples.

Still, they point toward a consistent operational challenge. Enterprise adoption can occur through approved platforms, embedded features, browser tools, employee experiments, and custom workflows at the same time.

Security teams cannot govern an object they cannot identify. They also cannot assign accountability if nobody knows who owns an agent or why its access remains active.

That inventory gap creates pressure on chief information security officers. Blocking every agent would constrain legitimate adoption, while approving tools without continuous oversight could expose customer records, source code, or financial processes.

Organizations therefore need a middle path. They must allow useful automation while limiting unnecessary permissions and preserving a record of ownership and change.

Clear documentation matters alongside automated controls. Teams evaluating agent access need a searchable knowledge base for policies, architecture decisions, owners, and incident findings.

Reco’s timing reflects that shift. The company originally focused more heavily on SaaS posture and AI application visibility. It now presents agent security as the layer connecting those earlier capabilities.

That positioning gives Reco a plausible entry point, but it does not settle the competitive question. Many security companies see the same opportunity, and several begin with different technical advantages.

The AI Agent Security Market Is Already Crowded

Reco is not racing against one direct rival; it is competing against several security categories converging on the same enterprise budget.

TechCrunch found at least two dozen companies offering some form of AI agent security. Their products differ, but their marketing often repeats the same promises: discovery, governance, runtime monitoring, tool control, and risk reduction.

Some vendors focus on the tools agents can invoke. Others concentrate on data access, non-human identities, prompt traffic, runtime behavior, or unauthorized AI usage.

CrowdStrike approaches the problem from endpoint detection and response. Its position can appeal to buyers who want agent activity connected to devices, workloads, and established security operations.

Zenity focuses heavily on securing AI agents and low-code automation. That framing addresses workflows created in platforms that business teams can configure without conventional software-development controls.

HiddenLayer began with machine-learning model security. Its expansion into agent protection emphasizes threats that appear when models and autonomous systems reach production.

WitnessAI offers enterprise AI governance and data-flow controls. The company raised $58 million in early 2026 from investors including Sound Ventures, Fin Capital, Qualcomm Ventures, and Samsung Ventures.

That financing was another sign of capital moving into this category. Axios reported that PitchBook estimated nearly $250 million went into agentic cybersecurity companies during 2025 across almost two dozen deals.

The agent security investment also came with an important qualification. Roughly one-quarter of respondents in a McKinsey study said their organizations were meaningfully scaling agentic AI systems.

Adoption is therefore real but uneven. Vendors are building for a large future market while many customers remain in pilots, limited deployments, or early governance programs.

Reco’s answer to this crowded field is context. The company argues that its SaaS coverage gives it an existing view of applications, identities, permissions, and data relationships.

That foundation could help Reco recognize risk across connected systems. A security team might see not only that an agent exists, but also which account it uses and what business information that account can reach.

The approach differs from controls placed only around a model endpoint. An agent can behave safely at the model layer while still holding excessive access to Salesforce, Workday, Microsoft 365, or ServiceNow.

Reco also claims it can add new integrations quickly through its Reco Factory. Integration speed matters because every unsupported application creates another possible visibility gap.

Yet context graphs are not unique to Reco. Knowledge graphs, identity relationships, asset maps, and attack-path analysis already appear across cloud, identity, data, and exposure-management products.

The competitive issue is therefore not whether relationships matter. It is whether Reco can build and maintain a more useful relationship map than larger platforms or specialized rivals.

Established vendors have distribution, telemetry, and procurement advantages. A customer already using a major endpoint, identity, cloud, or data-security platform might prefer an agent module from that supplier.

Startups can respond with deeper specialization and faster product development. However, they must prove that a separate platform produces enough value to justify another console, integration project, and vendor review.

The involvement of AT&T and ServiceNow gives Reco credibility on this front. A major customer-investor can provide deployment feedback, while a platform integration can place findings inside existing security workflows.

Neither relationship guarantees market leadership. Strategic investors sometimes back several technologies, and platform partnerships can expand across competing vendors.

This is why the Reco funding round represents competitive pressure as much as validation. The capital gives Reco time to secure customers before adjacent security categories absorb agent governance.

The winner may not be the vendor with the broadest list of agent-specific features. It may be the company that connects agent risk to the systems security teams already trust and operate.

What Reco’s Context Graph Must Prove

Reco’s central promise depends on data coverage, relationship accuracy, and timely remediation, not simply the ability to display an agent inventory.

The Reco Graph maps agents to identities, applications, permissions, API connections, sessions, tools, data, and workflows. That structure addresses an important weakness in conventional asset management.

A list can show that an agent exists. A graph can show that the agent uses a former employee’s authorization, reaches sensitive records, and sends information through an external integration.

That relationship view supports a more precise security decision. Instead of banning the agent, a team might remove an unnecessary permission, revoke an outdated token, or disable one risky connection.

Reco says its product can reduce excessive permissions, revoke obsolete access, disable integrations, and enforce policies. These are meaningful actions, but their reliability depends on the underlying telemetry.

Coverage is the first test. More than 280 integrations represent substantial breadth, yet large enterprises often use thousands of applications, extensions, scripts, and internal services.

The unsupported portion can contain the greatest risk. New agent frameworks and Model Context Protocol servers can appear before formal security integrations exist.

Model Context Protocol, commonly shortened to MCP, is a standard for connecting AI systems with tools and data sources. An MCP connection can expand what an agent sees and does.

Reco must identify those connections across sanctioned and unsanctioned deployments. Browser and network signals can help, but encrypted traffic, personal accounts, custom code, and remote services complicate discovery.

Accuracy is the second test. A graph can produce misleading conclusions if it links the wrong owner, misses a temporary permission, or cannot distinguish theoretical access from actual use.

False positives create operational costs. Security teams may stop trusting recommendations if a platform repeatedly flags harmless relationships or proposes disruptive remediation.

False negatives create the opposite danger. A clean dashboard can provide misplaced confidence when an agent or integration remains invisible.

Freshness is the third test. Agent relationships can change quickly as users authorize new tools, developers modify workflows, or applications add embedded AI features.

A periodic scan may not capture an access chain before an agent takes action. Reco must show how quickly it detects changes and how reliably it updates risk decisions.

Remediation is the fourth test. Identifying a dangerous relationship is valuable, but enterprises need controls that work across varied applications without breaking legitimate processes.

The ServiceNow partnership offers a concrete model. Reco says findings can return to ServiceNow as tickets and workflows, keeping remediation inside an established operational system.

That still leaves questions about automation. Buyers need to know which actions Reco can execute directly, which require approval, and how teams can reverse an incorrect change.

Security teams will also examine privilege boundaries. A platform that can discover and revoke access needs extensive visibility and potentially sensitive administrative rights.

That makes Reco itself part of the customer’s critical security architecture. Buyers must assess its data handling, role design, audit records, failure modes, and integration permissions.

The reported 21,000-agent discovery illustrates both opportunity and uncertainty. Reco has not publicly provided the customer’s counting method, agent definition, or independent validation.

A browser extension, embedded assistant, automated workflow, and autonomous production agent do not necessarily create equal risk. Treating every detected object as equivalent could inflate the apparent problem.

The same caution applies to revenue and growth statements. Reco says its annual recurring revenue should triple this year, but private-company forecasts remain unverified.

None of these questions invalidates the product thesis. They identify the proof points buyers should demand before treating a context graph as the authoritative source for agent risk.

Evaluation should start with a controlled inventory comparison. Security teams can measure how many known agents Reco finds, which unknown items it surfaces, and how many results survive manual review.

A second test should examine access-path accuracy. Buyers can select real workflows and confirm whether Reco correctly maps identities, permissions, tools, data destinations, and business owners.

A third test should measure remediation outcomes. The platform should reduce exposure without interrupting approved automation or generating an unmanageable queue of alerts.

Reco’s competitive advantage will emerge only if those tests outperform existing identity, SaaS, cloud, and endpoint tools. A visually detailed graph alone will not establish that edge.

Three Signals Will Decide Whether the Bet Works

Reco’s next phase will be judged by enterprise deployment depth, measurable control outcomes, and its response to competitors entering the same workflows.

The first signal is expansion beyond initial discovery. Reco has more than 100 customers, according to Klein, but customer count alone cannot show how deeply organizations use the product.

Watch whether deployments progress from limited audits into continuous governance across multiple business units. Broader adoption would support Reco’s claim that agent security is becoming an operational requirement.

The best evidence would include customer-reported changes. Examples could cover reduced excessive permissions, faster removal of abandoned agents, or fewer unknown integrations after deployment.

Independent case studies would strengthen the argument further. Current disclosures rely heavily on company statements and selected customer examples.

If customers remain focused on one-time inventories, the market may be treating agent security as an assessment project rather than a lasting platform category.

The second signal is product coverage across changing agent environments. Reco says it supports hundreds of applications, but the relevant question is whether coverage keeps pace with new platforms and internal workflows.

The ServiceNow relationship is an early indicator. The integration protects Otto agents, evaluates platform posture, and routes findings into existing workflows.

Reco should show that this pattern works elsewhere. Buyers will look for comparable depth across Microsoft Copilot, Salesforce, Workday, OpenAI, Anthropic, browsers, and custom agent frameworks.

New integrations must provide more than connector counts. Security teams need consistent identity resolution, permission analysis, activity monitoring, and remediation across each environment.

Evidence of rapid, accurate integration would strengthen the Reco AI agent security thesis. Persistent gaps or shallow connectors would weaken it.

The third signal is how competitors package similar controls. Reco’s opportunity narrows if larger security platforms bundle agent governance into products customers already own.

CrowdStrike and other endpoint vendors can connect agent activity to device telemetry. Identity providers can extend lifecycle controls to non-human accounts and delegated access.

Cloud-security platforms can map workloads, secrets, and APIs. Data-security companies can focus on what sensitive information an agent can retrieve or transmit.

Specialists such as WitnessAI, HiddenLayer, and Zenity can compete through concentrated agent expertise. Their products may overlap with Reco while emphasizing different control points.

This competitive field is visible in current security funding. Reco must convert new capital into defensible deployment experience before category boundaries settle.

Market consolidation is another possibility. Enterprises may resist operating separate tools for SaaS posture, model security, agent runtime protection, data governance, and identity control.

Vendors will respond through product expansion, partnerships, and acquisitions. Reco’s integration strategy positions it to participate, but larger platforms hold substantial leverage.

The company also needs to preserve clarity as it broadens. “Agentic security” can become an umbrella term covering discovery, governance, runtime defense, data protection, and application posture.

A broad platform story can help Reco reach more budgets. It can also make direct product evaluation harder if buyers cannot identify which controls are mature today.

The most credible path is measurable specificity. Reco should show what it detects, how it connects that evidence, what action it recommends, and what exposure disappears afterward.

The $55 million raise gives Reco resources to build distribution around that proposition. It does not establish that the category will support every company currently pursuing it.

Enterprise buyers should avoid choosing a vendor from funding totals or agent counts alone. They should test discovery against a known inventory, validate access paths, and measure remediation accuracy.

They should also ask who owns each agent after deployment. Technical visibility has limited value if business teams, security teams, and platform administrators cannot agree on accountability.

For developers, the lesson is equally practical. Every new tool connection or delegated permission becomes part of the agent’s security boundary, even when the model itself behaves as intended.

For knowledge workers, agent adoption changes how access persists. An automation created for one project can continue reaching documents, messages, and records after its original purpose disappears.

Reco’s investment shows that these questions have become commercially urgent. The AI agent security market is attracting serious capital before its technical boundaries and dominant vendors are settled.

The next few months should reveal whether Reco turns strategic backing into deeper deployments, richer integrations, and verified risk reduction. Those outcomes matter more than another funding headline.

Organizations evaluating Reco AI agent security should begin with one question: can the platform find and explain access paths that their current tools genuinely miss? A convincing answer requires a live test, documented baselines, and results that security teams can reproduce. Buyers should compare those findings with identity, endpoint, SaaS, cloud, and data-security products already deployed. They should then measure whether Reco removes risky access without blocking useful automation. If deployments produce repeatable improvements, the financing will look like an early bet on a durable control layer. If the value remains concentrated in discovery dashboards and vendor-reported examples, crowded competition will become Reco’s larger problem.