Sequoia Capital is backing Cymphony, a New York and Tel Aviv-based startup, with a $30 million Series A investment to help enterprises manage security risks from AI agents operating inside corporate systems. The funding round, co-led by Sequoia and SMBC Fin Atlas Beyond Fund, values Cymphony at more than $100 million and follows an earlier undisclosed seed investment from Sequoia.

The core problem Cymphony is solving reflects a fundamental mismatch in how enterprises manage access and identity. Traditional security systems were built around human employees with relatively stable roles and permissions. AI agents, by contrast, operate at machine speed, can access multiple systems simultaneously, and may acquire new capabilities or even create other agents during runtime. This creates blind spots that most existing security tools cannot address.

Why Are AI Agents Becoming a Security Nightmare for Enterprises?

AI agents do not necessarily go through the same access and identity controls as human employees, yet they have access to multiple systems and handle large amounts of corporate data. This makes it extremely difficult for security teams to track who or what has access to sensitive information. Cymphony has already uncovered alarming exposures at major companies. At one U.S. public company, the startup discovered approximately 85,000 files that had become accessible to AI tools and agents.

In another incident, Cymphony identified an external collaborator who had installed an unsanctioned instance of Anthropic's Claude that used the collaborator's existing access to scan thousands of sensitive files. These real-world discoveries underscore why Sequoia partner Bogomil Balkansky believes spending in AI agent security will become critical. "If companies are not spending money on agent security, I don't know what else they'll be spending money on in the next five to 10 years," he stated.

How Does Cymphony's "Workforce Graph" Actually Work?

At the heart of Cymphony's platform is what the company calls a "workforce graph," which brings together identity, data, and activity signals into a single view. This gives security teams visibility into employees, AI agents, and other non-human identities across corporate systems, along with the specific systems and sensitive data each entity can access.

Founded by CEO Shy Dekel alongside co-founders Idan Berkovits and Edi Gotlieb, all three of whom came through Talpiot, the Israeli military's highly selective technology and leadership program, Cymphony has built a platform that goes beyond simple monitoring. The company uses AI agents itself to investigate incidents, prioritize what security teams should address, and automate remediation, including correcting access permissions.

"Enterprise security was designed for human employees. More and more, there start to be independent entities that are practically joining the workforce, but they're no longer people," said Shy Dekel, co-founder and CEO of Cymphony.

Shy Dekel, CEO at Cymphony

Steps to Strengthen AI Agent Security in Your Organization

• Map Your AI Identities: Create a comprehensive inventory of all AI agents and non-human identities operating within your corporate systems, including their access levels and the data they interact with.
• Unify Identity and Data Controls: Move beyond traditional identity management tools designed for humans and implement systems that treat AI agent access as a unified problem alongside employee permissions.
• Automate Incident Investigation: Deploy security tools that can automatically investigate suspicious AI agent activity, prioritize risks, and remediate access issues without requiring manual intervention for every incident.

Why Sequoia Doubled Down on Cymphony's Founders

Sequoia's initial seed investment in Cymphony was largely a bet on the founders themselves rather than an existing product. When Sequoia led the seed round more than two years ago, Cymphony had no product or even a clear product direction. However, by the time of the Series A, the startup had built significant traction. Cymphony signed a double-digit number of enterprise customers, including KKR, Syngenta, Cass Information Systems, and Athennian, and reached seven figures in annual recurring revenue within its first year of sales.

"We just saw three amazing young people with the kind of pedigree that we at Sequoia have experienced a lot of success with," said Bogomil Balkansky, partner at Sequoia Capital.

Bogomil Balkansky, Partner at Sequoia Capital

Balkansky also noted that Sequoia has been using Cymphony's product internally since early in its development, giving the firm direct insight into the platform's capabilities and market fit. The quality and range of Cymphony's customers, combined with evidence that existing customers are expanding their use of the platform, convinced Sequoia to invest again.

How Does Cymphony Compete Against Larger Security Platforms?

Cymphony is entering an increasingly crowded market as established cybersecurity companies strive to address risks emerging from AI agent deployment. Major players including Microsoft, Okta, CyberArk, Wiz, and Varonis are all expanding their offerings around identity, data, and AI security. Despite this competition, Cymphony's approach stands out by treating identity and data security as part of the same unified problem rather than separate concerns.

Balkansky acknowledged that scores of companies are already positioning themselves around AI and agent security, but he argued that Cymphony's distinction becomes more important as companies deploy more AI agents across their operations. Unlike human employees with relatively stable roles, agents can take different routes to complete tasks, acquire new capabilities at runtime, and in some cases create other agents, making their access harder to govern with security systems designed around people.

Dekel told TechCrunch that Cymphony is already replacing some existing security products at customers. At one enterprise, the company helped consolidate two existing tools and eliminated the need to buy a third. However, Balkansky sees Cymphony's role, at least for now, as more complementary than replacement. "Nobody's going to get rid of their Okta," he said, noting that customers are largely adopting Cymphony as an additional layer today.

Dekel

Cymphony currently has about 30 employees across Tel Aviv and New York. Most of its customers are currently in North America, though Dekel indicated that the startup is beginning to see demand from enterprises in Europe, the Middle East, and Africa. As Cymphony moves beyond its Series A and expands among large enterprise customers, it will need to prove that AI agent security can become a market of its own rather than simply a feature offered by larger security platforms.