The $60M Rise of Agentic AI Security: How Corma is Closing the Defense Gap

The Architectural Reality of Agentic AI Security

The enterprise cybersecurity landscape has quietly reached a critical inflection point where artificial intelligence is weaponizing significantly faster than it is shielding. We are currently witnessing the rapid expansion of what experts term the “defense gap”—a structural, algorithmic imbalance where frontier foundation models demonstrate exceptional proficiency in offensive penetration while failing miserably at defensive containment. Enter Agentic AI Security, a highly anticipated paradigm shift designed to arm corporate defenders with specialized, autonomous intelligence rather than passive alert systems. Founded in 2025 and officially emerging from stealth mode in August 2026, Corma—helmed by CEO Alon Pluda—has introduced a completely new foundational model engineered from the ground up specifically for defensive cybersecurity operations.

Historically, Security Operations Centers (SOCs) have operated on a paradigm of human oversight augmented by automated alert aggregation. Systems generate tickets, and analysts parse them. But as adversaries begin deploying autonomous swarms of AI to relentlessly probe networks for zero-day vulnerabilities, the human response time has become a fatal bottleneck. By the time an analyst identifies a sophisticated lateral movement within the network, the attacker has often already established a persistent foothold. Agentic AI Security fundamentally rearchitects this dynamic. Instead of relying on human analysts to manually query logs and trace attack vectors, organizations can deploy an AI agent—an autonomous piece of software that actively operates as a virtual team member within the existing security stack, capable of finding needles in digital haystacks at machine speed.

Closing the Defense Gap and the Training Data Dilemma

To fully grasp why this technological pivot is necessary, one must understand the inherent limitations of today’s most celebrated large language models (LLMs). In rigorous simulated environments constructed to mirror complex enterprise infrastructure, the vulnerability of current security methodologies is glaring. Models like Claude Opus 4.8, GPT-5.5, Grok 4.3, and DeepSeek V4 are breathtakingly adept at coding, reasoning, and language generation. This translates perfectly to offensive capabilities, such as writing polymorphic malware, orchestrating multi-step penetration workflows, or uncovering deep source code vulnerabilities. According to comprehensive testing, when these general-purpose models act as attackers, they successfully execute end-to-end cyberattacks and implant persistent backdoors in up to 88% of simulations (or roughly 85% across 241 scored independent engagements in Corma’s specific testing environment).

However, when tasked with defending the exact same simulated networks, their success rate plummets dramatically, successfully detecting and mitigating threats in only 12% to 19% of encounters. This glaring disparity is what Corma identifies as the “defense gap.” The root cause of this imbalance is fundamentally tied to training data distribution. Offensive cybersecurity operations often involve scanning source code or generating scripts—tasks that heavily overlap with the vast repositories of code and text that foundational models ingest during pre-training. Defensive security, conversely, is an entirely different beast. It relies on the continuous parsing and contextualization of structured machine data: server logs, network events, deeply nested configurations, sprawling audit trails, and real-time on-disk state. This represents a highly structured, non-prose syntax that constitutes a vanishingly small fraction of the data current frontier models are exposed to. As a result, standard LLMs struggle to read, interpret, and action this data reliably.

Corma’s architectural approach addresses this by training foundational models specifically on this obscure, high-volume structured machine data. Backed by a formidable team that unites elite AI researchers from Google DeepMind with veteran cybersecurity intelligence experts from Israel’s renowned Unit 8200 military intelligence division, Corma operates across dual headquarters in Tel Aviv and San Francisco. The startup’s mission is to effectively build the “one ring to rule them all”—equipping defenders with the first truly intelligent, specialized AI workforce capable of turning the tide in this asymmetric cyber warfare.

Market Impact & Deployment: The Economics of Autonomous Defense

The financial markets and venture capital ecosystems have aggressively validated this technological thesis. In a commanding market debut in August 2026, Corma announced it had secured a massive $60 million in seed funding—an astronomical and highly unusual figure for a seed-stage company. The round was led by Silicon Valley titan Sequoia Capital, with deep participation from Khosla Ventures and Coatue. This staggering capital injection underscores the existential urgency among Fortune 500 companies to modernize their defense apparatus before autonomous offensive agents completely overwhelm their perimeters.

For Chief Information Security Officers (CISOs) and enterprise IT architects, the Total Cost of Ownership (TCO) equation here is deeply compelling. The promise of Agentic AI Security is not the incremental improvement of alert generation, but the introduction of active, autonomous threat containment. In its early deployments across a diverse array of Fortune 100 and Fortune 500 enterprises—spanning critical sectors such as healthcare, financial services, energy grids, and retail—Corma’s systems have delivered staggering ROI metrics. The startup reports that its deployed agentic workforce has reduced organizational threat response times by over 94%.

Furthermore, these AI agents have expanded security coverage across discrete business units by up to 15 times. By instantly processing anomalies across expansive, hybrid cloud environments, these agents systematically shift the SOC from a reactive, human-bottlenecked monitoring center into a highly automated, self-healing containment facility. The classic cybersecurity paradigm is akin to hiring a thousand guards to watch a thousand monitors, perpetually hoping they don’t blink when an adversary slips past. Agentic AI security acts more like a biological global immune system—an autonomous army of white blood cells that constantly patrols the bloodstream, spotting and instantly neutralizing infections, only pausing to ask the human brain for final authorization to quarantine the threat.

The Consumer Translation: Protecting Data at the Speed of Life

While the underlying architecture of Agentic AI Security is deeply steeped in enterprise IT, the downstream implications for global consumers are profoundly impactful. Today, the world’s largest enterprises hold unprecedented volumes of sensitive data, ranging from our deepest financial transaction records to genomic sequencing data and real-time power grid schematics. As autonomous AI cyberattacks become more sophisticated, they pose a clear and present danger to civil infrastructure and personal privacy. Consequently, the safety of the everyday consumer now relies entirely on how fast enterprises can contain a breach once a perimeter has been breached.

To truly understand the speed and practical application of this new technology, consider a real-world scenario shared by Corma’s CEO, Alon Pluda. A top-tier security executive was casually walking his dog on a weekend when his smartwatch suddenly buzzed with a high-priority notification generated by a Corma AI agent. The alert succinctly read: “I just caught a live attack. I need your permission to block it.” Recognizing the severity of the intelligence, the executive approved the prompt instantly from his wrist. Without requiring the executive to open a laptop, VPN into a network, or manually parse firewall logs, the autonomous AI agent instantly blocked the malware, successfully halting the attacker’s lateral movement through the corporate network. The entire intrusion was definitively mitigated and neutralized in under 10 minutes.

This level of frictionless, rapid response represents the pinnacle of modern security. It ensures that personal data is protected at true machine speed, drastically reducing the traditional “dwell time” (the window in which hackers operate undetected inside a network to exfiltrate sensitive consumer information). For the public, this shift means that the massive corporations entrusted with their data are finally fielding a defense mechanism capable of matching the velocity of modern, AI-augmented cybercriminals.

Frequently Asked Questions

Q1: What is the cybersecurity defense gap?
A1: The defense gap is the growing imbalance where general-purpose AI models are highly capable of offensive hacking tasks but struggle with defensive operations. In simulations, foundational models successfully execute attacks 88% of the time but only detect 12% of incoming threats.

Get the Weekly Brief

Curated analysis for tech leaders. Every Thursday.

Subscribe

Q2: How does Agentic AI Security differ from traditional monitoring?
A2: Traditional monitoring generates alerts that human analysts must manually investigate and resolve, leading to bottlenecks. Agentic AI security deploys autonomous virtual workers that instantly analyze anomalies, parse logs, and actively contain live threats in real time.

Q3: Why do traditional large language models fail at network defense?
A3: Traditional models are trained on prose and source code, making them excellent at writing malware or scanning for code vulnerabilities. Defensive security requires parsing structured machine data—like audit trails and on-disk states—which general models read far less reliably.

Q4: What is Corma, and what do they do?
A4: Founded in 2025 and emerging from stealth in 2026, Corma is an AI security startup that builds foundational models explicitly for defensive cybersecurity. They provide an autonomous AI workforce that integrates into existing security stacks.

Q5: How effective is Corma’s AI workforce in real deployments?
A5: In early deployments across Fortune 100 and 500 companies, Corma’s AI agents have expanded security coverage by 15 times and reduced overall threat response times by over 94%.

---

TechNode HQ Verdict: Pros, Cons & Usability

• Pro (Engineering): Purpose-built foundation models can reliably and swiftly parse structured machine data (server logs, audit trails, configurations) that traditional LLMs inherently fail to interpret, enabling true security automation.
• Pro (Consumer): Drastically reduces the time-to-containment for massive enterprise breaches, shrinking the window adversaries have to steal personal data, financial records, and proprietary information.
• Con: The requirement for human-in-the-loop authorization (e.g., via a smartwatch push notification) still introduces a latency bottleneck if senior executives are asleep, away from devices, or unavailable during a rapid attack.
• Con: Integrating an autonomous AI agent deeply enough to instantly block live network traffic carries severe risks of false positives, which could inadvertently paralyze core business operations if the AI misidentifies legitimate internal traffic.

Enterprise Usability: For Fortune 500 CTOs and CISOs facing advanced, multi-stage attack campaigns orchestrated by state actors or rogue AI, deploying defensive AI agents is rapidly transitioning from a luxury experiment to a baseline necessity. However, rollout must be staged carefully to ensure that aggressive autonomous blocking does not take down critical internal networks during routine load spikes.

Everyday Usability: The general public cannot purchase these enterprise-grade tools directly. However, consumers should actively favor platforms and institutions that transparently leverage agentic AI to protect user data, as the sluggish speed of legacy, human-operated defense operations is simply no longer sufficient to secure modern data.

---