Pluto Security Raises $42M to Secure Enterprise AI Agents

Pluto Security Inc. emerged from stealth on October 13, 2026, announcing $42 million in total funding to address enterprise visibility and security risks associated with autonomous artificial intelligence agents. The capital comprises an $8.5 million seed round led by TLV Partners and a $34 million Series A round led by Jump Capital, with participation from Skinos, an investment fund affiliated with Check Point Software Technologies co-founder Shlomo Kramer. Headquartered in Tel Aviv, Pluto provides software that discovers, profiles, and governs AI agents operating across employee endpoints, cloud environments, and software-as-a-service applications, giving corporate security teams central oversight of agent tooling, system integrations, and behavioral risks.

Funding Breakdown and Enterprise Market Traction

The company was founded in 2025 by former Microsoft, Palo Alto Networks, and IDF Unit 8200 cybersecurity leaders Shahar Bahat (Chief Executive Officer), Tal Ofer Regev (Chief Product Officer), and Gil Maman (Chief Technology Officer). According to reporting by CTech, the founding team established the startup to counter the rapid expansion of employee-built and vendor-deployed AI agents that operate without centralized IT approval or monitoring.

Since opening commercial sales in April 2026, Pluto has accumulated more than 30 enterprise customers and surpassed $2 million in annualized recurring revenue (ARR), as reported by TechCrunch. Early enterprise adopters include health insurer Oscar Health, integration platform Workato, mobility provider Sixt, and financial intelligence platform AlphaSense. Pluto plans to allocate the newly secured capital toward hiring, scaling commercial sales, accelerating engineering roadmap milestones, and expanding dedicated threat research.

Agent Discovery, Telemetry, and Prompt-Based Enforcement

For Chief Information Security Officers and enterprise architecture teams, manual discovery of AI agents is functionally unworkable. Workers routinely deploy agentic assistants directly within development environments, browser extensions, and SaaS workflows. This creates an unmanaged operational layer where invisible SaaS agents bypass enterprise identity security and interact with sensitive backend systems without auditing.

Pluto’s platform tackles this blind spot by synthesizing telemetry through two primary channels: integrating directly with an enterprise customer’s existing cybersecurity stack and deploying dedicated, lightweight endpoint sensors. These sensors execute hardware-efficient machine learning models locally on employee workstations to monitor runtime agent actions without incurring prohibitive performance overhead.

When an agent is detected across an endpoint, cloud cluster, or SaaS environment, the platform compiles a detailed inventory profile detailing:

• Underlying Model Identity: The specific foundational model or fine-tuned instance executing the workload.
• Tool and Connector Access: External system utilities, APIs, terminal access, and database connectors available to the agent.
• Customizations and Prompt Repositories: User-defined configuration files, prompt libraries, and local plugin directories.

Rather than relying solely on network-level disconnects or post-hoc log alerts, Pluto intervenes directly at runtime. When an agent attempts an action that breaches organizational policy—such as accessing sensitive databases or executing unverified shell scripts—the platform injects an authoritative prompt directly into the agent’s context window, commanding it to halt the unauthorized workflow immediately. Security teams can establish granular control policies tailored to specific workflows, such as permitting engineering agents to generate code while forbidding interactions with production infrastructure to prevent zero-click indirect attacks on AI agents.

AI Supply Chain Governance and the EtherDuck Threat

Beyond internal runtime activity, enterprise risk extends heavily into the third-party AI supply chain. As documented by The Next Web, Pluto maintains Plutonium, a publicly accessible agent supply chain security registry. Powered by Pluto’s proprietary RisksDB database, Plutonium catalogs security profiles and evaluates risks across more than 4,500 public agent extensions, application connectors, and Model Context Protocol (MCP) servers. The service currently counts several thousand users evaluating external components before organizational deployment.

The operational necessity of pre-installation auditing was highlighted by recent findings from Pluto’s threat research team. Earlier in October 2026, researchers published an analysis detailing ‘EtherDuck,’ an active malware campaign connected to the broader SleepyDuck threat family. Attackers uploaded weaponized extensions to the Open VSX registry targeting Solidity smart contract developers, compromising development environments across Windows, macOS, and Linux platforms. The incident demonstrates that developer-facing AI and code-extension ecosystems have become active targets for supply chain compromise.

What happens next

With $42 million in fresh capital, Pluto Security faces the task of expanding its go-to-market footprint while enterprise IT leaders evaluate how agent governance fits into existing security architectures. Organizations currently piloting or deploying autonomous agents should consider the following operational next steps:

• Audit Local Agent Footprints: Security and compliance teams must identify which employee workstations run unmanaged agent frameworks, local prompt repositories, and third-party plugins.
• Establish Tool Connection Boundaries: IT leadership should define strict permission policies that prevent autonomous coding and productivity agents from interacting directly with credential stores, production repositories, or regulated databases.
• Pre-Screen MCP and Extension Repositories: Security teams should integrate registry scanning tools—such as Plutonium—into procurement and developer onboarding pipelines before allowing developers to connect public Model Context Protocol servers or third-party extensions.
• Monitor Runtime Interventions: Enterprise architects evaluating prompt-based mitigation must measure how effectively context-injected stop instructions prevent policy breaches without destabilizing critical legitimate workflows.