As AI agents operate at machine speed while gaining access to the same sensitive corporate data and systems as human employees, enterprises are likely to be exposed to new security risks. Renowned venture firm Sequoia Capital is betting big on that change, backing Symphony, a startup that emerged with $30 million in funding to help companies curb the growing AI talent pool.
The funding includes a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, and will bring the New York and Tel Aviv-based startup to a post-investment valuation of more than $100 million. This round follows a previously undisclosed seed investment from Sequoia.
Although AI agents do not necessarily go through the same access and identity controls as employees, they access multiple systems and process large amounts of corporate data. This makes it difficult for businesses to track who has access to what.
Cymphony seeks to address this gap by giving security teams a central view of non-human identities such as employees, AI agents, and accessible systems and sensitive data. The two-year-old startup has built what it calls an “employee graph” as the core of its platform. This brings together identity, data, and activity signals.
“Enterprise security was designed for human employees,” Cymphony co-founder and CEO Shy Dekel (pictured above, center) said in an exclusive interview. “More and more independent organizations are effectively joining the workforce, but they are no longer people.”
Sinfonia said it has already discovered these risks within large companies. At one U.S.-listed company, the company said it discovered about 85,000 files that had been made accessible to AI tools and agents. Sinfonia said this contributed to the closure of the raid and confirmed that no files were accessed through these AI systems.
In another case, an outside collaborator installed an unauthorized instance of Anthropic’s Claude and used that collaborator’s existing access to scan thousands of sensitive files, Dekel told TechCrunch.
In addition to identifying risks, Cymphony uses AI agents to investigate incidents, prioritize what security teams should take action on, and automate some remediation, such as fixing permissions. Dekel said the platform can operate almost automatically, adding that customers can also opt for a managed service that brings in Symphony’s security experts for more complex cases.
Why Sequoia has doubled
Sequoia’s first bet on Cymphony came before the startup solved the problem it wanted to solve. Bogomil Balkansky, a partner at Sequoia, told TechCrunch that Cymphony didn’t have a product or even a clear direction when the venture led a seed round more than two years ago.
The investment was primarily a bet on Dekel and his co-founders Idan Berkowitz (pictured above, right) and Eddie Gottlieb (pictured above, left), all three from Talpiot, the Israeli military’s highly selective technology and leadership program. Sequoia was already familiar with the program through previous cybersecurity investments, including Wiz.
“We’ve seen three great young men with the kind of pedigree that have experienced a lot of success at Sequoia,” Balkansky said.
Nevertheless, Sequoia wanted to see more than its founder’s pedigree by its Series A.
Cymphony developed the product, signed on double-digit enterprise customers, and reached seven-digit annual recurring revenue within its first year of sales, the company told TechCrunch. Customers include KKR, Syngenta, Cass Information Systems, and Athenian.
Sequoia has also been using Cymphony’s products internally since early development, Balkansky said. He pointed to the quality and scope of Symphony’s customers, as well as the growing use of the platform by existing customers, as key reasons for the venture’s decision to reinvest.
Cymphony is entering an increasingly crowded market as cybersecurity companies seek to address risks arising from the increased use of AI agents.
Recent events have further heightened these concerns. In July, OpenAI revealed that an agent undergoing a cybersecurity competency test bypassed safeguards and penetrated the systems of its AI platform Hugging Face. Then, late last week, agents linked to OpenAI made thousands of edits to the German programming wiki, using parts of the site to communicate and share ways to work around the restrictions.
Balkansky acknowledged that many companies are already positioning AI and agent security front and center. But he said Cymphony’s approach stands out because it treats identity and data security as part of the same problem.
Dekel and Balkansky argue that that distinction will become more important as companies deploy more AI agents across their operations. Unlike human employees, who have relatively stable roles and privileges, agents can take different routes to complete tasks, acquire new capabilities, and even create other agents, making it difficult to manage agent access in security systems designed around humans.
“Agents are a completely different entity,” Balkansky said, arguing that existing identity tools are not designed for agents that can change their behavior and functionality at runtime.
Cymphony is also competing with established security companies that are expanding their services around identity, data, and AI, including Microsoft, Okta, CyberArk, Wiz, and Varonis.
Dekel told TechCrunch that Cymphony is already replacing some of its customers’ existing security products. He said the company helped one company integrate two existing tools, eliminating the need to purchase a third one, without providing further details.
But Balkanski believes the symphony’s role, at least for now, is more of a complement than a replacement. “Nobody is going to retire Okta,” he said, adding that most customers now employ Cymphony as an additional layer. But over time, he told TechCrunch, the startup could replace some point solutions, especially in areas like data loss prevention.
Cymphony has approximately 30 employees in Tel Aviv and New York. Most of the company’s customers are currently in North America, but Dekel told TechCrunch that the startup is starting to see demand from companies in Europe, the Middle East and Africa.
That said, as Cymphony expands beyond Series A and into large enterprise customers, it will need to prove that AI agent security can become its own market, rather than a feature provided by large security platforms. Balkanski believes spending in this area will increase as companies put more AI agents to work.
“If companies aren’t spending money on agent security, I don’t know what else they’re going to spend money on in the next five to 10 years,” he says.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.
