The problem with giving everyone in your company access to AI tools is that people will use them in unexpected ways. And that fact is steadily instilling fears that companies have, or at least will soon have, a major new security hole in their systems.
Shahar Bahat, CEO and co-founder of Pluto Security, illustrated how the pace of AI tool adoption within enterprises is causing such concerns, noting that newly announced AI tools can appear within enterprise environments within just two hours of release. And about 60% of the risks her company detects across its customer base are in tools that are vibe-coded by non-developers. The biggest source of such risk is the finance department, followed by marketing and legal teams, she told TechCrunch. The developer says it’s in 4th place.
Her startup’s tools appear to have uncovered a vibe-coded app created by treasurers at Fortune 500 companies to manage customer information and cancellations, but the app remained exposed to the internet.
Pluto, which just came out of stealth with $42 million in funding, is the latest in a flurry of security startups to help companies address these fear gaps, all of which have raised large sums of money from investors on the belief that using only AI tools, connectors, and existing security software to monitor and control usage is a square-pin-round-hole approach.
Bahat told TechCrunch that her startup only started selling in April, but has already found some adopters for its technology. The technology helps companies gain context, risk analysis, visibility, and control over how employees use AI tools. She said Pluto began selling in April and already has more than $2 million in annual recurring revenue and more than 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense.
Pluto’s funding includes an $8.5 million seed round led by TLV Partners, with investors including the founders of cybersecurity firm Armis. The company recently raised $34 million in Series A led by Jump Capital with participation from Skinos (Check Point co-founder Shlomo Kramer’s venture firm), Ansa Capital, and other angel investors.
While not uncommon in this age of AI, this is enough traction for a young startup. But that may be because the breadth of risk is not limited to the big tech companies that lead the AI adoption charts.
When I asked Bahat where she thought the biggest risks lie, she said the issue is differentiated by the CISO’s mindset and the organization’s willingness to adopt AI, but the risks are there either way.
“Generally speaking, we didn’t have a single POC that went in, and we didn’t find anything malicious,” she said. “Whether they’re extension packages or skills, some of them were doing active live attacks while we were doing POCs. That’s also surprising to me from a product standpoint. For an enterprise, it’s not so great.”
Pluto’s overall bet is that securing such environments will require security tools that pay attention to the behavior of AI agents in real time, in addition to tracking what and how employees are building and deploying it.
“We are moving from user behavior to agent behavior,” says Bahat.
In line with that vision, the startup’s software monitors the AI tools, skills and extensions employees use, MCP servers and other components those tools depend on, as well as the apps and agents they create. The company says it can identify risky components, identify potentially dangerous agent activity, and enforce security policies without preventing employees from using or creating AI tools.
To do all this, Pluto connects to endpoint security and device management systems and can deploy its own sensors through them or directly on devices. It collects information such as prompts, commands, running processes, privileges, and a user’s previous activity, and uses a unique “lightweight” model on the endpoint to evaluate what the agent is trying to do.
What stands out is that Pluto’s system can intervene while the agents are working, Bahat said. For example, if an agent tries to obtain more privileges than the user intended, the system can stop the action or add an instruction to the session that asks the agent to confirm.
“You can inject context back into the session, which allows you to change the way the agent behaves,” Bahat explained.
The startup also takes an unusual approach to finding customers. In April, the company launched Plutonium, a free platform that allows anyone to check the risks associated with publicly available AI skills, connectors, and add-ons. We also have a catalog of MCP scanners and verified components. Bahat claims that thousands of security professionals are using Plutonium, and the community around it has become an important source of feedback and future customers.
He said 70% of Pluto’s sales pipeline currently comes from inbound interest, but did not provide a breakdown of how much of that comes directly through Plutonium.
Pluto said it plans to use the new funds to develop its products, expand its security research efforts and expand its presence in the United States. The company has 40 employees in the United States and Israel.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.
