Pluto Security announced $42 million in new funding as it positions its software to detect and mitigate security risks that emerge when employees deploy AI tools and agents across enterprise environments. CEO and co-founder Shahar Bahat said new AI tools can appear inside corporate estates within two hours of public release.
Where the risks come from
Pluto reports that roughly 60% of the risks it finds across customers originate from tools created or configured by non-developers. Finance teams are the largest source of these so-called vibe-coded risks, followed by marketing and legal teams; developers rank fourth. One customer case the company flagged involved a finance employee at a Fortune 500 company who had built a customer data and churn-management app that was left exposed to the internet.
Traction and customers
According to Bahat, Pluto only started selling in April and has already surpassed $2 million in annual recurring revenue (ARR). The company counts more than 30 enterprise customers, including Oscar Health, Workato, Sixt, and AlphaSense. Bahat also said about 70% of Pluto’s sales pipeline now comes from inbound interest, though she did not specify how much of that directly stems from their public tools.
Product approach
Pluto’s core thesis is that legacy security tooling alone is insufficient to manage the behavior of AI agents and connectors. The startup’s software monitors the AI tools employees use, the skills and extensions those tools rely on, MCP servers and other components, and the apps and agents being created. The system aims to identify risky components, detect potentially dangerous agent activity, and enforce security policies without preventing employees from using or developing AI tools.
To gather the necessary context, Pluto integrates with endpoint security and device-management systems and can deploy its own sensors through those systems or directly onto devices. It collects prompts, commands, running processes, permissions, and users’ prior activity, and runs lightweight models on endpoints to assess an agent’s intent.
Real-time intervention
A distinguishing capability of Pluto’s platform is runtime intervention. If an agent attempts to escalate privileges beyond what a user intended, the system can block the action or inject instructions into the session that prompt the agent to ask for confirmation. Bahat framed this as a move from focusing on user behavior to focusing on agent behavior.
Plutonium: a public, community-driven feeder
In April, Pluto launched Plutonium, a free platform that allows anyone to check risks associated with publicly available AI skills, connectors, and add-ons. Plutonium includes an MCP scanner and a catalog of verified components. Bahat says thousands of security professionals use Plutonium and that the community has become an important source of feedback and prospective customers.
Funding and plans
Pluto’s financing comprises an $8.5 million seed round led by TLV Partners, with investment from the founders of cybersecurity firm Armis, and a $34 million Series A led by Jump Capital, with participation from Skinos (the venture firm of Check Point co-founder Shlomo Kramer), Ansa Capital and other angel investors. The company said it will use the new capital to develop its product, expand security research, and grow its presence in the U.S. Pluto currently employs 40 people across the U.S. and Israel.
Why it matters
As AI tools spread quickly inside enterprises and non-developers build and deploy functioning agents, new attack surfaces are appearing. Pluto Security’s product and go-to-market approach focus on real-time visibility and control of agent behavior to address what the company describes as a largely internal source of risk. The startup reports that in many proof-of-concept engagements it has discovered risky or even active malicious activity, underscoring the urgency for organizations to update security controls to address AI-specific threats.
