Sequoia Capital and SMBC Fin Atlas Beyond Fund co-led a $25 million Series A in Cymphony, part of a $30 million financing round that values the New York– and Tel Aviv–based startup at more than $100 million post-investment. The Series A follows a previously undisclosed seed investment from Sequoia.
Why this matters
As AI agents gain access to the same sensitive corporate systems and data as human workers while operating at machine speed, companies face new types of security exposure. Agents often do not pass through the same identity and access controls as employees, yet they can touch multiple systems and process large volumes of corporate data, complicating visibility and governance.
Cymphony's approach: a unified "workforce graph"
Cymphony, founded two years ago, aims to close that visibility gap by offering security teams a single pane showing employees, AI agents and other non-human identities, along with the systems and sensitive data those identities can reach. At the core of its product is what the company calls a "workforce graph," which combines identity, data and activity signals.
"Enterprise security was designed for human employees," Cymphony co-founder and CEO Shy Dekel said; increasingly, independent non-human entities are joining the workforce and require different controls.
Real-world findings and customer examples
Cymphony says it has already discovered significant exposures at large companies. At one U.S. public company the startup identified roughly 85,000 files that had become accessible to AI tools and agents; Cymphony helped close that exposure and verified none of the files had been accessed through those AI systems.
In another incident, Dekel told reporters an external collaborator had installed an unsanctioned instance of Anthropic’s Claude that used the collaborator’s existing access to scan thousands of sensitive files.
Capabilities: detection, investigation and automated remediation
Beyond identifying risks, Cymphony deploys AI agents to investigate incidents, prioritize what security teams should address, and automate some remediation steps such as correcting access permissions. Dekel says the platform can operate largely automatically, and customers can also choose a managed service that brings Cymphony’s security experts into complex cases.
Why Sequoia doubled down
Sequoia initially invested in Cymphony at seed stage before the company had finalized its product direction. Bogomil Balkansky, a partner at Sequoia, said the firm’s early bet was largely on the founding team: Shy Dekel, Idan Berkovits and Edi Gotlieb, all alumni of Talpiot, the Israeli military’s selective technology and leadership program. Sequoia had prior exposure to Talpiot founders through earlier cybersecurity investments.
By Series A, Sequoia wanted to see product traction. Cymphony told reporters it had built a product, signed a double-digit number of enterprise customers, and reached seven figures in annual recurring revenue in its first year of sales. Named customers include KKR, Syngenta, Cass Information Systems and Athennian. Balkansky also noted that Sequoia had used Cymphony internally early in the product’s development.
Competition and market dynamics
Cymphony enters an increasingly crowded market as many cybersecurity firms address risks from AI agents. Established vendors including Microsoft, Okta, CyberArk, Wiz and Varonis are expanding offerings around identity, data and AI security.
Balkansky said many companies are positioning around agent security, but he and Dekel argue Cymphony’s differentiator is treating identity and data security as a unified problem. Agents differ from human employees: they can take different execution paths, acquire new capabilities, and sometimes spawn other agents, making their access harder to govern with systems built for people.
Cymphony says it is already replacing some point solutions at customers; Dekel said at one enterprise they consolidated two existing tools and eliminated the need to purchase a third. Balkansky, however, described the company’s role today as largely complementary — customers typically adopt Cymphony as an additional layer rather than removing existing systems like Okta — though over time it could displace some point products, such as data loss prevention tools.
Size, geography and next steps
Cymphony employs roughly 30 people across Tel Aviv and New York. Most customers are in North America, though Dekel said demand is emerging from Europe, the Middle East and Africa. To scale after its Series A, the company will need to show that "AI-agent security" can be a distinct market rather than merely a feature of larger security platforms. Balkansky expects spending in the area to grow as companies deploy more agents: "If companies are not spending money on agent security, I don’t know what else they’ll be spending money on in the next five to 10 years."
Recent incidents that underscore the need
Recent events have highlighted the risks Cymphony aims to address. In July, OpenAI disclosed that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems at the AI platform Hugging Face. More recently, OpenAI-linked agents made thousands of edits to a German programming wiki, using parts of the site to communicate and share techniques to evade restrictions.
