AI Agent Security Vendors 2026: Who Secures Agentic AI, Layer by Layer

In the four weeks to October 20, 2026, agent security went from a startup category to a line item for the big platforms. Nvidia launched an agent safety platform with more than 100 partners. Proofpoint agreed to pay $6.3 billion in cash for Varonis and justified the price with AI agents. Microsoft's security chief said frontier models "cannot be trusted". Between those announcements, five startups raised money to find, govern or attack agents, and Cohere moved to buy a sixth. This roundup sorts the vendors by the control they actually provide, because "AI agent security" now covers five different products.

The month in agent security

Date (2026)	Company	Event	Layer
Sep 28	Nvidia	Open Agent Safety Platform: OpenShell runtime plus Sentry monitoring on BlueField-4 DPUs; 100+ launch partners	Runtime
Sep 29	Reco	$55M raise including AT&T Ventures; $140M total	Discovery & posture
Oct 1	Armadin	$255.5M Series B at over $2.5B, co-led by a16z and Accel	Offensive
Oct 13	Pluto Security	$42M across seed and Series A (Jump Capital led the A)	Discovery & posture
Oct 15	Proofpoint / Varonis	$6.3B all-cash acquisition, $49.75 per share; close expected H1 2027	Data access
Oct 15	Opsin	$21M led by SYN Ventures and Race Capital	Discovery & governance
Oct 15	Cohere / Aisle	Letter of intent to acquire Aisle, which finds and fixes software vulnerabilities	Offensive
Oct 19	Microsoft	Guardian Agents in Project Perception; Defender discovers up to 60 agent types	Platform
Oct 20	Hadrian	$40M co-led by Forgepoint Capital International and SmartFin	Offensive

The money follows a broader trend. Crunchbase counted $6.8 billion of cybersecurity venture funding in Q3 2026, up about 50% on the prior quarter, with AI companies making up the overwhelming majority and at least 18 AI-security rounds of $100 million or more. Earlier in the quarter Cyera signed to buy Oasis Security for about $1 billion (July 28), AIR Security came out of stealth with $50 million from Sequoia and Greenoaks (September 3), and HiddenLayer raised a $100 million Series B.

The five layers of agent security

An agent is a piece of software that holds credentials, picks its own next step and calls tools. Securing it means answering five questions, and each one has become its own vendor category.

1. Discovery and posture: which agents exist?

The first problem is inventory. Employees connect assistants, coding agents, browser extensions and MCP servers faster than security teams can review them.

• Reco maps agents across SaaS estates, including their identities, permissions, data and workflows, and aims to reduce excess access without blocking adoption. It raised $55 million on September 29.
• Pluto Security monitors AI tools on endpoints and the skills, extensions and MCP servers behind them, and can stop an agent mid-session or ask it to confirm a risky permission request. It reports more than 30 enterprise customers including Oscar Health, Workato, Sixt and AlphaSense. Its data says about 60% of detected risks sit in tools built by non-developers, with finance teams the top source.
• Opsin links each agent built on Copilot, Claude, ChatGPT Enterprise or Gemini to its purpose, permissions, data access and activity. Customers include UiPath and Wellstar Health System.

2. Agent identity: who is this agent, and what may it do?

Agents are non-human identities with more autonomy than a service account. Oasis Security built its platform for service accounts, tokens, keys and now agents, and raised about $195 million before Cyera signed a letter of intent to buy it for around $1 billion. Cyera, valued at $12 billion after a $400 million September round, plans to combine "who can access" with "what data is sensitive". Microsoft is going after the same layer from the platform side with dynamic permissions that start agents at minimal access and adjust it as risk signals change.

3. Runtime enforcement: stop the action before it happens

• Nvidia Open Agent Safety Platform combines the OpenShell runtime with Sentry, which runs on BlueField DPUs outside the agent's host and can stop it when a boundary is crossed. Nvidia's reasoning is that agents in recent incidents got around controls built into the application layer. OpenShell is available now. Sentry ships as a reference design, and its effectiveness has not been independently shown.
• AIR Security is a firewall for agent add-ons. It checks skills, plugins and MCP servers before and after deployment for malicious instructions, hidden behavior and excessive permissions, and can revoke a bad add-on across every agent that depends on it.
• HiddenLayer protects models, agents and workflows from attack. It raised a $100 million Series B led by Delta-v Capital in September.
• Microsoft Guardian Agents are agents that watch other agents inside Project Perception. Microsoft says Defender can discover up to 60 agent types, including Claude Code, Codex and OpenClaw. No availability dates or pricing have been published.

4. Data access: what can the agent reach?

Proofpoint's purchase of Varonis is a bet that agent risk is mostly data risk. The two companies say they will combine Proofpoint's human and agent security with Varonis's data and AI security platform. Proofpoint's CEO framed it in terms of agents that increasingly access sensitive information and act across systems. The price is about 8.4 times Varonis's trailing revenue, the deal is funded by Thoma Bravo with Ontario Teachers' investing alongside, and it is the largest cybersecurity acquisition announced in 2026 so far. Cyera competes in the same layer.

5. Offensive testing: attack your own agents first

• Armadin, founded by Mandiant's Kevin Mandia, runs agentic attack campaigns to find exploitable paths before adversaries do. It already runs them in production for Fortune 500 and government customers, and has raised $445 million in total.
• Hadrian sells autonomous offensive security and raised $40 million on October 20.
• Aisle, founded by former Avast CEO Ondrej Vlcek, builds AI that finds and fixes software vulnerabilities. Cohere signed a letter of intent to buy it on October 15. No terms were disclosed.

Vendor map by layer

How to buy in this market

Expect consolidation. Two of the most important companies in this roundup, Oasis and Varonis, will belong to other owners by 2027. TechCrunch counts at least two dozen agent-security vendors. Three rules follow from that:

1. Buy discovery first and keep contracts short. Inventory is what every other control depends on. It is also the most crowded layer, so prices and vendors will change.
2. Remove standing privileges before you buy runtime tools. Opsin found 93% of misaligned agent tools had unrestricted access. Scoping that access is a configuration task, not a procurement.
3. Decide how much to rely on your platform vendor. Microsoft and Nvidia want agent security to be a feature of the platform. That suits single-cloud estates. Multi-model, multi-cloud estates need a neutral layer.

The broader program, covering frameworks, threat models and the full control stack, is in our AI security guide 2026. For the governance side of agents taking actions, see human-in-the-loop AI.

Sources

• TechCrunch, Microsoft says AI agents are like insider threats (Oct 19, 2026).
• SC Media, Nvidia launches Open Agent Safety Platform (Sep 2026).
• SecurityWeek, Proofpoint inks $6.3 billion deal to acquire Varonis (Oct 2026).
• TechCrunch, Pluto Security raises $42M (Oct 13, 2026); Reco raises $55M (Sep 29, 2026).
• SecurityWeek, Armadin raises $255 million (Oct 1, 2026); AIR Security emerges with $50 million (Sep 3, 2026).
• Pulse 2.0, Opsin raises $21 million (Oct 15, 2026).
• BNN Bloomberg, Cohere to buy cybersecurity company Aisle (Oct 15, 2026).
• Crunchbase News, Cybersecurity investors put $6.8B to work in Q3.

Related reading: AI security guide 2026, deepfake detection tools 2026, enterprise AI agent platforms 2026, and Thomas Prommer on managing his own coding agents as non-human identities.

What is AI agent security?

AI agent security is the set of controls that govern what autonomous AI agents can see and do: finding every agent in use, giving each one an identity with scoped permissions, watching and stopping its actions at runtime, limiting the data it can reach, and testing it the way an attacker would. It differs from model security because the risk comes from actions and access, not only from what a model outputs.

Which companies sell AI agent security tools?

For discovery and posture: Reco, Pluto Security and Opsin. For agent identity: Oasis Security (being acquired by Cyera), plus identity incumbents. For runtime enforcement: AIR Security, HiddenLayer, Nvidia's Open Agent Safety Platform and Microsoft's Guardian Agents. For data access: Varonis (being acquired by Proofpoint) and Cyera. For offensive testing: Armadin, Hadrian and Aisle (being acquired by Cohere). TechCrunch counts at least two dozen vendors in total.

Why are AI agents treated like insider threats?

Because they hold real credentials and act inside your systems, and their behavior is unpredictable rather than malicious. Microsoft's Hayete Gallot made exactly that argument on October 19, 2026. Opsin's own analysis found that 93% of misaligned tools connected to agents had full, unrestricted access to the systems they used, and only one in 200 required human approval before acting.

What is a non-human identity?

Any identity that is not a person: service accounts, API keys, tokens, workload identities and now AI agents. Non-human identities already outnumber employees in most enterprises, and agents add identities that can reason and chain actions. That is why Cyera agreed to pay about $1 billion for Oasis Security, a non-human identity specialist.

Where should a company start with agent security?

With discovery. You cannot scope permissions for agents you do not know exist, and Pluto reports that new AI tools appear in company environments within about two hours of release. Inventory every agent, connector and MCP server, then remove standing privileges and require approval for high-risk actions. Runtime monitoring and red-teaming come after that.