Sequoia Invests $30M in Cymphony, Betting on AI Security

The security of AI agents is emerging as a new expense line for companies. Sequoia is strengthening its support for Cymphony with a $25 million Series A co-led in a total round of $30 million, while the New York and Tel Aviv-based startup claims its first deployments and clarifies its technical approach.

A Market to Prove, Established Competition

Cymphony must now establish that the security of AI agents constitutes an independent market, rather than just an additional feature of large platforms. The company faces expanded offerings from established players like Microsoft, Okta, CyberArk, Wiz, and Varonis. For now, Bogomil Balkansky describes Cymphony as a complementary layer, noting that "no one is going to get rid of their Okta," while observing that customers are widely adopting it as an overlay. However, he anticipates that in the long run, Cymphony could replace certain point solutions, particularly in data loss prevention. The competitive landscape is tightening as incidents multiply: in July, OpenAI reported agents capable of bypassing protections and compromising systems on Hugging Face, and last week, agents linked to OpenAI altered thousands of entries on a German programming wiki by sharing ways to evade restrictions. In this context, Balkansky expects an increase in budgets dedicated to agent security in line with AI deployments, projecting that over the next five to ten years, it will become a major expense line.

Mapping Access and Automating Remediation

Cymphony's platform offers a unified view of human and non-human identities, indicating the sensitive systems and data accessible. Its "workforce graph" aggregates identity, data, and activity signals to illuminate these relationships. Beyond detection, the tool relies on AI agents to investigate incidents, prioritize interventions, and automate certain corrections, particularly regarding access permissions. It can operate largely automatically, with a managed service delegating complex cases to the company's experts. Cymphony reports having already uncovered large-scale risks, including approximately 85,000 files made accessible to AI tools and agents within a U.S. public company, an exposure it claims to have reduced without consultation through these systems. Another case mentioned involves the unauthorized installation of a Claude instance by an external collaborator, used to scan thousands of sensitive files. These situations arise as agents do not always follow the same identity controls as employees, can access multiple systems, and manipulate large volumes of data, complicating access tracking.

Sequoia's Capital Bet and Commercial Traction

The startup has completed a $30 million funding round, including a $25 million Series A co-led by Sequoia and the SMBC Fin Atlas Beyond Fund, achieving a post-money valuation of over $100 million. Based in New York and Tel Aviv, Cymphony had previously received undisclosed seed funding from Sequoia. The fund's first check came when the company had neither a product nor an established product cap, according to partner Bogomil Balkansky, who relied on the team formed by Shy Dekel, Idan Berkovits, and Edi Gotlieb, all from the Talpiot program, known to Sequoia for investments like Wiz. For the Series A, the fund claims to have required evidence beyond pedigree. Cymphony now mentions a product in production, a double-digit enterprise client portfolio, and seven-figure annual recurring revenues in its first year of sales, citing KKR, Syngenta, Cass Information Systems, and Athennian. Sequoia states it has been using the solution internally since its inception and highlights the quality, diversity, and expansion of use cases among clients. The funds are expected to help companies manage their expanding AI workforce.

Why the Identity+Data Approach is Highlighted

Sequoia emphasizes that Cymphony addresses identity and data together, rather than as two silos, to tackle agent security. The founders and their investor believe this approach is particularly relevant as agent deployments multiply. Unlike employees with relatively stable roles, agents can vary their execution paths, acquire new capabilities, or even create other agents, making access governance more complex with tools designed for humans. "Agents are very different actors," argues Bogomil Balkansky, asserting that current identity solutions are not designed for behavior that evolves during execution. Shy Dekel adds that enterprise security has been designed for humans, even as non-human entities join the workforce. In this light, the platform is often adopted as an additional layer by clients.

Team and Presence: 30 People Between Tel Aviv and New York

Cymphony employs around 30 people, split between Tel Aviv and New York. Most of its clients are currently located in North America. However, the company is observing emerging demand in Europe, the Middle East, and Africa.