Sequoia bets $25M on Cymphony's solution to govern AI agents as corporate security threat

Deployment of AI agents across enterprises is outpacing the tools to monitor and control them. Sequoia Capital is doubling down on that opportunity by leading a $25 million Series A for Cymphony, a startup applying security expertise to the problem of keeping autonomous systems accountable.

The New York and Tel Aviv-based company, co-founded by three veterans of Israel's Talpiot military technology program, aims to track which AI agents and human employees can access what corporate systems and data. The investment values the two-year-old firm at over $100 million and includes participation from SMBC Fin Atlas Beyond Fund.

The emerging AI security gap#

Traditional identity and access management was built around human workers with stable roles and defined permissions. AI agents operating in production environments introduce unpredictable behavior: they can take varied paths to complete tasks, acquire new capabilities on the fly, and even spawn additional agents—all while holding the same sensitive access as human employees.

Cymphony's initial discovery work has surfaced real risks. At one major U.S. public company, the startup uncovered approximately 85,000 files that had inadvertently become exposed to AI tools. In another case, an outside partner installed an unsanctioned instance of Anthropic's Claude using legitimate corporate credentials to scan thousands of confidential documents.

How Cymphony's approach differs#

The platform consolidates identity data, system access logs, and activity signals into what Cymphony calls a "workforce graph"—a unified map of who (or what) can reach sensitive information. Rather than treating AI agent risks as a separate concern, the startup frames identity and data security as interconnected, an angle Sequoia partner Bogomil Balkansky argues existing tools overlook.

Beyond detection, Cymphony deploys AI agents of its own to investigate security incidents, rank priorities for human teams, and automate remediation—correcting overpermissioned access. Customers can operate the system in a self-service mode or engage managed security services for complex scenarios.

Why Sequoia doubled down#

Sequoia's initial seed investment in Cymphony was made before the founders had identified a specific problem to solve—a bet on founders rather than a product. All three co-founders passed through Talpiot, a selective Israeli military leadership and tech program that has also produced executives at cybersecurity standout Wiz, giving Sequoia confidence in the team's pedigree.