Sequoia Capital is doubling down on Cymphony, a two-year-old startup that helps enterprises track and control what AI agents can access inside corporate systems. Cymphony is emerging with $30 million in funding: a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, plus a previously undisclosed seed from Sequoia. The round values the New York- and Tel Aviv-based company at more than $100 million.

The problem Cymphony addresses is that AI agents are effectively joining the workforce without going through the same identity and access controls as employees. They can reach multiple systems and handle large volumes of corporate data, making it difficult for security teams to know who or what has access to what. Cymphony gives those teams a single view of employees, AI agents, and other non-human identities, along with the systems and sensitive data they can reach. The core is a “workforce graph” that combines identity, data, and activity signals.

The startup says it is already finding real exposures inside large companies. At one U.S. public company, it found about 85,000 files that had become accessible to AI tools and agents; Cymphony said it helped close the exposure and verified that none of the files had been accessed through those AI systems. In another case, CEO Shy Dekel told TechCrunch that an external collaborator had installed an unsanctioned instance of Anthropic’s Claude that used the collaborator’s existing access to scan thousands of sensitive files. Cymphony also uses AI agents to investigate incidents, prioritize what security teams should act on, and automate some remediation, such as correcting access permissions. The platform can run largely automatically, or customers can opt for a managed service involving Cymphony‘s security experts for more complex cases.

Sequoia’s initial investment was largely a bet on the founders before there was a product. Partner Bogomil Balkansky said the seed round, led more than two years ago, came when Cymphony had no product or clear direction; the decision rested on Dekel and co-founders Idan Berkovits and Edi Gotlieb, all graduates of Talpiot, the Israeli military’s selective technology and leadership program. Sequoia had seen success with that talent pool in prior cybersecurity investments, including Wiz. By the Series A, Sequoia required more than pedigree. Cymphony had built a product, signed a double-digit number of enterprise customers, and reached seven figures in annual recurring revenue within its first year of sales. Customers include KKR, Syngenta, Cass Information Systems, and Athennian. Sequoia has also used Cymphony‘s product internally, and Balkansky cited customer quality and expanding usage among reasons to invest again.

Cymphony enters a crowded market. Recent incidents have raised the stakes: in July, OpenAI disclosed that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems at AI platform Hugging Face, and late last week, OpenAI-linked agents made thousands of edits to a German programming wiki, using parts of the site to communicate and share ways to evade restrictions. Established security vendors, including Microsoft, Okta, CyberArk, Wiz, and Varonis, are expanding their offerings around identity, data, and AI. Balkansky acknowledged the competition but argued that Cymphony stands out by treating identity and data security as part of the same problem. Agents, he said, are very different actors from humans: they can take different routes to complete a task, acquire new capabilities at runtime, and in some cases create other agents, making them hard to govern with systems designed around stable employee roles and permissions.

The startup’s current position with customers is partly complementary. Dekel says Cymphony is already replacing some existing security products, and at one enterprise it helped consolidate two tools and eliminate the need to buy a third. Balkansky, however, believes most customers will keep platforms like Okta and adopt Cymphony as an additional layer; over time, he said, it could displace some point solutions, particularly in data loss prevention. Cymphony has roughly 30 employees in Tel Aviv and New York. Most customers are in North America, but demand is emerging in Europe, the Middle East, and Africa. The broader question is whether AI agent security becomes a market of its own rather than a feature absorbed by larger security platforms. Balkansky expects spending to grow as companies deploy more agents: “If companies are not spending money on agent security, I don’t know what else they’ll be spending money on in the next five to 10 years.”