Pluto Security has emerged from stealth with $42 million in funding to give enterprises context, risk analysis, visibility, and control over how employees use AI tools. The underlying problem, as CEO Shahar Bahat describes it, is that AI adoption outruns security teams: a newly announced AI tool can show up inside a company’s environment within two hours of its release. About 60% of the risks Pluto detects across its customer base are in tools “vibe-coded” by non-developers. Finance departments are the biggest source of such risks, followed by marketing and legal teams, with developers ranking fourth. In one case, a finance employee at a Fortune 500 company had built an app to manage customer information and churn that was left exposed to the internet.

The startup is the latest in a new crop of security companies built on the conviction that using existing security software to monitor and control AI tools, connectors, and usage is a square-peg-round-hole approach. Pluto began selling in April and has already crossed $2 million in annual recurring revenue, with more than 30 enterprise customers including Oscar Health, Workato, Sixt, and AlphaSense. The funding spans an $8.5 million seed round led by TLV Partners, with cybersecurity firm Armis’ founders investing, and a $34 million Series A led by Jump Capital, with Skinos (Check Point co-founder Shlomo Kramer’s venture firm), Ansa Capital, and other angels participating.

Pluto monitors the AI tools employees use, the skills, extensions, MCP servers, and other components those tools rely on, plus the apps and agents being created. The system connects to endpoint security and device management systems and can deploy its own sensors through them or directly onto devices. It gathers prompts, commands, running processes, permissions, and users’ previous activity, then uses lightweight models on endpoints to assess what an agent is trying to do. Bahat frames the shift simply: “We’re moving from user behavior to agent behavior.”

The standout capability is intervention while an agent is working. If an agent tries to gain permissions beyond what the user intended, Pluto can stop the action or inject instructions into the session that prompt the agent to ask for confirmation. “We can inject context back to the session, and this way I can change how the agent is working,” Bahat explained.

Pluto also takes an unusual route to customers. In April it launched Plutonium, a free platform that lets anyone check risks associated with publicly available AI skills, connectors, and add-ons, alongside an MCP scanner and a catalog of verified components. Bahat says thousands of security professionals use Plutonium, and 70% of Pluto’s sales pipeline now comes from inbound interest.

Bahat said the biggest risks vary by CISO mindset and how willing an organization is to adopt AI, but problems appear across the board: “In general, I’ll say there was not one POC in which we entered and didn’t find malicious stuff,” she said. Some extension packages and skills had active live attacks during proof-of-concept work. Pluto plans to invest the new capital in product development, expand its security research efforts, and grow its U.S. presence. It has 40 employees in the U.S. and Israel.