The one-line read: the venture money in AI security stopped chasing safer models and started chasing control of the agents. Onyx's fresh ~$113M Series B at a reported ~$640M valuation (Calcalist) is the loudest signal yet — and it's the same bet July's ~$1.8B agent-funding wave already placed: control the agents.
The market moved from "is the model safe?" to "what is this agent allowed to do?"#
For two years, AI-security dollars flowed into pre-deployment assurance — red-teaming, evals, guardrail models that decide whether an LLM will say or do something it shouldn't before you ship. That mattered when the product was a chatbot that answered questions.
It stopped being enough the moment the product became an agent that acts. An agent calls tools, moves money, opens pull requests, touches production. The question a buyer actually loses sleep over is no longer "will the model misbehave in a benchmark?" It's "what is this running agent allowed to do, can I see what it did, and can I stop it?" That's a runtime question, and 2026's money followed it there — rounds increasingly emphasize access control, audit trails, behavior visibility, and intervention at execution time.
An agent that passed every pre-ship eval can still do real damage with one over-broad token in production. The eval graded the model; nobody graded the permissions.
The cap table is the clearest evidence#
You don't need a threat report to see the shift — read the funding. One analysis counts roughly $3.6B raised across ten agentic-AI-security startups in 2026, and the named rounds map the category cleanly:
- Onyx — the anchor this week: a reported ~$113M Series B to deploy enterprise agents securely at scale, managing per-agent permissions, monitoring activity, and blocking the risks of autonomous action.
- Oasis Security — a reported ~$120M round for non-human identity and agentic access governance: the thesis that agents need managed identities the way humans need IAM. (We mapped that attack surface in the non-human-identity founder playbook.)
- XBOW — a reported ~$120M Series C at a $1B+ valuation for autonomous offensive security: agents that attack your systems to find the holes before someone else's agents do.
- RunSybil — a reported ~$40M, founded by OpenAI's first security hire — frontier-lab security talent pointed straight at agents.
Earlier in the summer, Patronus AI raised $50M to build "digital worlds" that stress-test agents — the test-them corner of the same board. Put the pieces together and the category isn't one product; it's a stack: identity, permission, monitoring, intervention, and adversarial testing, each with a funded contender. (Numbers here are reported by outlets — verify against first-party announcements before you build a pitch on them.)
What a founder should actually do this week#
The instinct when a category gets $3.6B is to assume it's for enterprises and ignore it. Wrong read. The money is telling you where the liability is — and the liability is yours the day your agent touches a customer's data or your own production.
**If you sell agent infrastructure:** security and governance is the wedge with budget behind it. Buyers who won't pay for a marginally better agent will pay to deploy the agents they already have without getting fired. "Deploy your agents safely" outsells "our agent is 3% smarter."
**If you deploy agents — even a one-person shop:** you don't need to buy an enterprise platform to adopt the lesson. Three moves, all buildable yourself:
- Least privilege, always. Scope every agent to a narrow, per-task credential — never your root API key. Start with how to scope agent permissions to least privilege and the deeper cut in fine-grained authorization for AI agents.
- A real identity per agent, so you can revoke and audit each one independently. That's the "non-human identity" the funded startups are productizing — and the reason verified authorization for agent actions is drawing so much crawler and reader demand.
- A kill path and a log. Record every tool call, and keep the ability to stop a running agent — the capability we argued became its own category. For the human-gate version, wire in a human-in-the-loop approval step on the calls that move money.
The through-line#
Strip the logos away and 2026's AI-security market is making one claim with its checkbook: the control plane for agents is inevitable, the way IAM was inevitable for cloud. Enterprises will not let autonomous software act on production systems without identity, permission, and oversight — any more than they hand a new employee root and hope. Some of this year's valuations will look rich later; the demand under them won't. Investors just spent $3.6B pricing the leash, not the agent. Build accordingly — and if you're choosing where the durable moats sit, that's the same map we drew in control the agents vs own a regulated vertical.



