The short version: on August 3, 2026, agent-security company Zenity raised a $125M Series C led by Norwest (total funding now ~$180M), pitched on one line — secure the era of one billion AI agents. The round is the headline; the signal is that agent security is now a funded layer of the stack, sitting in a gap your model provider does not cover. If you ship agents, that gap is yours until you close it — and the cheapest way to start is an inventory.
| Question the raise answers | Answer |
|---|---|
| Is agent security a real category? | Yes — it's funded, with strategic corporate money in |
| Does my model vendor cover it? | No — they secure the model, not your agent's actions |
| What's the minimum viable control? | Discovery + a deterministic allow/modify/block gate on high-blast-radius tool calls |
The round, and why the investor list is the story#
Zenity, founded in Tel Aviv in 2021, took $125M at Series C led by Norwest, with Qumra Capital, SoftBank Vision Fund 2, Hitachi Ventures, and LG Technology Ventures joining returning backers Intel Capital, Vertex Ventures, Third Point Ventures, and DTCP (SecurityWeek, Fortune). That brings total funding to roughly $180M.
Read the cap table, not just the number. Hitachi and LG are industrial corporates; strategic money like that shows up when a category stops being a research curiosity and becomes something the enterprise has decided it has to buy. This is the same pattern we flagged when agent security first became a funded category — Zenity is now the largest data point in that trend, not the first.
What Zenity actually sells is the shape of the category#
Strip the branding and the product is four jobs. Zenity describes its platform as understanding an agent's intent and then deterministically allowing, modifying, or blocking the action it's about to take (BusinessWire). Unpack that and you get the whole layer:
- Discover the agents, copilots, and automations already running against your systems.
- Read intent — what is this agent about to do, and why?
- Gate the action at runtime: allow, modify, or block.
- Audit — keep a ledger of what ran, on whose authority.
None of those are covered by your model provider. The provider's safety layer stops at the model — it filters text and refuses obvious harm. It has no idea that your agent's next tool call will move money, delete a row, or email a customer, and it can't enforce your rules about which is allowed. The control that can has to live outside the model, because the model itself can be jailbroken into wanting the wrong thing.
The founder read: you own the gap until you don't#
The takeaway isn't "go buy Zenity" — a Series C security platform isn't priced for a team of one. It's that the un-owned middle — the agent holding a credential, acting with no human in the loop — is now expensive enough that a growth-stage company can raise nine figures to sit in it. That means it's expensive for you too, just paid in incidents instead of ARR.
The "one billion agents" framing is the reason. When you run one agent, you review its actions by hand. When traction means fifty agents touching customer data overnight, manual review is gone, and the only thing between a compromised agent and a wire transfer is a gate you built on purpose.
So build the cheap version of the four jobs now:
- Discovery is free and first. You can't secure what you can't list. Start with an inventory of every agent already running in your company — owner, tools, scopes.
- Log every tool call with arguments. Intent you never recorded can't be judged.
- Deny-by-default the high-blast-radius tools — payments, deletes, outbound email — and human-approve the rest. Tie every action to a real agent identity, not a shared service account.
- Keep an append-only action ledger. A dispute needs who/what/when, not a token-usage chart.
That's the DIY version of what Zenity just raised $125M to sell as a product. The company that funded it is betting every enterprise will eventually need the polished version. The move for a founder shipping agents today is to make sure the gap is closed, not that it's closed by them — and to notice that the market has now put a nine-figure price on leaving it open. This is the same instinct behind July's control-vs-vertical funding wave: the money is flowing to whoever owns the agent's boundary.
