The term “AI sprawl” is increasingly frequent in discussions on tech platforms and in leadership circles as businesses ramp up the deployment of AI agents. Chief Information Security Officers (CISOs), however, are grappling with a novel challenge linked to this phenomenon: the surge of vendors eager to assist in securing these widespread agents.
A quick search through public databases like Crunchbase and PitchBook reveals at least 24 companies dedicated to AI agent security. These vendors offer various services, from vetting the tools agents utilize to managing the data access these agents require. For instance, CrowdStrike is focusing on developing detection and response systems for the devices housing the agents, while others aim to identify and manage unauthorized AI usage.
While the specifics of their solutions may vary, their promises surrounding the discovery and governance of agents are strikingly similar, often incorporating elements like knowledge graphs, real-time monitoring, and security controls.
Some companies are pivoting towards this evolving market. Take Reco, an AI security startup that prior to last year primarily focused on securing SaaS and AI platforms. It has now adapted to offer a more comprehensive solution that utilizes a context graph to connect agents with applications, individuals, accounts, and permissions. This enhancement allows security teams to monitor which resources agents can access, facilitating the restriction of unnecessary access.
According to Reco’s co-founder and CEO, Ofer Klein, the impetus for this broader focus was the rapid pace at which businesses are adopting AI agents, often outpacing their ability to oversee them. For example, at one Fortune 100 client, Reco discovered 21,000 agents that were previously unaccounted for. In another instance with a large financial services client, the company found an agent established by a former employee that had access to Salesforce and could share that information externally.
Klein emphasized the market's current demand for agent security, noting it encompasses the entire ecosystem, not just individual agents.
This urgency is echoed by Chris Sestito, co-founder and CEO of HiddenLayer, who remarked on the rapid escalation in risk as agents transition into production phases. He noted that over 50 of his clients utilize AI agents that interact with critical systems and sensitive assets.
Additionally, Cymphony, another player in the AI space, discovered roughly 85,000 files that were unintentionally made available to AI tools and agents at one U.S. public organization.
The appeal of providing solutions to identify and secure these agents has not gone unnoticed by investors. Reco recently announced a fundraising success, securing $55 million, building on a previous $30 million in February. Notable investors include AT&T's venture arm, alongside Forestay and Quadrille Capital.
Klein revealed that since February, the startup’s valuation has “more than doubled,” though he refrained from disclosing exact figures, suggesting it hovers in the “high hundreds of millions.” He also indicated that their current annual recurring revenue stands in the “double-digit millions” and anticipates tripling by the year’s end. The company boasts over 100 clients, with financial services companies constituting approximately 40% of its customer base.
Reco aims to leverage its existing capabilities in securing SaaS applications and the AI agents associated with them to differentiate itself in a competitive landscape. Currently, it integrates with over 280 applications, with the potential for new integrations to be completed within days. The platform employs browser and network signals to detect agents that exist beyond the apps it directly connects to, along with features to monitor requests and tool interactions.
The latest funding will be directed towards hiring, enhancing sales efforts, fostering partnerships, and bolstering customer support. With this infusion, Reco's total capital raised climbs to $140 million.
