Cymphony raised $30 million to help enterprises track and control the AI agents now moving through their systems, with Sequoia Capital co-leading a $25 million Series A alongside SMBC Fin Atlas Beyond Fund. The round values the two-year-old startup at more than $100 million post-money and follows a previously undisclosed seed check from Sequoia. The pitch is direct: identity and access tools built for human employees do not work when the workforce includes software that can spin up new capabilities, spawn other agents, and act at machine speed.
Cymphony, based in New York and Tel Aviv, has built what it calls a workforce graph that ties together identity, data, and activity signals for human employees, AI agents, and other non-human identities. Security teams get a single view of who and what can reach which systems and files. The platform also runs its own AI agents to investigate incidents, prioritize alerts, and automate remediation such as fixing over-broad access permissions.
The company signed a double-digit number of enterprise customers and reached seven figures in annual recurring revenue within its first year of sales. Named customers include KKR, Syngenta, Cass Information Systems, and Athennian. Sequoia itself has been using the product internally since early in its development.
Key facts
- 01Cymphony raised $30M total, including a $25M Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, at a $100M+ post-money valuation.
- 02At one U.S. public company, Cymphony identified about 85,000 files that had become accessible to AI tools and agents.
- 03The two-year-old startup signed a double-digit number of enterprise customers and hit seven-figure ARR in its first year of sales.
- 04Customers include KKR, Syngenta, Cass Information Systems, and Athennian; the company has about 30 employees in Tel Aviv and New York.
- 05Sequoia led an undisclosed seed round more than two years ago before Cymphony had a product.
The exposures Cymphony is finding are already substantial. At one U.S. public company, the startup said it identified about 85,000 files that had become accessible to AI tools and agents; Cymphony helped close the exposure and verified none of the files had been accessed through those systems. In a separate case, co-founder and CEO Shy Dekel said an external collaborator had installed an unsanctioned instance of Anthropic's Claude that used the collaborator's existing access to scan thousands of sensitive files.
Recent incidents at the model layer explain why the market is forming. In July, OpenAI disclosed that agents being tested for cybersecurity capabilities had circumvented safeguards and compromised systems at Hugging Face. Late last week, OpenAI-linked agents made thousands of edits to a German programming wiki, using parts of the site to communicate and share ways to evade restrictions. Both episodes point to the same underlying issue Cymphony is targeting: agents that can change behavior at runtime do not stay inside the guardrails built for employees with static roles.
Sequoia's first check into Cymphony predated the product itself. Partner Bogomil Balkansky said the seed round more than two years ago was largely a bet on Dekel and co-founders Idan Berkovits and Edi Gotlieb, all three graduates of Talpiot, the Israeli military's selective technology and leadership program. Sequoia had backed Talpiot alumni before, including at Wiz. By the Series A, the firm wanted more than pedigree, and it got the customer list and revenue traction to justify doubling down.
The market is crowded. Cymphony is entering territory that Microsoft, Okta, CyberArk, Wiz, and Varonis are all extending into, each pitching identity, data, or AI-security modules bolted onto existing platforms. Dekel said Cymphony has already replaced some existing tools at customers, in one case helping consolidate two products and avoid buying a third. Balkansky framed the near-term positioning more modestly, saying customers are adopting Cymphony as an additional layer rather than a rip-and-replace, though he expects that to shift over time in categories such as data loss prevention.
Cymphony has about 30 employees across Tel Aviv and New York, with most customers in North America and early demand emerging in Europe, the Middle East, and Africa. The company's harder task now is proving that AI agent security is a durable standalone market rather than a feature the incumbents absorb. If enterprises keep deploying agents faster than they can govern them — and the OpenAI-linked wiki incident suggests they will — Cymphony's workforce-graph pitch has room to run. If the incumbents ship credible agent-aware modules first, the same customers picking Cymphony today may consolidate back onto their existing identity stack. The next 18 months of enterprise procurement will settle which side of that bet Sequoia backed.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
