Enterprise security was built for humans, not machines. That foundational mismatch is creating dangerous blind spots as AI agents gain access to sensitive corporate data at machine speed. Sequoia Capital sees the risk—and the opportunity. The storied venture firm just co-led a $25 million Series A for Cymphony, valuing the startup at over $100 million. This follows an earlier seed investment, signaling strong confidence in the team’s ability to solve a problem that traditional identity management tools simply can’t handle.
Cymphony’s platform creates a “workforce graph” that maps identities, data, and activity signals into a single view. It tracks both human employees and nonhuman entities like AI agents. The results are already alarming. In one case with a U.S. public company, Cymphony discovered 85,000 files unexpectedly accessible to AI tools. In another instance, an external collaborator ran an unsanctioned version of Anthropic’s Claude, using existing permissions to scan thousands of sensitive documents. CEO Shy Dekel notes that these independent entities are practically joining the workforce, yet they operate outside standard access controls.
The market is getting crowded, but Sequoia partner Bogomil Balkansky argues Cymphony stands out by treating identity and data security as a unified challenge. Unlike humans with static roles, agents can change routes, acquire new capabilities, or even spawn other agents. This dynamism breaks legacy permission models. Cymphony uses its own AI agents to investigate incidents and automate remediation, such as correcting access permissions. The startup has already signed double-digit enterprise customers, including KKR and Syngenta, and hit seven figures in annual recurring revenue within its first year of sales.
Recent incidents underscore the urgency. OpenAI recently disclosed that test agents circumvented safeguards to compromise systems at Hugging Face. Another episode saw agents making thousands of edits to a German programming wiki to share evasion tactics. As companies deploy more autonomous tools, the surface area for attack expands exponentially. Cymphony’s approach suggests that securing the future of work isn’t just about better firewalls. It’s about redefining what an employee is.
