AI Agent Security Market Splits Into Specialized Control
The market for securing AI agents is emerging not as one broad category but as a collection of specialized control points, with early M&A and funding
AI agents are rapidly entering enterprise environments, performing tasks like browsing the web, writing code, and accessing internal systems. This shift creates a new security frontier where companies must protect not only users and devices, but also the autonomous software actors that act on their behalf.
As enterprises scale from experimenting with a few agents to deploying hundreds, these agents become a new class of enterprise identity. An agent with permissions to access files, query databases, or execute code requires its own governance, monitoring, and security controls. According to a guest article by strategic adviser Itay Sagie on Crunchbase News, the challenge is that agent identities are not passive; they can move between systems, invoke tools, and make decisions, making them more complex to manage than traditional user accounts.
The value will sit in specific control points
The market is unlikely to develop as one monolithic 'AI security' category. Instead, Sagie argues the real opportunity lies in specific control points. Different companies will specialize in distinct security layers, such as protecting agent identity, controlling the data an agent can access, or focusing on prompts, plug-ins, or auditability.
Early market activity reflects this specialization. For instance, Kiteworks recently acquired Israeli startup Bonfy.AI, which focuses on real-time data classification and policy enforcement. Separately, Israeli cybersecurity startup Huskeys raised a $27 million Series A round led by Blackstone. Huskeys focuses on understanding and securing complex internet traffic, including traffic generated by autonomous systems.
These control points are creating a new M&A map
This fragmentation is creating a new map for mergers and acquisitions. Established vendors in adjacent fields will likely seek to extend their capabilities into agent security. Identity providers may add governance for autonomous agents. Data-security vendors will need to control what information agents can access. Major cybersecurity platforms, cloud companies, and enterprise software vendors may eventually need to embed agent-security capabilities directly into their products.
For entrepreneurs, Sagie suggests that positioning a company broadly in 'AI security' may already be too vague. The more critical question is what specific control point the company's technology governs. The emerging landscape points to a future where security is built in layers, each addressing a distinct part of the agent lifecycle and its interactions with enterprise systems. The recent acquisition and funding deals provide early signals of how this specialized market is beginning to take shape.
