Pluto Security raises $42 million to secure the AI tools employees build themselves
Pluto Security, an Israeli-American startup in "AI workspace security," came out of stealth mode on October 13, 2026 with $42 million in total funding. The company began selling in April of the same year and already claims more than $2 million in annual recurring revenue (ARR) and dozens of customers. But the most striking element of the company's message is not the growth figures – it is the claim that most AI-related security risks in its customer base do not come from developers, but from employees without technical backgrounds who build their own tools with AI assistance.
The money and the investors
The funding consists, according to TechCrunch, which first reported the news, of an $8.5 million seed round led by TLV Partners and a $34 million Series A led by Jump Capital. Other investors include Skinos – the venture firm of Check Point founder Shlomo Kramer – Ansa Capital and AlphaDrive Ventures, according to Calcalist/CTech. Individual investors include Armis founders Yevgeny Dibrov and Nadir Izrael as well as a16z partner Assaf Ezra.
It is worth noting that Unite.AI pointed out that the company's own announcement did not specify which round the most recent tranche of roughly $34 million was; the "Series A" designation comes from TechCrunch. The capital is, according to The Next Web, to be used for product development, research and expansion in the US.
What Pluto actually sells
The company, founded in 2025, describes its category as "AI workspace security" – security for a company's entire AI workspace. The scope covers, according to Unite.AI, three layers: the AI tools employees use, the components that connect to those tools, and the apps, agents and automations employees build themselves.
The latter category is the relatively new one. With so-called "vibe-coding" tools, people without developer backgrounds can create working apps and automations by describing what they want in natural language. Pluto claims that employees in its customer base use hundreds of so-called supply chain components – skills, extensions and MCP servers – while building thousands of applications.
Technically, the sensors are deployed via companies' existing endpoint security systems, according to TechCrunch. On its website, the company divides the platform into four functions: Explorer (detects AI activity), Risk Radar (evaluates findings against a risk database called RisksDB), Space Shield (enforces policies) and Marketspace (a curated selection of AI add-ons). These descriptions come from the company's own materials and have not been independently tested.
The most notable capability is the ability to intervene in an agent session while it is ongoing. "We can inject context back into the session, and that way I can change how the agent is working," founder and CEO Shahar Bahat told TechCrunch. In practice, this means the security tool does not just monitor, but can actively redirect an AI agent that is about to do something unwanted.
The numbers – and the discrepancies in them
The commercial traction figures vary between sources, all of which rely on the company's own information:
- ARR: Over $2 million, according to Bahat, speaking to TechCrunch. FinanceWire describes it as "several million dollars."
- Customers: TechCrunch reports "over 30" enterprise customers, while FinanceWire, citing the company, reports "over 40." The difference is not explained anywhere.
- Endpoints: Over 1 million secured endpoints globally, according to company figures reported by FinanceWire.
- Employees: TechCrunch reports 40 employees in the US and Israel; The Next Web and FinanceWire report over 50.
- Customer names: Oscar Health, Workato, Sixt and AlphaSense are named in both sources; FinanceWire adds that the company also serves Fortune 500 organizations.
All of these figures are thus the company's own claims, made in connection with a funding round, and no independent verification exists.
The core message: the risk is not in the IT department
Pluto's central sales argument is a picture of where security risk actually sits. Roughly 60 percent of the risks the company detects across its customer base lie, according to Bahat, in tools built by non-developers with AI assistance. Finance departments are the largest source, followed by marketing and legal. Developers come in fourth.
Bahat also claimed that every single proof of concept Pluto has run has uncovered malicious content. "Generally speaking, I'd say there wasn't a single POC that we came into where we didn't find malicious stuff," Bahat told TechCrunch, adding: "Whether it's extension packs or skills – some of them had active, live attacks while we were performing the POC."
If the claims hold up, they challenge an established assumption in enterprise security: that risk can primarily be managed through developer tooling, code review and traditional software supply chain controls. When finance staff build their own apps with AI assistance, the attack surface sits in the accounting department – far from the security team's established tools and routines. But there is no independent confirmation of the figures, and they are presented by a company with a direct commercial interest in exactly this picture. That "every POC" shows findings could, for example, also reflect which customers choose to test the product.
The founders and the go-to-market strategy
Bahat founded Pluto together with Tal Ofer Regev and Gil Maman. The trio's background spans Microsoft, Palo Alto Networks, the security company Bridgecrew and Israel's military Unit 8200 – a profile well known in the Israeli cybersecurity scene, and evidently also part of the investors' calculation.
On the go-to-market side, the company launched Plutonium in April, a free platform where anyone can check the risk of publicly available AI skills, connectors and add-ons. The strategy appears to function as a sales engine: 70 percent of the sales pipeline now comes in inbound, according to Bahat. "Hundreds of professionals use it every week, and most of Pluto's pipeline now walks in the door on its own," said Jump Capital partner Saaya Pal, who explained why the firm led the round, to FinanceWire.
What remains to be answered
Several questions are open after the launch. The competitive landscape is untreated in the available information – it is unclear how Pluto differs from established security vendors that already cover parts of the same territory. The effectiveness of the detection, including how precise the risk assessment in RisksDB is, has not been independently tested. And the practical limits of intervening in a live agent session – how often it happens, and what kind of steering is actually sent back to the agent – are not publicly documented.
What is concrete, however, is the funding, the founding team and rapid commercial traction measured in the company's own figures from a business that has been selling for five months. For security teams at companies watching employees build their own AI tools, Pluto's data is at best an early and biased, but immediately relevant, signal about where the next security work may need to happen.