Cymphony Raises $25M Series A for AI Agent Security

A single AI agent can inherit access paths built over years of human work, then move through files and systems faster than the security stack can explain what it touched. Cymphony is financing a control layer for that problem.

Cymphony launched publicly on September 9, 2026 with $30M in total disclosed funding. TechCrunch and Calcalist identify a $25M Series A co-led by Sequoia Capital and SMBC Fin Atlas Beyond Fund, following a $5M Seed led by Sequoia. The round gives the New York- and Tel Aviv-based company more capital to connect identity and data security around a workforce that now includes employees, contractors, machines, and autonomous software.

The announcement matters because enterprise AI adoption can outrun the controls built for human access. An employee usually has one job, recognizable working patterns, and permissions that change slowly. An AI agent can act on the employee's behalf, traverse several applications, acquire new capabilities, and search far more data before a security team understands the effective reach of the account behind it.

What Cymphony Announced

Cymphony's official launch release describes $30M in funding co-led by Sequoia Capital and SMBC Fin Atlas Beyond Fund. TechCrunch reports that the current transaction is a $25M Series A at a post-money valuation above $100M. Calcalist separately reports a $5M Seed led by Sequoia, bringing the disclosed total to $30M.

The distinction keeps the capital accounting honest: $25M is the new Series A, while $30M is total funding across the Seed and Series A. Sequoia confirms that it led the Seed and returned to co-lead the Series A, although the investor does not publish the round amounts or valuation. Ownership, check sizes, board changes, and the exact closing date remain undisclosed.

The second co-lead deserves its full name. The SMBC Fin Atlas Beyond Fund is a $300M U.S.-focused corporate venture vehicle created by Sumitomo Mitsui Banking Corporation with Fin Capital. Cymphony's website and intake materials use the shorter Fin Capital name, while the wire release names the underlying SMBC fund.

The Workforce Graph Behind the Funding

Cymphony combines identity, access, data, and activity signals into what it calls a workforce graph. The platform continuously maps employees, AI agents, other non-human identities, the systems they can reach, and the sensitive information exposed along those paths. It then prioritizes material risks, recommends or automates remediation such as permission changes, and coordinates the work that still requires a person.

That design moves beyond inventory. An identity tool can show that an agent exists, while a data-security product can flag a sensitive file. Cymphony's thesis is that an enterprise also needs the relationship between them: which agent is acting for which employee, what inherited permissions make possible, what behavior followed, and who should close the exposure.

The official site groups the product around AI, Data, Identity, Threat Center, and Maestro Security Assistant. Cymphony also describes agentless ingestion, a graph-based context model, AI enrichment, unified profiles, and integrations with Slack, email, and ticketing tools. The result is meant to reduce the distance between detecting a risky access path and fixing it.

Three Founders and a Second Sequoia Check

Cymphony was founded in 2024 by Shy Dekel, Idan Berkovits, and Erez "Edi" Gotlieb, all graduates of Israel's Talpiot program. Shy Dekel, co-founder and CEO, spent nearly six years in Unit 8200 and rose to lead its cyber department. Idan Berkovits, co-founder and CPO, ran a research group in the Office of the Prime Minister of Israel. Edi Gotlieb, co-founder and CTO, worked in hardware engineering at Apple and the Israeli Ministry of Defense.

Sequoia's first decision was largely a bet on those founders. Partner Bogomil Balkansky told TechCrunch that the Seed arrived before Cymphony had a product or settled direction. By the Series A, the company had turned its original human-risk work toward AI agents and assembled enough customer evidence for Sequoia to invest again.

That arc is more useful than founder mythology. The same backgrounds that helped the team see fragmented access also create a demanding promise: Cymphony must translate deep security experience into software that ordinary enterprise teams can deploy, understand, and trust with remediation decisions.

Early Enterprise Evidence and Its Limits

Cymphony told TechCrunch that it signed a double-digit number of enterprise customers and reached seven figures in ARR within its first year of sales. Named customers include Syngenta, KKR, Cass Information Systems, and Athennian. Sequoia says it has also used the product since early in development, and Cymphony has about 30 employees across Tel Aviv and New York.

The company offered a sharper example from one unnamed U.S. public company, where it says the platform found approximately 85,000 files exposed to AI tools and agents. Cymphony says it helped close the exposure and verified that the files had not been accessed through those AI systems. The identity of the customer and an independent audit are not available, so the result should be read as a company-reported case study.

The case still makes the commercial problem legible. Permission debt accumulates quietly when employees change roles, contractors keep access, files are shared broadly, and service accounts outlive the project that created them. AI agents can turn that slow administrative residue into an active path across thousands of files, making access context more valuable before an incident than after one.

Why AI Agent Security Is Becoming a Category Fight

Cymphony is entering a busy market. Microsoft, Okta, CyberArk, Wiz, Varonis, and newer security companies are expanding around identity, data, and AI-agent controls. Balkansky told TechCrunch that enterprises currently tend to use Cymphony as an additional layer, even as the startup sees opportunities to replace some point products over time.

That positioning defines the business risk. A new security layer can win when the old categories leave an important relationship invisible, but it can lose when incumbent platforms add enough of the same context to satisfy existing customers. Cymphony must show that joining identity and data around agent behavior produces faster investigations, fewer meaningful exposures, and remediation that earns trust rather than another dashboard demanding attention.

The named customers give Cymphony a credible starting point across agriculture, finance, payments, and legal operations. The company-reported ARR suggests willingness to pay, but exact revenue, retention, customer concentration, pricing, margins, and audited outcomes remain undisclosed. Those measures will determine whether agent security becomes a budget line or a temporary feature race.

What the Series A Changes

Cymphony says the funding will accelerate product development and expand its engineering and go-to-market teams. Its careers page shows U.S. sales roles alongside backend, frontend, product design, and DevOps openings, matching the stated plan to deepen the product and sell it into more enterprises.

The capital buys time to make the workforce graph broader, more accurate, and more useful during remediation. Each new integration also increases the obligation to preserve context, permissions, data quality, and customer trust across systems that were never designed to share one security model.

Cymphony's next phase will play out inside the approvals enterprise AI still struggles to earn. Every agent that moves from a pilot into production creates another reason for security teams to know whose access it inherited, which information it can reach, and whether the answer can be corrected before machine speed turns an old permission into a live event.