Obsidian Security Raises $85M Series D for AI Agent Security

Obsidian Security has raised $85M in Series D funding to expand its security platform for enterprise SaaS applications, third-party integrations, and AI agents. Crescent Cove Advisors led the round, which Axios reported values the Newport Beach cybersecurity company at $1.1B post-money.

The financing arrives as enterprises move from experimenting with AI assistants to giving agents access to business-critical applications and data. That changes the security question from “Which model should we use?” to “What can this agent reach, what permissions did it inherit, and who notices when those permissions drift?” Obsidian is betting that the control layer for AI will be built on the same identity and application graph it has spent years developing for SaaS.

What Happened

The $85M Series D was led by Crescent Cove Advisors. Axios named Greylock and Menlo Ventures among the participating investors, while Obsidian's official company page says all existing investors backed the round. Axios also reported a $1.1B post-money valuation, giving the company unicorn status without requiring anyone to pretend cybersecurity suddenly became a simple business.

The round follows Obsidian's $90M Series C in April 2022. At that time, the company said it had raised $119.5M in total financing. Adding the new round brings disclosed financing to at least $204.5M, although that figure is a calculation based on the two company disclosures rather than a newly announced company total.

Obsidian was founded in 2017 by Ben Johnson, Glenn Chisholm, and Matt Wolff. The current executive team includes CEO Hasan Imam, CTO Xinran Wang, Chief Product Officer Khanh Tran, and co-founder and Chief AI Officer Matt Wolff. The company has not disclosed a detailed spending breakdown for the Series D, but says the capital will support its effort to scale trust and control across the third-party applications that AI agents touch.

Why This Matters

Enterprise AI agents do not operate in a clean room. They connect to Salesforce, Microsoft 365, Workday, GitHub, collaboration tools, support systems, data platforms, and a long tail of specialized SaaS products. Each connection carries permissions, tokens, configurations, and data-sharing rules that may have accumulated over years.

That is where the market problem gets expensive. An agent can inherit access that was already too broad, use an integration nobody remembered approving, or move sensitive information through a setting that looks harmless until automation scales it. The risk is not limited to malicious models. Ordinary configuration drift and stale privileges become more consequential when software can act across systems at machine speed.

Obsidian's thesis is that security teams need a unified view of identities, permissions, application activity, integrations, and data flows before they can safely govern agent behavior. The company has expanded from SaaS posture management and identity threat detection into AI agent visibility, governance, and runtime controls. That transition is less a pivot than an acknowledgment that agents are becoming another identity class inside the enterprise.

Product and Market Context

Obsidian says its platform now provides visibility and posture coverage across more than 200 enterprise applications and connectors. The breadth matters because application security becomes unreliable when critical parts of the SaaS estate remain invisible. A single uncovered integration can become the missing section in an incident timeline or the forgotten account that survives an employee's departure.

The company's 2026 product work illustrates how that footprint is being extended into AI. Obsidian launched an AI Agent Security Foundation designed to map agent permissions and block high-risk actions at runtime. It also announced a Claude Compliance API integration that monitors risky configuration settings around sharing, accounts, sessions, and data retention.

Obsidian also reports significant enterprise adoption, including 10 of the top 12 financial services firms, 2 of the top 3 telecommunications carriers, and 3 of the top 5 healthcare providers. Those figures are company-reported, but they point to the buyer profile: large organizations with complicated application estates, regulated data, and little appetite for discovering access failures through an incident report.

What the Series D Signals

Crescent Cove's investment suggests that AI security is moving beyond model testing and prompt controls into the operational plumbing of enterprise applications. Greylock and Menlo Ventures participating alongside the lead investor reinforces a longer-running thesis that identity, SaaS posture, and application activity belong in one security view.

The timing also says something about enterprise software. AI agents promise faster work by crossing application boundaries, but every boundary they cross carries a trust decision. Companies can either map those decisions deliberately or let automation inherit the mess. Obsidian's new funding is a wager that boards and security leaders will choose visibility before speed turns ambiguity into liability.

For operators, the practical lesson is not to slow AI adoption. It is to treat every agent as an identity with permissions, data access, integrations, and runtime behavior that must be observed. The companies that build that discipline early may move faster because they know what their automation can reach and where the controls actually sit.

The Bigger Industry Shift

Cybersecurity categories often appear after the architecture has already changed. SaaS security grew because business applications moved beyond the direct control of infrastructure teams. AI agent security is now emerging because software is gaining the ability to act across that fragmented environment.

Obsidian Security's $85M Series D gives it more capital to compete for that control layer. The hard part will not be explaining that AI creates risk. The hard part will be proving that one platform can see enough of the application estate, interpret enough of its trust relationships, and intervene quickly enough to make enterprise automation safer without turning every useful agent into a help-desk ticket.