AI security risks are giving enterprise security teams a serious new headache. Pluto Security just raised $42 million to help companies get those risks under control.
The core problem is simple: when everyone in a company gets access to AI tools, people will use them in unexpected ways. That reality is steadily seeding fears that companies now have new, gaping security holes in their systems — or at least will soon.
Shahar Bahat, CEO and co-founder of Pluto Security, illustrates the pace of AI tool adoption driving those fears. She says a newly announced AI tool can show up inside a company’s environment within a mere two hours of its release.
Where AI Security Risks Hide
About 60% of the risks Pluto detects across its customer base are in tools vibe-coded by non-developers. Finance departments are the biggest source of such risks, followed by marketing and legal teams. Developers rank fourth.
Pluto’s tools once found a vibe-coded app made by a finance employee at a Fortune 500 company to manage customer information and churn. The app was left exposed to the internet.
Pluto, fresh out of stealth with $42 million in funding, is the latest in a new crop of security startups that have quickly sprung up to help companies address these gaps. All of them are raising big money from investors on the conviction that only using existing security software to monitor and control AI tools, connectors, and usage is a square-peg-round-hole approach.
Rapid Traction and Strong Investor Backing
Bahat says her startup started selling only in April and has already found takers for its tech, which helps companies gain context, risk analysis, visibility, and control over how their employees use AI tools.
Pluto has already crossed $2 million in annual recurring revenue, with more than 30 enterprise customers, including Oscar Health, Workato, Sixt, and AlphaSense.
Pluto’s funding spans an $8.5 million seed round led by TLV Partners, with cybersecurity firm Armis’ founders also investing. The company recently raised a Series A of $34 million led by Jump Capital, with Skinos (Check Point co-founder Shlomo Kramer’s venture firm), Ansa Capital, and other angel investors participating.
That’s decent traction for a young startup, though not unique in this AI era. But it may be because the breadth of the risk isn’t isolated to large tech companies that lead the AI adoption charts.
Risks Show Up in Every Assessment
When asked where she’s seeing the biggest risks, Bahat said the issues are differentiated by the mindset of the CISO and how willing the organization is to adopt AI. But there were risks to be found anyway.
“In general, I’ll say there was not one POC in which we entered and didn’t find malicious stuff,” she said. “Whether those are extension packages or skills — some of them had active live attacks while we did the POC. Which again, for me, product-wise is amazing. For the companies, it’s not very good.”
Monitoring Agent Behavior, Not Just User Behavior
Pluto’s entire bet is that securing such environments will require security tools to pay attention to what AI agents are doing in real time, in addition to keeping track of what and how employees are building and deploying.
“We’re moving from user behavior to agent behavior,” Bahat said.
In line with that vision, the startup’s software monitors the AI tools employees use, the skills, extensions, MCP servers, and other components those tools rely on, as well as the apps and agents being created. The company says it can identify risky components, spot potentially dangerous agent activity, and enforce security policies without stopping employees from using or making AI tools.
How the Technology Works
To do all that, Pluto connects to endpoint security and device management systems. It can deploy its own sensors through them or directly onto devices.
It gathers information, including prompts, commands, running processes, permissions, and users’ previous activity. It then uses its own “lightweight” models on endpoints to help assess what an agent is trying to do.
What stood out is that Pluto’s system can intervene while an agent is working, Bahat said. If an agent tries to gain permissions beyond what a user intended, for example, the system can stop the action or add instructions into the session that prompt the agent to ask for confirmation.
“We can inject context back to the session, and this way I can change how the agent is working,” Bahat explained.
Plutonium: A Free Platform for Security Professionals
The startup also takes an unusual approach to finding customers. In April, it launched Plutonium, a free platform that lets anyone check risks associated with publicly available AI skills, connectors, and add-ons.
There’s also an MCP scanner and a catalog of verified components. Bahat claims thousands of security professionals use Plutonium and that the community around it has become an important source of feedback and prospective customers.
She said 70% of Pluto’s sales pipeline now comes from inbound interest, although she didn’t break down how much of that comes directly through Plutonium.
What’s Next for Pluto Security
Pluto plans to invest the new capital in developing its product, expanding its security research efforts, and growing its presence in the U.S. It has 40 employees in the U.S. and Israel.
As AI tool adoption accelerates across enterprises, the AI security risks that Pluto is targeting are only likely to grow. The company’s bet is that real-time agent monitoring — not just traditional user behavior tracking — will be essential to keeping those risks in check.
