As accessible AI tools like Claude Code, Codex, and low-code platforms allow non-technical employees to build complex automations, the traditional perimeter of enterprise cybersecurity is fracturing. Workers across finance, healthcare, and operations are no longer just consuming approved SaaS tools. They are actively assembling custom AI agents, linking Model Context Protocol (MCP) servers, and embedding third-party community skills directly into their daily workflows.
This shift toward decentralized vibe-coding has created a massive governance blind spot for chief information security officers. Stepping out of stealth to tackle it, Pluto Security announced $42 million in total funding, comprising an $8.5 million seed round led by TLV Partners and a $34 million Series A led by Jump Capital.
Founded by veterans of Microsoft, Palo Alto Networks, and Israel's Unit 8200, Pluto has already secured over 1 million endpoints, generated more than $2 million in annual recurring revenue since April 2026, and signed over 30 major enterprise clients, including Oscar Health, Workato, Sixt, and AlphaSense.
What Pluto Security does | Four layers over the AI workspace
Pluto builds a specialized governance and security layer designed for the AI workspace, the environment where employees use AI tools and create custom agents, automations, and applications. Instead of imposing rigid blanket bans that stifle productivity, the platform monitors employee intent, supply chain dependencies, and runtime behavior to enforce precise safety guardrails.
The architecture splits into four components. Explorer provides continuous discovery of AI tools, custom agents, and shadow applications. Risk Radar delivers contextual risk analysis powered by the Plutonium AI supply chain database. Space Shield handles real-time enforcement that blocks dangerous actions such as unauthorized API calls. Marketspace offers a curated, vetted repository of safe enterprise AI skills and MCP connectors.
Action-level control vs. the blanket block
Traditional security mechanisms struggle because blocking whole applications stalls business momentum. Pluto's differentiation is granularity. If a user asks an approved AI assistant to summarize a customer record, Pluto allows the request. If that same agent attempts to export an entire database or ping an unverified payment API, Pluto intercepts and blocks that specific action in real time while leaving the rest of the workflow intact.
The platform also inspects the supply chain behind every connection. When an employee links an AI agent to a third-party extension, community skill, or MCP server, Pluto maps what data sources and internal APIs that extension can reach, flagging over-privileged credentials or malicious skills before execution. It indexes the hidden artifacts standard Endpoint Detection and Response agents overlook, including custom scripts, local vector databases, and user-built workflows.
That scope problem is exactly what the developer community is working through in public. The GitHub Universe 2026 agenda includes a session on fine-grained authorization for hosted MCP servers, where Pomerium's Nick Taylor argues that AI agents should draft pull requests without ever holding global merge permissions. Pluto productizes the same principle one layer up, across every tool on the endpoint.
The pressure to govern these agents is rising because adoption is no longer optional. OpenAI Dots run persistent agents on dedicated cloud VMs with deep app integrations, and Microsoft Autopilot and Meta Muse are competing for the same autonomous workflow layer. Each deployment multiplies the number of credentialed agents an enterprise must account for.
Intent over isolation | The Plutonium database
Shahar Bahat, CEO and co-founder of Pluto Security, framed the approach around velocity rather than restriction. Security has traditionally been built around stopping things, he explained, but that model breaks down when the business is moving faster than security can evaluate every new tool. Pluto instead focuses on understanding employee intent rather than relying entirely on blunt restrictive controls.
Part of Pluto market expansion stems from Plutonium, its free, community-driven AI risk database. Powered by proprietary data from RisksDB, Plutonium acts as a public catalog detailing the safety profiles, hidden behaviors, and permission scopes of thousands of AI extensions and skills. By making that research freely accessible to security professionals, Pluto has built a dominant inbound sales engine and positioned itself as a central player in the emerging AI workspace governance market.
The free-database strategy also reflects how the local AI movement is reframing data risk. Devices like the $3,499 Ghost Core personal AI computer eliminate cloud egress entirely, but enterprise reality is hybrid, and that hybrid surface is precisely where Pluto sells. The same human-in-the-loop logic appears in agentic commerce deployments like Grok and Stripe Link, where final approval on a financial action stays with the person.
As agentic systems take on more autonomous execution, the governance question is shifting from policy documents to runtime enforcement. The broader superintelligence governance debate asks how much autonomy to grant systems that can act, not just converse. Pluto is answering that question at the enterprise endpoint, one blocked action at a time.