Enterprises are deploying AI agents en masse, but CISOs are now facing a new kind of sprawl: vendors offering to help manage the chaos.
A review of Crunchbase and PitchBook profiles reveals at least two dozen companies selling AI agent security. Some check the tools agents use, while others control data access. CrowdStrike builds detection controls on devices, and other firms focus on finding unapproved usage.
Products differ, yet their promises to discover and govern agents sound similar. They rely on knowledge graphs, continuous monitoring, runtime security, tool access, and MCP vetting.
Some vendors update existing products to join the trend. Until last year, Reco sold software to map and secure SaaS and AI platforms. It has since repositioned around a broader solution using a context graph to connect agents to apps, people, accounts, and permissions. This gives security teams a way to see what an agent can reach and cut off access it does not need.
Ofer Klein, co-founder and CEO of Reco, says the biggest change over the past year was that companies build and deploy agents faster than they can track them. At one Fortune 100 customer, the platform found 21,000 agents the company did not know about. At a large financial services client, the startup identified an agent set up by an ex-employee that could access Salesforce and share data with a domain the company could not see.
“The market demand right now for agent security is not only about the agent itself; it’s about the entire ecosystem end-to-end,” Klein told TechCrunch in an exclusive interview.
Klein is not alone in stressing the urgency. Chris Sestito, co-founder and CEO of HiddenLayer, noted earlier this month that when agents reach production, the scale of their costs and risk goes from theoretical to “full scale really quickly.” Over 50 of his customers have AI agents in production touching critical systems and sensitive assets.
Cymphony, another AI startup, said it found about 85,000 files that had become accessible to AI tools and agents at one US public company.
Investors are keen on companies that can help secure these agents. On Tuesday, Reco said it raised $55 million, building on a $30 million Series B in February. AT&T, a customer, invested in the extension via its venture arm, as did Forestay and Quadrille Capital.
Klein said the company’s valuation has “more than doubled” since the Series B was first announced in February. He estimated it in the “high hundreds of millions” but would not share specifics. Annual recurring revenue is in the “double-digit millions of dollars,” and he expects it to triple this year. The startup has more than 100 customers, with financial services accounting for about 40% of the business.
Reco’s bet is that its existing coverage of SaaS apps, and the AI agents they increasingly offer, will help it stand out. The company integrates with more than 280 apps, and Klein says new integrations can be added within days. The platform uses browser and network signals to find agents outside apps it connects to directly, and it has controls to inspect prompts and tool calls.
The startup will use the new funding for hiring, sales, partnerships, and customer support. The new funding brings Reco’s total capital raised to $140 million.
What it means
Security teams now face a practical problem: they cannot monitor every agent manually. Tools that map the entire environment, including hidden agents and ex-employee access, become essential for basic governance.
