The problem with giving everyone in a company access to AI tools is that people will use them in unexpected ways. And that fact is steadily seeding fears that companies now have new, gaping security holes in their systems or, at least, will soon.
Illustrating the pace of AI tool adoption within enterprises driving such fears, Shahar Bahat, CEO and co-founder of Pluto Security, says a newly announced AI tool can show up inside companies’ environment within a mere two hours of its release. And about 60% of the risks her company detects across its customer base are in tools vibe-coded by non-developers: Finance departments are the biggest source of such risks, she told TechCrunch, followed by marketing and legal teams. Developers rank fourth, she said.
Her startup’s tools apparently found a vibe-coded app made by a finance employee at a Fortune 500 company to manage customer information and churn, but the app was left exposed to the internet.
Pluto, fresh out of stealth with $42 million in funding, is the latest in a new crop of security startups that have quickly sprung up to help companies address those fears gaps, and all of them are raising big money from investors on the back of the conviction that only using existing security software to monitor and control AI tools, connectors, and usage is a square-peg-round-hole approach.
Bahat tells TechCrunch her startup started selling only in April and has already found some takers for its tech, which helps companies gain context, risk analysis, visibility, and control over how their employees use AI tools. She said Pluto began selling in April and has already crossed $2 million in annual recurring revenue, with more than 30 enterprise customers, including Oscar Health, Workato, Sixt, and AlphaSense.
Pluto’s funding spans an $8.5 million seed round led by TLV Partners, with cybersecurity firm Armis’ founders also investing. The company recently raised a Series A of $34 million led by Jump Capital, with Skinos (Check Point co-founder Shlomo Kramer’s venture firm), Ansa Capital, and other angel investors participating.
That’s decent traction for a young startup, though not unique in this AI era. But it may be because the breadth of the risk isn’t isolated to large tech companies that lead the AI adoption charts.
When I asked Bahat where she’s seeing the biggest risks, she said the issues are differentiated by the mindset of the CISO and how willing the organization is to adopt AI, but there were risks to be found anyway.
“In general, I’ll say there was not one POC in which we entered and didn’t find malicious stuff,” she said. “Whether those are extension packages or skills — some of them had active live attacks while we did the POC. Which again, for me, product-wise is amazing. For the companies, it’s not very good.”
Pluto’s entire bet is that securing such environments will require security tools to pay attention to what AI agents are doing in real time, in addition to keeping track of what and how employees are building and deploying.
“We’re moving from user behavior to agent behavior,” Bahat said.
In line with that vision, the startup’s software monitors the AI tools employees use, the skills, extensions, MCP servers, and other components those tools rely on, as well as the apps and agents being created. The company says it can identify risky components, spot potentially dangerous agent activity, and enforce security policies without stopping employees from using or making AI tools.
To do all that, Pluto connects to endpoint security and device management systems and can deploy its own sensors through them or directly onto devices. It gathers information, including prompts, commands, running processes, permissions, and users’ previous activity, and uses its own “lightweight” models on endpoints to help assess what an agent is trying to do.
What stood out is that Pluto’s system can intervene while an agent is working, Bahat said. If an agent tries to gain permissions beyond what a user intended, for example, the system can stop the action or add instructions into the session that prompt the agent to ask for confirmation.
“We can inject context back to the session, and this way I can change how the agent is working,” Bahat explained.
The startup also takes an unusual approach to finding customers. In April, it launched Plutonium, a free platform that lets anyone check risks associated with publicly available AI skills, connectors, and add-ons. There’s also an MCP scanner and a catalog of verified components. Bahat claims thousands of security professionals use Plutonium and that the community around it has become an important source of feedback and prospective customers.
She said 70% of Pluto’s sales pipeline now comes from inbound interest, although she didn’t break down how much of that comes directly through Plutonium.
Pluto said it plans to invest the new capital in developing its product, expanding its security research efforts, and growing its presence in the U.S. It has 40 employees in the U.S. and Israel.