When organizations open the door to AI tools across their workforce, they also open the door to unpredictable behavior. Employees use these tools in ways that security teams rarely anticipate, and that reality is quietly creating what many experts believe are significant new vulnerabilities inside corporate systems - vulnerabilities that, in many cases, already exist without anyone knowing it.

The speed at which this is happening is striking. Shahar Bahat, CEO and co-founder of Pluto Security, says a newly released AI tool can find its way into a company's environment within two hours of its public launch. More telling, roughly 60% of the risks her company detects across its customer base originate not from developers, but from employees in functions like finance, marketing, and legal who are building their own AI-powered tools without formal engineering training. Finance departments represent the largest source of such risks, followed by marketing and then legal teams. Developers, despite their technical background, rank fourth.

One case her team uncovered illustrates the problem clearly. A finance employee at a Fortune 500 company had built a vibe-coded application - software assembled using AI assistance rather than traditional programming - to manage customer information and track churn. The app had been left exposed to the open internet, creating a potentially serious data security risk that went undetected until Pluto's tools flagged it.

A New Security Startup Emerges From Stealth With $42 Million

Pluto Security has now stepped out of stealth mode, announcing $42 million in total funding. The company is part of a growing wave of security startups responding directly to the challenges that widespread AI adoption is creating inside enterprises. Investors are backing these ventures in large numbers, driven by the belief that conventional security software - tools designed for a different era of computing - is fundamentally ill-suited to monitoring and controlling AI agents, connectors, and the behaviors they exhibit.

Pluto's funding is structured across two rounds. The first was an $8.5 million seed round led by TLV Partners, with participation from the founders of cybersecurity firm Armis. The second was a $34 million Series A led by Jump Capital, with contributions from Skinos - the venture firm founded by Check Point co-founder Shlomo Kramer - along with Ansa Capital and several angel investors.

Despite only beginning commercial sales in April of this year, Pluto has already crossed $2 million in annual recurring revenue. The company counts more than 30 enterprise customers, including Oscar Health, Workato, Sixt, and AlphaSense. That level of early traction is notable, though not without precedent in the current AI investment climate.

Risks Found in Every Single Proof of Concept

Bahat is candid about what her team encounters when they begin working with new customers. The nature and severity of the risks they find tend to vary depending on how open an organization's leadership is to AI adoption and how proactively the security team approaches governance. But the presence of risk itself appears to be universal.

"In general, I'll say there was not one POC in which we entered and didn't find malicious stuff. Whether those are extension packages or skills - some of them had active live attacks while we did the POC. Which again, for me, product-wise is amazing. For the companies, it's not very good."

The fact that active attacks were underway during initial proof-of-concept evaluations underscores the urgency Pluto is trying to communicate to potential customers. These are not theoretical risks sitting on a horizon - they are incidents happening in real time inside organizations that believed their existing security posture was sufficient.

Shifting Focus From User Behavior to Agent Behavior

The core premise behind Pluto's technology is that the rise of AI agents - software that can take autonomous actions, make decisions, and interact with other systems - demands a fundamentally different approach to security monitoring. Traditional security tools track what human users do. Pluto's argument is that security teams now need to track what AI agents do, in real time, and intervene when those agents behave in ways that exceed their intended scope.

"We're moving from user behavior to agent behavior," Bahat said, summarizing the shift her company is built around.

To put that into practice, Pluto's platform monitors the AI tools employees are using, along with the skills, extensions, MCP servers, and other components those tools depend on. It also tracks the applications and agents that employees themselves are building and deploying. The system is designed to identify risky components, flag potentially dangerous agent activity, and apply security policies - all without blocking employees from continuing to use or build AI tools.

On the technical side, Pluto integrates with endpoint security and device management systems, deploying its own sensors either through those existing systems or directly onto devices. It collects data including prompts, commands, running processes, permissions, and users' historical activity. Lightweight models running on endpoints help the system assess what an agent is attempting to do at any given moment.

Real-Time Intervention During Agent Sessions

One of the more distinctive capabilities Pluto has developed is the ability to intervene while an agent is actively working - not just flag activity after the fact. If an agent attempts to acquire permissions beyond what the user originally intended, the platform can halt that specific action or inject instructions directly into the session, prompting the agent to pause and request explicit confirmation before proceeding.

"We can inject context back to the session, and this way I can change how the agent is working," Bahat explained. This kind of mid-session intervention represents a meaningful technical distinction from security tools that primarily analyze logs or generate alerts after an event has already occurred.

Plutonium: A Free Community Tool That Also Feeds the Sales Pipeline

Pluto has taken an unconventional path to customer acquisition. In April, the company launched Plutonium, a free platform that allows anyone to evaluate the risks associated with publicly available AI skills, connectors, and add-ons. The platform also includes an MCP scanner and a catalog of verified components that security professionals can reference.

Bahat says thousands of security professionals are now using Plutonium, and the community that has formed around it has become a meaningful source of both product feedback and prospective enterprise customers. According to Bahat, 70% of Pluto's current sales pipeline comes from inbound interest, though she did not specify what proportion of that inbound activity is directly attributable to Plutonium.

The strategy reflects a broader trend in enterprise security, where free tools and developer communities have become effective entry points for building trust with technical buyers before converting them into paying customers.

Plans for the New Capital

Pluto says it intends to put the newly raised funding toward three primary areas: continued product development, expanded security research, and growing its footprint in the United States market. The company currently employs 40 people across offices in the U.S. and Israel.

The broader context in which Pluto is operating is one of rapid change. As AI tools proliferate across every department of every kind of organization - not just technology companies at the frontier of AI adoption - the attack surface available to malicious actors grows correspondingly. Pluto's early commercial results suggest that enterprises are beginning to recognize the scale of that exposure and are actively looking for tools built specifically to address it, rather than adapting existing security infrastructure that was never designed with AI agents in mind.