As AI agents gain access to enterprise data and systems, they are emerging as a new class of active identity requiring specialized permissions, monitoring and governance. Companies now need to protect software actors that can take actions on their behalf. This creates enormous productivity potential but also a new security problem, as enterprises move from experimenting with a few agents to deploying hundreds of them.

The market will likely not develop as one broad category called 'AI security.' Instead, real opportunity will be around specific control points. One company may protect agent identity, another may control the data an agent can access, while others may focus on prompts, MCP servers, plug-ins, traffic or auditability. Kiteworks recently acquired Israeli startup Bonfy. AI, which focuses on real-time data classification and policy enforcement. Israeli cybersecurity startup Huskeys raised a $27 million Series A led by Blackstone and focuses on understanding and securing increasingly complex internet traffic, including traffic generated by autonomous systems.

Identity providers may extend identity governance to autonomous agents. Data-security vendors may need to control what information agents can access. Cybersecurity platforms and cloud companies may eventually need agent-security capabilities embedded directly into their products. For entrepreneurs, 'AI security' may already be too broad a positioning. The more important question is what exactly the company controls.

Itay Sagie is a strategic adviser to tech companies, investors, CEOs and boards, specializing in strategy, growth and M&A. He is a guest contributor to Crunchbase News and a university lecturer on strategy, finance and entrepreneurship.