The Emerging M&A Map For AI Agent Security

Enterprise adoption of AI agents is accelerating rapidly. These autonomous systems now browse the web, generate code, handle file access, trigger APIs, and communicate with internal platforms.

While this delivers massive productivity gains, it simultaneously introduces a novel security challenge: organizations must now safeguard software actors capable of executing actions on their behalf, alongside traditional users, devices, and applications.

AI agents are becoming a new class of enterprise identity

Because an agent might query databases, review corporate files, execute code, or dispatch emails, it requires proper governance, monitoring, and permissions. Businesses will need visibility into which systems an agent connected to, the specific data it accessed, and whether its actions remained authorized.

As organizations transition from testing a handful of agents to running hundreds, agent identity will emerge as a vital layer of cybersecurity. Managing these identities proves far more complex than overseeing standard users or service accounts because agents are dynamic—they can make decisions, invoke tools, and navigate fluidly between systems.

The value will sit in specific control points

Rather than shaping into a single, massive category labeled “AI security,” this market will likely center on precise control points.

Firms may specialize in different areas: one might secure agent identities, another might govern permissible data access, and others could concentrate on plug-ins, prompts, Model Context Protocol (MCP) servers, auditability, or traffic management.

Early market activity already reflects this trend. Kiteworks purchased Bonfy.AI, an Israeli startup specializing in real-time policy enforcement and data classification. Simultaneously, Huskeys—an Israeli cybersecurity startup focused on securing complex internet traffic, including autonomous system traffic—secured a $27 million Series A funding round led by Blackstone.

Although these enterprises tackle distinct issues collectively, they highlight how the sector is dividing into specialized security layers.

These control points are creating a new M&A map

Identity governance providers could broaden their scope to include autonomous agents, whereas data-security platforms may need to regulate the information accessible to agents. Over time, enterprise software vendors, cloud providers, and broader cybersecurity platforms will likely integrate agent-security features directly into their offerings.

For startup founders, branding a business simply as “AI security” may already be overly generic. The critical differentiator is defining precisely what aspect of the technology the company controls.

Itay Sagie is a strategic adviser to tech companies, investors, CEOs and boards, specializing in strategy, growth and M&A. He is a guest contributor to Crunchbase News and a university lecturer on strategy, finance and entrepreneurship. Learn more at SagieCapital.com and connect with him on LinkedIn.

Related Crunchbase queries:

• Global M&A In 2026 For Venture-Backed Companies
• Global Venture Funding To AI Startups In 2026
• Global Cybersecurity Venture Funding In 2026

?Frequently Asked Questions

01Why are AI agents considered a new enterprise identity?

Because they independently access corporate files, execute code, and trigger APIs, they require individual permissions, monitoring, and governance similar to human users.

02How is the AI security market likely to develop?

Rather than forming one broad market category, the sector is expected to fracture into specific control points such as identity, traffic management, data access, and prompt security.

03What type of companies are driving early M&A and funding activity?

Startups specializing in real-time data classification, policy enforcement, and internet traffic generated by autonomous systems are attracting notable investments and acquisitions.

Illustration: Dom Guzman