Funding Brief｜Cymphony Series A $25M

🌏 中文版

Funding Details

What the company does

Cymphony builds security governance for enterprise "non-human identities" — as AI agents start accessing corporate systems and sensitive data the way employees do, Cymphony gives security teams visibility into what each agent can actually reach and what it's doing.

Its core product is built on what it calls a "workforce graph," combining identity, data-access permissions, and activity signals for employees, AI agents, and other non-human identities into a single view. The platform doesn't just surface risk — it uses AI agents to investigate incidents, prioritize what security teams should tackle first, and automate some remediation, like correcting access permissions; enterprises can also opt for a managed service where Cymphony's own security experts handle complex cases. All three co-founders — CEO Shy Dekel, Idan Berkovits, and Edi Gotlieb — came through Talpiot, the Israeli military's elite technology and leadership program, a pedigree that was a major factor in Sequoia's seed investment two years ago, back when the company hadn't even settled on a product direction.

Current customers include KKR, Syngenta, Cass Information Systems, and Athennian. In its first year of sales, Cymphony signed a double-digit number of enterprise customers and reached seven-figure annual recurring revenue. Sequoia itself uses Cymphony's product internally.

What this round signals

What it means for the agent ecosystem

The specific cases Cymphony disclosed illustrate the scale of the problem: at one U.S. public company, it found roughly 85,000 files that had become accessible to AI tools and agents; in another case, an external collaborator had installed an unsanctioned instance of Claude that used the collaborator's existing access to scan thousands of sensitive files. That means enterprises currently have almost no visibility into what data their agents have actually touched — identity and access management (IAM) architecture built for human employees was never designed to handle non-human identities that change behavior at runtime, acquire new capabilities, or even spawn other agents. The new capital will fund expansion outside the U.S., where Cymphony is already seeing demand from Europe, the Middle East, and Africa.

What investors are betting on

Two years ago, Sequoia's seed bet was almost purely on the three founders' pedigree — Talpiot alumni, the same talent pipeline Sequoia has tapped for prior security bets like Wiz. By the Series A, Sequoia partner Bogomil Balkansky was blunt: pedigree alone wasn't enough this time — he wanted product, customers, and revenue before doubling down. Cymphony delivered a double-digit number of enterprise customers and seven-figure ARR in its first year of sales, and Sequoia itself is a paying user — concrete reasons to follow on. Balkansky's stance is that Cymphony is complementary, not a replacement, to incumbents like Microsoft, Okta, CyberArk, Wiz, and Varonis "for now" — but he sees room for Cymphony to start displacing point solutions in specific areas like data loss prevention over time.

Numbers worth watching

• Double-digit enterprise customers and seven-figure ARR in year one of sales — a fast conversion rate for a company that hadn't even settled on a product direction at seed
• A $100M+ post-money valuation against conservatively estimated seven-figure ARR ($1-9M) implies a multiple somewhere between 10x and 100x — a range wide enough to suggest outsiders have limited visibility into the actual ARR figure
• A 30-person team split across Israel and the U.S. — compared to peers like Zenity ($38M Series B), Cymphony's funding size and headcount are still at an earlier stage

Watchlist status

Cymphony is not yet in the watchlist. Recommend adding it to section B7 (Agent Security / Governance). Rationale: two rounds of Sequoia conviction, focused specifically on identity and data-access governance for "non-human identities" (AI agents) — a distinct angle from existing B7 companies (Zenity, Protect AI, WitnessAI, and others), which puts human employees and AI agents on the same identity graph rather than only monitoring agent behavior in isolation.

Today's takeaway

The "85,000 files became accessible because of agents" figure Cymphony disclosed says more about urgency than any funding number could — enterprises haven't actually grasped how much access they've already handed off to agents, and Sequoia backing the same team twice is a bet that the moment companies wake up to the size of that gap will arrive sooner than current market consensus assumes.

References

• Sequoia doubles down on Cymphony as AI agents create new enterprise security risks
• Enterprise AI-Agent Security Startup Cymphony Exits Stealth With $30M, Backed by Sequoia
• Partnering with Cymphony: Security Unlocks Adoption