Act Security's $60M: AI agents inherit dead permissions

Act Security came out of stealth on July 28 with $60 million and a pitch aimed at a problem most small teams have and none of them have named: the permissions you granted three years ago never went away, and your AI agents are about to inherit all of them. The company's number — roughly 97% of cloud access sits dormant and unused — is the kind of stat you should verify against your own environment rather than take on faith. Do that this week. It's a one-afternoon audit and the answer is usually worse than you'd guess.

What actually happened

Per the company's launch announcement, Act raised a $20 million seed led by Team8 and Bessemer Venture Partners with Hetz Ventures and Claltech, plus a $40 million Series A led by Notable Capital with Startpoint Capital and SVCI. Founder and CEO Jonathan Langer previously built Medigate, the medical-device security company Claroty acquired for $400 million — so this is a second-time team, not a first swing.

The product is described as action-centric cloud security: instead of chasing vulnerabilities, it reduces the access surface that makes a vulnerability exploitable, enforcing boundaries across humans, workloads, and AI agents, and maintaining continuous compliance against NIST 800-53, PCI DSS, and HIPAA. SecurityWeek framed it as a response to the patch problem: you will never patch everything, so cut the paths instead.

Langer's line is the one to sit with: close to 97% of cloud access sits dormant and unused, "and now AI agents are inheriting those same old human permissions, running around the clock, at machine speed." That figure is Act's own, from a company selling the fix — treat it as a hypothesis, not a fact about your stack.

Why dormant permissions matter for your business

Here's the pattern we keep finding in client environments. Somebody stands up an AI agent to handle invoices or triage support tickets. To make it work fast, they attach an existing service account or an admin's credentials — because that account already has access to everything the agent might need, and scoping it properly would take a day nobody has budgeted. The agent ships. The over-broad permission stays forever.

The difference between a dormant human permission and a dormant agent permission is duty cycle. A human with excessive S3 access uses maybe 2% of it, during business hours, at human speed. An agent with the same grant runs continuously and will use whatever it can reach the moment a prompt, a bad tool definition, or an injected instruction points it there. Same permission, radically different blast radius — and this week's Hugging Face agent intrusion timeline is what the bad version looks like at scale.

You don't need Act's platform to start. Pull the access report from your cloud provider — IAM Access Analyzer on AWS, the equivalent in Azure or GCP — and sort by last-used date. Every role untouched in 90 days is a candidate for deletion. Then give every agent its own identity with its own scoped grant, never a borrowed human account. It's tedious, unglamorous work, and it's the single highest-leverage security hour you'll spend before your next agent goes live.

Sources: PR Newswire, SecurityWeek.