Cymphony raises $25M to inventory your AI agents

Cymphony raised a $25 million Series A to answer a question most companies cannot answer: which AI agents are running in your systems, and what can they reach? Sequoia and the SMBC Fin Atlas Beyond Fund co-led at a valuation above $100 million. The pitch is that enterprise security was built for humans with badges, and the fastest-growing category of account holder no longer has one. You do not need a $25 million product to fix this. You need the list.

What actually happened

TechCrunch reported the round on September 9. Sequoia had already funded the seed, so this is a second check into the same thesis.

Cymphony builds what it calls a workforce graph — one view of employees, AI agents, and other non-human identities, plus the systems and sensitive data each one can touch. It combines identity, data, and activity signals, then uses its own agents to investigate incidents, rank what the security team should handle first, and automate some remediation, including fixing over-broad access.

The company is about 30 people across Tel Aviv and New York, founded by Shy Dekel, Idan Berkovits, and Edi Gotlieb. Within its first year of selling it signed a double-digit number of enterprise customers and reached seven-figure annual recurring revenue. Named customers include KKR, Syngenta, Cass Information Systems, and Athennian. Dekel's framing to TechCrunch was that these are entities "practically joining the workforce, but they're no longer people."

Why non-human identity matters for your business

KKR needs a graph. You probably need a spreadsheet, and you probably do not have one.

Count what is already running: the Zapier connection with a Google Workspace token, the support bot with a Shopify Admin API key, the coding agent with a GitHub PAT, the scraper somebody stood up in June, the two service accounts left behind by a contractor. Each one is a login with permissions, and none of them will ever fail an MFA prompt or get walked out on a Friday.

Four columns get you most of the value. What is the identity. Who owns it — a human name, not a team. What scopes does it hold. When was it last used. Fill that in and the over-permissioned rows announce themselves: the read-only reporting job with write access, the integration nobody has touched since spring, the key with no owner.

Then set the rule that stops the list from rotting: no new agent, integration, or service account ships without a named owner and a scope narrower than "admin." That single gate is worth more than any tool you buy afterward, because a graph of unmanaged access is still a graph of unmanaged access.

Sources: TechCrunch.