Huskeys raised $27M because WAFs can't read AI agents

Blackstone led a $27 million Series A into a company whose product is a management layer for web application firewalls. That sounds like a very boring reason to write a check until you name the actual problem: a WAF answers "is this a human or a bot," and AI agent traffic has made that the wrong question. The agent hitting your checkout page is a bot, and it is also your customer.

What actually happened

Per Calcalist/CTech, Tel Aviv-based Huskeys closed a $27 million Series A led by Blackstone on September 2, bringing total funding to $35 million. Globes reports the company emerged from stealth about five months ago. Founders Itai Gafni (CEO) and Roy Weisfeld (CTO) are Unit 8200 alumni.

The investor list is the tell. Alongside Blackstone: Okta Ventures, Zscaler Ventures, Merlin Ventures, Skinos Ventures, and individual executives from Palo Alto Networks, Cloudflare, Check Point, AWS, Google, Microsoft, and Intel. Named customers include TikTok, Hugging Face, Legoland, and Ro.

The product is an AI layer over the WAFs a company already runs — visibility and tuning rather than a rip-and-replace. Gafni's framing, per CTech: most identities operating on the internet will soon be autonomous agents. The pitch is that a control technology designed around a human/bot binary needs a third answer.

Why AI agent traffic matters for your business

You do not run TikTok's edge. You run a site behind Cloudflare or a hosting provider's default bot rules, and those rules were tuned in a world where automated traffic was scrapers and card testers. That default now silently drops a category of visitor you want.

Concretely: a customer asks an assistant to check whether you carry a part, or to compare your pricing page against two competitors, or to fill in a form on their behalf. That request arrives as a datacenter IP with a non-browser user agent and no mouse movement. Every heuristic your bot filter uses says block. The customer does not see a CAPTCHA — they see the assistant reporting it could not find the information, and the assistant moves on to a competitor whose rules were looser. You get no log line, no bounce, no signal at all. The failure is invisible by construction.

The fix is not "turn off bot protection." It is to stop treating automated and malicious as the same word. Look at what your edge blocked in the last thirty days and sort it by user agent — you will find agent traffic in there. Decide deliberately which agents get read access to public pages, keep the hard blocks on anything that writes or authenticates, and rate-limit rather than reject when you are unsure. And publish a clean, structured version of the pages you want an agent to read, so the answer it gives about you is the one you wrote.

Blackstone is betting that telling good automation from bad becomes a product category. Until it is a product you can buy, it is a config file you should read.

Sources: Calcalist/CTech, Globes.