Reco raises $55M. One customer had 21,000 unknown agents

A Fortune 100 company turned on agent discovery and found 21,000 agents nobody had approved. That number, reported by TechCrunch on September 29, is the clearest argument yet for doing AI agent inventory before you do anything else. Reco raised $55 million on the strength of that problem. You can address the small-business version of it this afternoon with a spreadsheet.

What actually happened

Reco announced $55 million in additional funding — a strategic investment from AT&T Ventures with new investors Forestay and Quadrille Capital — bringing total capital to $140 million. It extends the $30 million round the company closed in February. TechCrunch labels it a Series C and reports annual recurring revenue in the double-digit millions, expected to triple this year, with more than 100 customers and roughly 40% of revenue from financial services.

The product maps the relationships among agents, identities, applications, permissions, data and workflows — 280-plus app integrations and about 1,000 detection controls. The pitch is discovery first: find the agents running in your environment, then see which identity each one borrows and what it can reach. One large financial services customer used it to find a rogue agent with unauthorized Salesforce access.

Reco's release cites a Gartner projection that the average global Fortune 500 enterprise will run more than 150,000 agents by 2028, up from fewer than 15 in 2025. CEO Ofer Klein's framing: "AT&T's participation reflects the need for security that follows agents across enterprise ecosystems."

The category is crowded. TechCrunch names AIR, Cymphony, CrowdStrike's Falcon Guardian, HiddenLayer and Zenity as competitors. That matters for pricing.

Why agent inventory matters for your business

You do not have 21,000 agents. You probably have somewhere between eight and forty, and you cannot name them. Every Zapier zap with an AI step, every GPT you built into a Slack workflow, every Make automation a contractor set up in 2024, every MCP server your dev tool connects to, every "AI assistant" toggle someone flipped on in your CRM. Each one holds a token. Some of those tokens belong to people who left.

The expensive part of the enterprise problem is discovery at scale. The cheap part — the part that delivers most of the risk reduction — is a list. Build it:

Pull the connected-apps page for every SaaS tool you pay for. Google Workspace, Microsoft 365, Shopify, Stripe, HubSpot, Slack. Each one has a screen showing every OAuth grant. Read it. Revoke what you do not recognize.

Write down, for each agent, whose identity it runs as. The single worst pattern in small-business automation is an agent authenticated as the founder's personal account, because that account has everything. Move each one to a dedicated service account with the narrowest scope that works.

Check your offboarding list against your automation list. When someone leaves, you kill their email. You almost certainly do not kill the three automations running on their token. Those keep working until they silently stop, which is the good outcome.

Then shop, if you still need to. Five funded vendors chasing the same buyer means list prices are negotiable and the feature sets are converging. If your inventory turns out to be forty agents on a spreadsheet, a platform is not your next purchase — least-privilege is.

The discipline scales down cleanly. Know what runs, know whose keys it holds, and know how to turn it off. Tooling makes that faster at 21,000. It does not replace it at 21.

Sources: GlobeNewswire, TechCrunch, SecurityWeek.