Eighty-five thousand files. That is the volume a single unauthorized instance of a large language model scanned inside one enterprise before a human being noticed. No data-loss-prevention alert fired. No cloud access security broker flagged the session. No identity log recorded anything resembling a privilege escalation. The machine simply did what machines do when nobody defines what they are allowed to do: it read everything it could reach, quietly, at a speed no human audit cycle was built to catch.
I have spent twelve years watching this exact pattern mutate. In 2017 I audited more than forty token whitepapers and found that the marketing described a network while the emission schedule described a treadmill. The tell was never the technology. It was always the gap between what a system claimed to govern and what it could actually see. The 85,000-file breach is that gap again, wearing an AI costume. Fractures in the ledger reveal what hype obscures, and the ledger here is not a blockchain. It is the permission graph of an enterprise that never knew how many non-human actors were already inside it.
That is why Cymphony's $25 million Series A — valuing the company north of $100 million — deserves more than a funding headline. It is a signal that autonomous software has outgrown the security assumptions built for human users. And it lands in a year when the crypto industry, which has been running non-human actors at machine speed since the first MEV bot, is finally forced to confront the same question from the opposite direction.
The Board
Let me set the pieces before I argue about them. Cymphony raised $25 million in a Series A, bringing cumulative funding to roughly $30 million. Sequoia led the round and, notably, uses the product internally — a detail the coverage frames as validation. A strategic check came from SMBC's Fin Atlas Beyond Fund, which is a strong hint that regulated finance is the beachhead vertical. The named customers are KKR, Syngenta, and Cass Information Systems, all of which point toward large enterprises in sensitive or regulated industries. First-year ARR is described as “seven figures.” The founding team is three Talpiot graduates out of the Israeli elite military-technical pipeline, the same talent pool that produced Wiz.
The timing is not accidental. Over roughly five months, the agent-security category absorbed an estimated $435 million across a cluster of raises, with Cymphony arriving as the third significant round in three weeks behind AIR and Zenity. The justification circulating alongside the money is a pair of statistics. An IDC and Lenovo finding holds that 88% of enterprises with agent plans have never moved one into production. A Gartner projection holds that more than 40% of agentic AI projects will be cancelled by the end of 2027. Read those two numbers together and the thesis writes itself: the bottleneck is not model capability, it is governance and security.
Now the part the press release leaves out. Every data point above is either company-reported or author-transmitted. There is no independent verification of the 85,000 files, the ARR figure, or the sector total. The narrative carries heavy public-relations fingerprints — founder pedigree rendered as destiny, the Sequoia self-use story framed as third-party validation, and, most tellingly, the Wiz analogy, which is the security startup's version of promising to be the next Amazon. The 2022 Terra collapse taught me the cost of taking a compelling mechanism at face value. I spent seventy-two hours reverse-engineering that spiral while the market was still quoting anchor yields, and the lesson stuck: an elegant story is not the same as a solvent one.
So I read this raise the way I read a token launch. Direction first, packaging second. The direction is real. The packaging is inflated. The question is not whether demand exists. It is where that demand settles — and whether it settles inside enterprise SaaS at all, or whether the far larger prize is being built on-chain while the venture capital chases the dashboard.
The Structural Case
Here is the claim underneath the sector: artificial intelligence did not eliminate the need for security infrastructure; it created a blind spot that existing tooling was never designed to cover. That is correct, and the mechanism is the proliferation of non-human identities.
Traditional security was architected around a subject with a job title, a badge, and a working day. IAM governs access. DLP governs data. CASB governs cloud egress. UEBA governs behavior. Every one of those systems assumes a human principal who authenticates slowly, holds bounded privileges, and follows recognizable diurnal patterns. An agent does none of this. It authenticates continuously, requests permissions at machine cadence, and touches data in bursts that look nothing like a human session. The source material is explicit about the root cause: agents differ from users in “privileges, speed, and access patterns,” and they frequently bypass the guardrails built for people. When an agent bypasses a human guardrail, no alarm sounds, because the guardrail was never watching for that shape of traffic. The two incidents — 85,000 exposed files, and an external collaborator silently installing an unapproved model to scan thousands of sensitive documents — are the shadow-AI problem made concrete. They are not hypotheticals. They already happened.
This matters to anyone who reads on-chain data, because crypto has been living this exact problem for a decade without ever naming it. The first non-human identities in production were not Claude instances. They were MEV bots, searchers, keepers, and oracle signers. They authenticated continuously, moved at block speed, and exploited the human-shaped assumption embedded in every early protocol — that a transaction reflects a deliberate human decision. Sandwich attacks exist because a smart contract cannot distinguish a person's swap from a bot's front-run. The exploit was never in the cryptography. It was in the identity model. The chart is the symptom, not the disease.
What enterprise security is now calling “non-human identity governance” is the discipline crypto has been groping toward through account abstraction. ERC-4337 and session keys are, stripped of jargon, an attempt to give autonomous agents scoped, revocable, per-transaction identities instead of an all-or-nothing private key. A session key can be capped, time-boxed, and restricted to specific contracts. A private key cannot. The entire account-abstraction movement is agent security wearing a protocol costume, and it has been shipping for years.
So Cymphony's core product — the “workforce graph” that unifies identity, data, and activity signals — is a centralized, off-chain analogue of something crypto is attempting to build decentrally, on-chain. That framing raises an uncomfortable question about what the product actually does. Look at the two demonstrations. It discovers. It maps. It surfaces. It sees the 85,000 files and the shadow model. What it does not demonstrate — anywhere in the material — is enforcement. There is no inline blocking in the execution path. There is no stated integration depth with the model's runtime. There is no interception at the tool-call boundary. And there is no mention of the agent-specific attack surfaces that red teams actually exploit: prompt injection, tool-call hijacking, credential theft, context leakage, agent-to-agent lateral movement. The category is being sold as control. The demonstration is observability. Complexity is often a disguise for fragility, and a product whose value rests on visibility rather than enforcement has a far lower replacement threshold than its roadmap admits.
I learned the difference between seeing and stopping the hard way. In 2026 my team designed a liquidity-provision model for autonomous agents operating on decentralized credit lines. We back-tested scenarios with ten thousand agents transacting concurrently, and the model cut slippage by 30% during high-frequency windows. But the design only held because we enforced constraints at the execution layer. Every agent's credit line was enforced on-chain, not merely monitored. Visibility gave us dashboards. Enforcement gave us solvency. The moment you rely on an alert reaching a human about an unaccountable agent, you have already lost the race to the speed of the agent.
That distinction is the valuation question in miniature. A $100 million-plus mark against “seven-figure ARR” is a price-to-sales ratio somewhere between 10x and 100x, and the range is not academic. It is the difference between a defensible multiple and a pure narrative premium. Run the arithmetic. At $1 million ARR the multiple is roughly 100x. At $5 million it is about 20x. At $9.9 million it is near 10x. The refusal to specify where inside the “seven-figure” band the number sits is itself the signal. Firms confident enough to anchor a $100 million valuation are usually confident enough to quote a precise ARR. The interval is doing marketing work. Consensus is a lagging indicator of truth.
And the moat is thinner than the round implies. The platform layer is circling. Microsoft has Purview. Palo Alto has Cortex. CrowdStrike already owns the endpoint and the identity telemetry. If agent security becomes a module inside an existing platform — the way data-loss prevention became a checkbox in every CASB, and the way endpoint detection became a feature of the operating system — the standalone category dissolves into a function. Four hundred and thirty-five million dollars in five months tells you capital arrived faster than the market proved it needs four or five independent vendors. Solvency checks precede sentiment recovery, and in this corner of the market, the checks have not yet been cashed.
There is one more layer worth naming, because it is where the institutional and on-chain worlds actually intersect. When I built the ETF-inflow correlation work in early 2024, the finding was that institutional flow was driving long-term holder behavior, not speculative traders, and that price discovery lagged the fund-flow data by roughly forty-eight hours. That lag is now compressed and increasingly automated. The natural next step is agents reading the same institutional flow data and executing on it before any human desk reacts. When that happens, the most systemically important non-human identities will not be the ones inside an office network. They will be the ones plugged directly into the capital markets, moving size at machine speed. Governing those agents is a far larger and more consequential problem than governing a workforce graph.
The Decoupling
Here is where I part ways with both the bull case and the internal skeptics, because the crypto lens inverts the answer.
The prevailing view — and the analysis treats it as the top risk — is that agent security is a feature, not a product, destined to be absorbed by the platform giants. For enterprise software, that is probably right. But crypto is not enterprise software, and the agents that matter most to readers of this kind of analysis do not live inside a corporate workforce graph. They live on-chain. They transact with each other. They settle in stablecoins. They do not have a job title to govern.
Consider what is actually being built. Agent-to-agent payments, machine-to-machine settlement rails, autonomous credit, HTTP-native payments — an entire economic layer where the transacting party is a process, not a person. In that world, identity governance cannot be a centralized graph owned by one vendor, because there is no central agent registry and no single trust anchor that every counterparty shares. The identity primitive has to be cryptographic, composable, and verifiable by any participant without permission. A workforce graph that maps a company's internal agents is useful. But it cannot govern an agent that touches five protocols across three chains and settles in a stablecoin it did not issue. That agent's identity is its key, its scope is its session permissions, and its reputation is its on-chain history.
Which means the largest agent-security market of the next cycle may not be enterprise data-loss prevention for AI. It may be the on-chain attestation and scoping layer — the thing that lets a DeFi protocol know that the agent hitting its pool is a bounded, revocable, verifiable actor rather than an unbounded wallet with a private key and a grudge. This is not speculation about a distant future. It is the direct extension of work I led in 2026, where the operating principle was that smart contracts must be able to price the risk of the machine on the other side of the trade without a human intermediary. Cymphony's instinct — that autonomous agents need a fundamentally different identity model — is correct. But the abstraction it chose, the enterprise workforce graph, may be optimized for the wrong deployment surface. Enterprise agents need a security vendor. On-chain agents need a security primitive.
That is the decoupling thesis in its least fashionable form. Most of the capital flowing into agent security is betting that enterprise governance is the durable market. I think the durable market is the cryptographic one, and the enterprise SaaS wave is partly a liquidity event for investors who cannot yet buy exposure to the on-chain primitive because it does not have a ticker. Crypto has already paid the tuition on non-human identity — in exploits, in forks, in account-abstraction standards. Wall Street is now buying the same course at full price, and it is buying the version without enforcement.
Positioning
Zoom out to the cycle. We are in a bull market, which is precisely when technical flaws get repriced last. The $435 million is not a mistake, but it is positioning ahead of a market that has not yet been measured. The enterprise agent-security category will likely produce one winner, several acquisitions, and a long tail of companies that raised on the same deck and could not differentiate on the same architecture.
What I am watching instead sits one layer down. If agent security is genuinely a new category, the crypto-native version of it will not look like a dashboard. It will look like a standard: some combination of account abstraction, verifiable agent attestation, and scoped session permissions that lets a protocol price the risk of the machine on the other side of the trade. Enterprise buyers are solving for compliance and visibility. The on-chain economy is solving for solvency and enforceability. Only one of those problems requires you to see the agent before it acts. The other requires the agent to prove itself before it is allowed to act.
That is the signal to track over the next eighteen months. Not the next agent-security funding round — those will keep coming, and the headlines will keep quoting the same two statistics. Watch instead whether an on-chain agent-identity standard reaches adoption before the enterprise version reaches consolidation. If it does, the more interesting question stops being who secures the agents and becomes who governs the machines that pay each other. And whoever answers that will not have needed a workforce graph to do it — which is exactly why the $100 million valuation tells you more about the temperature of the capital than the durability of the category.
