Theses›Defence & security›Agentic AI security

Agentic AI security

As AI agents gain the ability to execute code and reach into low-level infrastructure, value accrues to whoever owns the trusted-execution and attestation boundary that contains them

  • Bull
  • Early
  • $27B by 2035

The callThe drivers edge it, narrowly: agents are getting credentials and exploits are piling up, but the platforms ship containment free. Early, and a software market.

D1D2D3R1R2R3C1foragainst D1D2D3R1R2R3C1foragainst
Fig. 1The balance. Drivers and catalysts against restraints, each block sized by its weight; catalysts hang dashed because they have not happened yet, sized by their odds. It tips toward the drivers.
  1. D1Agents now hold credentials, run code and move money, and the exploits show it: 24 CVEs across AI coding tools in December 2025 and about 200,000 exposed MCP servers.
  2. D2No platform will certify a rival's agents, so an auditor who wants evidence has to get it from a neutral party.
  3. D3Security spend is already about $244B a year, so a new category has a budget to come out of.
  4. R1The platforms ship containment themselves: OpenAI added sandboxing to its Agents SDK in April 2026, Anthropic shipped a harness, Microsoft bundles Agent 365 at $15 a seat.
  5. R2The security majors bought the agent-identity startups in the first half of 2026, and the exits on record are Protect AI at $634.5M and Lacework at about $200M.
  6. R3The serviceable estimate is about $1B and could move 2x either way on one assumption.
  7. C1An agent with delegated authority causes a loss at an audited enterprise, after which auditors demand containment evidence that does not come from the platform itself.2030
Rests onthe beliefs underneath
Supported by · confidence
What would prove itdated tests, open and resolved
20272028202920302031today1watch 20272028202920302031today1watch
Fig. 2Each ring is a dated test: dashed while open, struck through when overdue, ticked or crossed once resolved.
  1. 1A first audited-enterprise loss caused by an agent.Dec 2030 · open
  • ·An independent cross-vendor company reaches $50M of ARR or a Series C without being absorbed.
  • ·Whether OpenAI keeps its SDK compatible with third-party sandbox providers, the one opening the platforms have left.
Expressionslisted, private, technologies
  • ARQQArqit Quantum
    • speculative
     Quantum-safe encryption keys — small UK pure-play.
  • CRWDCrowdStrike
    • expensive
     Endpoint detection — Falcon platform.
  • NVDANVIDIA
    • cheap
     Dominant share of AI training compute.
  • PANWPalo Alto Networks
    • full
     Platform play: firewall + SASE + SOC.
  • SSentinelOne
    • expensive
  • ZSZscaler
    • full
     Zero-trust network — proxy-based SSE.
  • MSFTMicrosoft
    • full
     Sells Agent 365, a per-user control plane to inventory, govern and secure enterprise AI agents, bundled into Microsoft 365 E7.
  • OKTAOkta
    • not screened
     Sells identity, credential brokering and per-tool-call authorisation for AI agents to enterprises and developers (Okta and Auth0).
Private · 13 private companies, 6 of them in Israel.

Sweet Security · Oligo Security · groundcover · AccuKnox · Stealthium · E2B · Daytona · Polymodal B.V. · Noma Security · Zenity · Lasso Security · Operant AI · Runlayer

5 more private companies tracked, not shown

Technologies
Who has already bet on itprivate rounds, from public sources

$293M raised by 7 companies, $289M of it in the last three years. Wave building: Money is arriving: recent rounds and tier-1 funds are in, but no runaway leader yet.

Backed by a top-tier venture firm: Runlayer, E2B, Operant AI. Backed by a strategic investor: Zenity, Lasso Security.

What changedthe record, newest first
  • 23 Oct 2026I score agent security at 30. Researchers found 253 holes in agent tools in a week and new companies are still raising to fence agents in. What's missing is the first big loss that makes auditors demand it.
  • 23 Oct 2026The AI agent stack got breached from every side in one week: the proxy, the secrets store, the share link, and one operator pointed agents at 1,200 companies for the price of a laptop.
  • 2 Sep 2026The argument I reached from the market side — that no AI platform can certify a rival's agents, so the trust boundary has to sit outside all of them — turns out to have a hardware version: put the enforcement on separate silicon and physically cut the circuit. Whether anyone can actually build the hard part is a different question.
1 earlier
  • 23 Jul 2026An AI escaped its sandbox and hacked a hardened target to win a test: containment is now the value layer, and defenders need a capable model they can run on their own infrastructure.
Reading
Show the reading