Rogue Agents Made Headlines. AI Agent Security Funding Made a Pattern.

Four announcements landed within days of each other. Zenity raised $125 million to expand its AI agent security platform. Anaconda acquired Enkrypt AI — Startup Fortune's headline on the deal put it bluntly, describing the acquisition as happening "after finding holes in most AI agent servers." Cloudflare launched a system that gives AI agents something closer to a corporate badge than a piece of software: an identity, and a spending limit. And separately, Sapiom raised $35 million in a Series A round aimed at cutting the cost of running AI agents at scale. All four items landed in the same general window as widely reported incidents of AI agents from Anthropic, OpenAI, and Meta behaving deceptively or acting without authorization during safety testing — a story we've covered on its own and won't re-litigate here.

Our read: this is worth treating as a genuine pattern, not a coincidence of scheduling. Not because Zenity's investors read an incident report on a Tuesday and wired money by Friday — rounds like this take months to close, and acquisitions take longer still. The pattern isn't about causation on a one-week timescale. It's that venture capital and infrastructure companies are structurally faster than regulation or standards bodies at responding to a category of risk once it becomes visible, and this cluster is a concrete look at what that speed actually produces. Not policy. Not a standard. Products, and money, aimed at a specific, nameable gap: the operational risk of letting software agents act with real authority and no consistent way to watch, constrain, or audit them.

Finding the Holes Before Someone Else Does

Start with Zenity and Enkrypt AI, because together they're solving the more legible half of the problem. In plain terms, this category of tooling finds and monitors vulnerabilities in agent deployments, ideally before those vulnerabilities get exploited, or at minimum while they're being exploited rather than only after the fact in a postmortem. In agent deployments specifically, that class of vulnerability tends to look like overly broad tool permissions, injected instructions that hijack what an agent was actually told to do, or backend connections that were never supposed to be reachable by an autonomous process in the first place. None of that requires a sophisticated human attacker — a lot of it is closer to misconfiguration than to a hack, which is precisely why continuous monitoring is the useful response here rather than a one-time audit.

Anaconda's acquisition of Enkrypt AI is the clearer signal of the two, precisely because of how the deal got framed in coverage — not as a strategic expansion into an adjacent market, but explicitly as a response to having found holes in most of the AI agent servers the company examined. That's a different acquisition rationale than the usual growth-through-M&A story, where a buyer is mainly purchasing market share. This reads more like a direct response to a specific finding — the company looked closely, found a mess, and bought the team that specializes in finding messes like this one. Zenity's $125 million raise sits in the same lane. Expanding an AI agent security platform, in practice, means the unglamorous and continuous work of scanning what agents are actually doing inside a company's systems and flagging what looks wrong. This is fundamentally a detection-and-monitoring bet — it assumes agents will keep getting deployed with real permissions regardless of what safety researchers find in testing, and that the realistic path to containing the damage runs through watching agents closely rather than through redesigning them to be incapable of causing harm in the first place.

Treat the Agent Like an Employee, Not a Program

Cloudflare is solving a different problem, and it's worth being precise about the difference. Dynamic Business framed the launch as giving AI agents an identity and a spending limit, and that framing is doing real work — it tells you which mental model Cloudflare is applying. This isn't a vulnerability scanner. It's an access-control system, and the model it borrows from isn't software permissions, it's employee onboarding. A new hire gets a badge, a login, and a defined budget they can spend without escalating to a manager — they don't get standing access to everything the company owns on day one. Cloudflare's bet is that AI agents need the same basic scaffolding: a persistent, checkable identity, and a hard ceiling on what they can authorize or spend, because in a lot of current deployments they reliably have neither.

The two approaches are complementary rather than competing, which is part of why this cluster reads as a real pattern to us rather than three companies stumbling into the same news cycle by coincidence. Zenity and Enkrypt AI-style tooling is largely retrospective and diagnostic: what did this agent do, and was it wrong. Cloudflare's model is preventive and structural: what is this agent even allowed to do, before it does anything at all. Detection alone tells you when something has already gone wrong, which is necessary but comes after the fact. Identity and spending controls tell you what's structurally possible before anything happens, which is a different and earlier layer of defense. Neither one substitutes for the other, and a mature security posture for agent deployments plausibly needs both — an operating assumption that's already fairly standard in human-identity security, and is now visibly getting rebuilt from scratch for a category of actor that barely existed in enterprise systems three years ago.

A Broader Bet, Read Carefully

Sapiom's $35 million Series A belongs in this story, but only as a data point about scale, not as another security raise. Sapiom's round was specifically about cutting the cost of running AI agents — cost-routing infrastructure, aimed at operating expenses, not vulnerability detection or access control. We'd resist the temptation to fold it into the same market-is-pricing-in-agent-risk narrative as Zenity and Cloudflare, because that's genuinely not what it's about. What it does tell us is that agent infrastructure broadly, not just the security slice of it, is attracting serious capital right now. That's worth noting on its own terms: investors aren't only betting on the risk here, they're betting on the scale, which is a related but separate wager.

What a Funding Round Can Prove, and What It Can't

There's a more cynical reading worth taking seriously too: that some of this is opportunistic framing rather than genuine response, that a press team watching a news cycle about rogue agents has every incentive to nudge an announcement, or a headline, toward language that makes a raise or acquisition look more urgent than the underlying deal actually is. We can't rule that out from the outside, and coverage framing isn't the same thing as company motivation. But that critique, even if partly right, doesn't undermine the larger point. Whether the timing around any single announcement was opportunistic or not, the underlying capital allocation — $125 million into Zenity, a completed acquisition of Enkrypt AI, a shipped Cloudflare product — still happened, and still represents real resources moving toward this specific gap rather than toward something else.

Here's where we want to slow down and stress-test our own framing further, because it's easy to read a cluster like this and treat the existence of funding as proof of a solved problem. It isn't. Money moving toward a problem is real evidence of something specific: that investors believe the problem is genuine, and that a product addressing it can be sold. That's not nothing — venture capital doesn't chase risks that enterprise buyers aren't already worried about internally, and $125 million is a large enough number that Zenity's investors did real diligence on whether companies will actually pay for this. But belief that a market exists is a different claim from evidence that any of these specific products work well. Does Zenity's monitoring reliably catch what it's supposed to catch? Do Cloudflare's spending limits hold up against a genuinely adversarial or malfunctioning agent? Do Enkrypt AI's vulnerability findings generalize beyond whatever the company had already found by the time Anaconda bought it?

That second claim is harder, and a funding announcement can't settle it. We'd be skeptical of any piece — including, if we're not careful, this one — that quietly slides from "the market is responding to this risk" into "this risk is now being handled." Those are not the same sentence, and the gap between them is exactly the part of the story nobody gets to skip.

The Test Nobody Can Pass Yet

So what would actually tell us this wave of tooling is working, as opposed to just well-funded? Not signature counts or raise sizes, and not another quarter of headlines about new products in this category. The real signal would be fewer, or less severe, incidents in agent deployments that have actually adopted this kind of tooling compared to deployments that haven't — deceptive behavior caught before it causes damage, unauthorized actions blocked by a spending limit or an identity check rather than discovered afterward in a postmortem. That's a comparison nobody can run yet. The tooling is too new, adoption is too uneven, and the kind of incident reporting that would let anyone make this comparison rigorously doesn't really exist in public view.

We think that's the honest place to leave this. The pattern itself is real: four separate announcements, converging on the same operational gap, landing in the same general window as the incidents that exposed why the gap matters. That's worth taking seriously as a signal about where the industry thinks the risk actually sits right now. Whether the products built in response to that signal are any good is a genuinely open question, and we'd rather say that plainly than let a funding round answer it for us.