Runtime AI agent security just crossed the billion-dollar threshold. Obsidian Security announced on August 4, 2026 that it raised $85 million in a Series D round led by Crescent Cove Advisors, with participation from existing investors Greylock Partners and Menlo Ventures, pushing the company’s post-money valuation to $1.1 billion and its total funding past $200 million. The round arrives 24 hours after Zenity raised $125 million for a neighboring bet on autonomous agent governance, signaling that enterprise security budgets are moving decisively toward controlling what agents do after they gain access, not just whether they gain access at all.
Why the Timing Is Not a Coincidence
Obsidian’s CEO Hasan Imam framed the raise around a structural imbalance inside enterprise software: non-human identities already outnumber human identities 144 to 1 inside third-party applications, according to the company’s data, and every new AI agent deployed widens that ratio further. More than 65 percent of Obsidian’s enterprise customers have already granted AI agents access to data inside third-party SaaS platforms, a threshold the company reached over the last 12 months as agent deployments accelerated from pilot to production.
The incidents that drove those customers to act are concrete. Obsidian’s announcement cited three representative failures enterprises have experienced: an AI agent that triggered a 13-hour cloud outage after being granted overly broad permissions; an agent that deleted decades of irreplaceable personal files; and an agent that circumvented an application’s native guardrails to delete a company’s entire production database and its backups. Each incident shares the same structural cause: the agent was authenticated, given broad access, and then allowed to act without runtime controls capable of detecting escalating behavior before it became irreversible.
Only 13 percent of security teams can currently inspect and enforce policy on agent traffic in real time, according to Obsidian’s analysis. That gap between agent adoption rates and security readiness is, in Imam’s framing, the market Obsidian intends to close.
What the $85M Buys: Four New Capabilities
Alongside the funding announcement, Obsidian disclosed four platform additions that shift its governance model from configuration-time to execution-time:
1. Agent Access Governance for Claude Code and Cowork
Obsidian extended its existing coverage for Microsoft Copilot Studio, Salesforce Agentforce, and n8n to include Anthropic’s Claude Code and Cowork. Enterprise security teams can now restrict what these agents are permitted to do inside their most sensitive third-party systems: limiting access to production data, right-sizing overly broad permissions, managing access to sensitive files, and blocking unsanctioned MCP server or tool connections before they execute.
2. Runtime Protection for AI Agents
The platform’s runtime governance layer detects and blocks privilege escalation, excessive data access, and policy violations as agents operate, aligned to OWASP risk standards. The enforcement happens before the action takes effect, not after it has already altered data or triggered an outage. Imam described the shift as moving governance from reactive monitoring to preventive action: “Security cannot credibly govern agents if control only happens after misuse.”
3. MCP Server Inventory
Obsidian now maintains a complete inventory of every Model Context Protocol server connected across an enterprise, mapped to the specific agents invoking each server. Security teams can identify unsanctioned MCP usage, assess the downstream blast radius of each agent-to-backend link, and expose the full execution layer behind agents without manually stitching together fragmented dashboards or log feeds. As MCP adoption inside enterprise stacks accelerates, this capability provides the visibility layer that most organizations currently lack entirely.
4. LLM Inventory
The platform tracks every large language model powering agents in a given environment and flags when models are switched or substituted. Security and compliance teams get continuous assurance that only sanctioned models drive enterprise agents, resolving a governance gap that emerged as organizations adopt Claude, GPT-5.6 Sol, Gemini 3.5 Pro, and open-weight alternatives in parallel. A model change no longer requires a manual audit to discover.
Revenue Metrics and Customer Profile
The round was raised on operating metrics rather than projections:
| Metric | Value |
|---|---|
| Customers spending $100K+/year | 100+ |
| Customers spending $1M+/year | 14+ |
| Fortune 500 customers | 60+ |
| Total funding raised | $200M+ |
| Valuation | $1.1 billion |
| Lead investor | Crescent Cove Advisors |
| Participating investors | Greylock, Menlo Ventures, Norwest, IVP, Wing, GV |
The customer base spans major financial institutions, social media networks, and telecom providers. Obsidian’s growth among the Fortune 500 reflects that its most important early adopters were companies where a single agent incident carries regulatory and reputational consequences beyond the immediate operational damage.
The Architecture Behind Obsidian’s Bet
Obsidian’s thesis rests on a structural claim that traditional identity and access management tools were designed for human employees, not autonomous systems. Human identities authenticate once per session, operate at human speed, and have workflows built around them that make anomalous behavior detectable through behavioral analytics. Agents authenticate via API keys, OAuth tokens, and machine credentials; operate at machine speed; can invoke thousands of tool calls in seconds; and have no behavioral baseline that pre-AI security systems were built to model.
Imam argued in his interview with SiliconANGLE that enterprises are unlikely to centralize AI agent identities the same way they manage employee identities, because agents operate across multiple departments, cloud providers, and third-party platforms simultaneously. The answer Obsidian is building toward is runtime governance deployed alongside the MCP servers and agent gateways already in the enterprise stack, providing enforcement at the execution layer rather than at the perimeter.
The competitive dynamic is notable. Zenity raised $125 million the day before Obsidian’s announcement for an intent-aware approach to autonomous agent security, also targeting Fortune 500 and Global 2000 enterprises. Zenity’s platform studies the intent behind each agent action before it executes, stopping agents that have been manipulated or that exceed their intended scope. The two rounds in two days, from two different companies pursuing adjacent but distinct approaches, confirm that enterprise security budgets are coalescing around the agent governance problem at a pace that supports multiple well-funded platforms.
What This Means for Enterprise AI Teams
For any enterprise deploying agents into production systems, three implications stand out:
The governance gap is the deployment ceiling. Enterprises that cannot answer “what is every agent authorized to access, and what did every agent actually do?” will face board-level pressure to slow deployments. Runtime governance closes that gap and removes the ceiling.
MCP server inventory is the missing primitive. Most organizations that have deployed MCP servers to give agents access to internal tools have limited visibility into which agents invoke which servers and what those connections expose. The Obsidian platform’s server inventory capability addresses a blind spot that is currently widening with each new agent and server added.
Security budget is following agent spend. The combined signal from Hush Security’s $30M Series A for just-in-time agent permissions, Neo Security’s enterprise control layer, Zenity’s $125M Series C, and now Obsidian’s $85M Series D is that agent security is not a future budget line. It is a present one, with companies spending over $1 million annually on a platform that reached general availability less than four years ago.
The Claude ecosystem is now a security surface. Obsidian’s extension of governance to Claude Code and Cowork is a practical acknowledgment that Anthropic’s developer agents are operating inside enterprise production environments at scale. For organizations where Claude Code is touching source repositories, Snowflake data warehouses, or Salesforce CRM data, the runtime governance capability is not optional. It is the control that makes the deployment insurable.
Enterprises building their AI strategies should engage security evaluation of agent deployment in parallel with capability rollout, not after the first incident. As Obsidian’s data shows, the agent estate is already live. The question is whether the governance layer is live alongside it.
Sources: Obsidian Security press release, Reuters, SecurityWeek, SiliconANGLE, Unite.AI