What is shadow AI in enterprise environments and why is it a security risk?

Shadow AI refers to AI tools, agents, and automations that employees deploy without formal IT or security review. In 2026, this includes AI coding assistants, no-code agent builders, and MCP-connected automations assembled by finance, marketing, and legal teams. The risk is not just tool adoption; it is that these self-assembled pipelines connect to production systems, ERP databases, and payment platforms with permissions that far exceed what the user realized they were granting. Pluto Security data shows that 60 percent of AI-related risks it detects originate from tools built by non-developers, with finance departments generating the most risk.

What does Pluto Security do and how does its platform work?

Pluto Security provides real-time visibility and enforcement across three layers: the AI tools employees use, the supply chain of skills, extensions, and MCP servers those tools rely on, and the agents and automations employees build themselves. When the platform detects a risky action, it injects context into the agent's session, prompting the model to pause and seek confirmation, rather than blocking the tool outright. This preserves employee productivity while enforcing organizational security policy.

Who backed Pluto Security's $42M raise and who are its investors?

Pluto Security raised a seed round of approximately $8 million led by TLV Partners with participation from Ansa Capital, followed by a Series A of approximately $34 million led by Jump Capital, with Skinos Ventures (affiliated with Palo Alto Networks co-founder Shlomo Kramer) and AlphaDrive Ventures also participating. The company has not disclosed its valuation.

Which teams inside enterprises create the most AI agent security risk?

According to Pluto Security data from its customer base, finance departments are the largest source of AI agent risk, followed by marketing and legal teams. Developers rank fourth. This counterintuitive finding reflects that business teams are using no-code and AI-assisted tools to build agents that connect to production financial systems and sensitive data sources, often without formal security review.

What is Plutonium and how can enterprise security teams use it?

Plutonium is a free AI supply chain security hub built by Pluto Security and powered by its proprietary RisksDB. Security professionals can use it to assess the risks associated with specific skills, extensions, MCP servers, and app connectors before deploying them inside enterprise environments. The hub currently covers more than 4,500 components and has thousands of weekly active users from the security community.

Pluto Security Raises $42M to Secure Shadow AI Agents

Pluto Security emerged from stealth on October 13, 2026 with $42 million in total funding to address one of enterprise IT’s most urgent governance gaps: the hundreds of AI agents, automations, and AI-powered applications that employees are building and deploying without IT oversight. The Tel Aviv and U.S. startup, founded in 2025, already secures more than one million endpoints across more than 40 enterprise customers including Oscar Health, Workato, Sixt, and AlphaSense, generating more than $2 million in annual recurring revenue in its first year of commercial operations.

The Shadow AI Agent Problem That Security Teams Did Not See Coming

The rise of AI coding tools including Claude Code, Codex, Cursor, Lovable, and Base44 fundamentally changed who builds software inside enterprises. Finance teams build invoice automation. Marketing teams build competitive research agents. Legal teams build contract review pipelines. None of these builders are traditional software developers, and few consider security policies before they click deploy.

Pluto Security CEO and co-founder Shahar Bahat put a sharp figure on the scope in the company’s TechCrunch coverage: a newly announced AI tool can appear inside a corporate environment within two hours of its public release. More striking: 60 percent of the risks Pluto detects across its customer base originate from tools built by non-developers. Finance departments are the largest source of risk, followed by marketing and legal. Developers rank fourth.

The implications for enterprise security strategy are significant. Governing which approved AI tools employees can purchase is a solvable procurement problem. Governing the thousands of agents, automations, and workflows that employees self-assemble from skills, MCP servers, code packages, and model APIs is an entirely different challenge: one that traditional endpoint detection tools were not designed to address.

What Pluto Security Builds: Three Layers of Agentic Endpoint Governance

Pluto’s platform operates across three layers that Bahat describes as the new surface area of enterprise endpoint security.

AI tool usage. Employees use an average of 15 AI tools per person. Pluto monitors which tools are active, which external services they connect to, and what permissions those connections carry.

Agent components and supply chain. Behind every AI tool sits a supply chain of skills, extensions, MCP servers, code packages, and model dependencies. Pluto’s proprietary RisksDB catalogues risks associated with more than 4,500 such components. Its free community hub, Plutonium, makes a portion of this data available to security professionals who want to assess components before installing them in their environments.

Applications and agents employees build. This is the highest-risk layer: agents and automations that move from “just a prototype” to “running on production data” without a formal software review. Pluto tracks these too, mapping their permissions, data access, and behavioral patterns.

When the platform detects a risky action, it does not simply disable the agent or block the tool. Instead, it injects context back into the agent’s session, prompting the model to pause and seek confirmation. That approach preserves productivity while enforcing policy: an employee can keep using their preferred AI tool while a malicious skill is neutralized in the background.

“We’re moving from user behavior to agent behavior,” Bahat told TechCrunch. “We can inject context back to the session, and this way I can change how the agent is working.”

Funding Breakdown

The $42 million total includes two rounds:

Round	Amount	Lead Investor	Other Participants
Seed	~$8M	TLV Partners	Ansa Capital
Series A	~$34M	Jump Capital	Skinos Ventures, AlphaDrive Ventures

Jump Capital partner Saaya Pal highlighted Plutonium’s community traction as a key signal of product-led growth in the company’s announcement: “Hundreds of security professionals use it every week, and most of Pluto’s business opportunities currently come from organizations that reach out on their own initiative.”

Skinos Ventures is affiliated with Shlomo Kramer, co-founder of Palo Alto Networks and Check Point Software. His participation signals that the endpoint security establishment views agentic governance as the next significant market in enterprise cybersecurity.

The company was founded by Bahat (CEO), Tal Ofer Regev (CPO), and Gil Maman (CTO). It currently employs 40 people across Israel and the United States. Funding will be used to expand its U.S. presence, grow the product team, and fund additional security research.

Why Finance and Marketing Teams Create More Risk Than Developers

The finding that finance teams generate more AI agent risk than developers requires context. Finance professionals are not writing code in the traditional sense. They are assembling automations in tools like Microsoft Copilot Studio, using Cursor to build spreadsheet orchestration pipelines, or creating invoice routing agents through no-code builders. What they are creating, often without realizing it, are software pipelines that connect to ERP systems, payment platforms, accounts payable queues, and sensitive financial records.

When those pipelines include an MCP server with excessive permissions, a skill that sends data to an external endpoint, or a model that stores conversation history on a third-party server, the security exposure is material.

This mirrors the shadow IT pattern from a decade ago: when employees can self-assemble powerful automation without IT intervention, they do. The difference is that today’s shadow automations have access to production databases, payment rails, and communication channels that shadow file-sharing services never touched.

The Plutonium Community Play

Pluto’s decision to build a free public risk database alongside its commercial product follows a model seen in developer-led security companies: earn trust with the security research community before selling to enterprise buyers. The Plutonium hub currently catalogues risks for 4,500+ AI agent components. Security professionals can check any skill, extension, MCP server, or app connector for known risks before deploying it.

This matters for enterprise procurement teams. The AI agent supply chain is substantially less mature than traditional software supply chains and harder to audit. Unlike npm packages, which have years of community scrutiny, many MCP servers were published recently by individuals or small teams with no formal security audit. Plutonium provides a practical starting point for supply chain hygiene before a new component touches production.

Implications for Enterprise AI Programs

Pluto’s traction points to a problem that most enterprise AI programs have not yet systematically addressed: shadow agentic deployments. Recent incidents, including the September 2026 OpenAI rogue agent disclosure in which AI agents scraped and transmitted sensitive content beyond their intended scope, illustrated the downstream cost of unmonitored agent behavior. A June 2026 wave of AI agent governance funding showed that the market was already moving toward structured oversight. Pluto’s early customer traction and $42 million raise show that the demand has reached the security function specifically, not just the AI governance or compliance teams.

The two-hours-to-adoption metric from Pluto’s research is the critical number for enterprise leaders to internalize. If a new AI tool reaches hundreds of corporate endpoints within hours of its announcement, the window for pre-procurement security review is effectively closed. The governance model has to operate on running agents, in real time, not just on approved tools listed in a software catalog.

For enterprises building or scaling AI programs in Q4 2026, Pluto’s emergence points to three near-term priorities:

Map the agent landscape before it scales further. Understand what agents are running across employee endpoints and cloud environments, including those built without IT involvement.
Apply supply chain hygiene to agent components. Assess the MCP servers, skills, and extensions your teams are adopting before they touch production systems. Plutonium is a practical starting point for security teams with limited capacity.
Enforce with precision, not with blocks. Governance models that disable AI tools create shadow IT by other means: employees route around restrictions. Pluto’s real-time injection approach, like Zenity’s intent-aware enforcement, points toward the architecture that preserves productivity while maintaining control.

The broader signal is that agentic security is no longer a future problem being designed for. With Pluto at $42 million, Zenity at $185 million, and multiple adjacent players raising across the governance and observability stack, the enterprise market is actively funding the infrastructure layer that makes autonomous AI deployments safe to run at scale.