Pluto Security Exits Stealth With $42M to Rein In Employees' Rogue AI Tools

By Hamza Faisal

Every company now hands its employees AI tools and hopes for the best. The problem, as Pluto Security’s chief executive Shahar Bahat puts it, is that people use them in unexpected ways — and security teams have no idea what just walked through the door.

On October 13, the cybersecurity startup emerged from stealth with $42 million in total funding to make sure those surprises are caught before they turn into breaches.

Pluto’s pitch is aimed squarely at the “shadow AI” problem: employees adopting AI assistants, connectors and autonomous agents in hours — sometimes minutes — while the security team is still reading the vendor’s privacy policy.

Bahat told TechCrunch that a newly announced AI tool can show up inside a company’s environment within two hours of its release, and that roughly 60 percent of the risks her company detects are in tools vibe-coded by non-developers.

The pattern Pluto has seen across its customer base is counterintuitive: finance departments, not developers, are the biggest source of risky AI tooling, followed by marketing and legal teams. Developers rank only fourth.

In one case, Pluto’s software found a vibe-coded app built by a finance employee at a Fortune 500 company to manage customer information and churn — left exposed to the open internet.

Bahat said the scale of the gap shocked even her team: “In general, I’ll say there was not one POC in which we entered and didn’t find malicious stuff,” she said, adding that some of the extension packages and AI skills they examined were under active live attack while the proof of concept was running.

Pluto’s software monitors the AI tools employees use, the skills, extensions and MCP servers those tools depend on, and the apps and agents employees are building. Crucially, it watches what AI agents are doing in real time.

If an agent tries to gain permissions beyond what its user intended, the system can stop the action or inject context into the session that prompts the agent to ask for confirmation.

The company connects to endpoint security and device management systems, deploys its own sensors, and runs lightweight models on endpoints to assess what an agent is trying to do. “We’re moving from user behavior to agent behavior,” Bahat said.

The bet is that securing AI environments means understanding intent and acting in context, rather than simply blocking tools until employees route around them.

Founded in 2025 by Bahat, Tal Ofer Regev and Gil Maman — veterans of Microsoft, Palo Alto Networks, Bridgecrew and Israel’s Unit 8200 — Pluto began selling in April 2026 and says it has already crossed $2 million in annual recurring revenue, with more than 30 enterprise customers including Oscar Health, Workato, Sixt and AlphaSense.

Israeli press reports put the customer count above 40, with more than a million endpoints secured.

Its funding spans an $8.5 million seed round led by TLV Partners, with the founders of cybersecurity firm Armis also investing, and a roughly $34 million Series A led by Jump Capital, with participation from Skinos — Check Point co-founder Shlomo Kramer’s venture firm — Ansa Capital and angel investors.

The startup also built an unusual inbound engine: in April it launched Plutonium, a free platform where anyone can check the risks of publicly available AI skills, connectors and add-ons, complete with an MCP scanner and a catalog of verified components.

Bahat claims thousands of security professionals use it, and that 70 percent of Pluto’s sales pipeline now arrives inbound.

The new capital will go toward product development, security research and expanding the company’s US presence, where it now employs around 40 people alongside its Israel team. Pluto’s thesis is blunt: the era of approving software before employees use it is over — and security has to learn to keep pace instead.