One big cheque does not make a market, so let me start with the number that made me take the pattern seriously.
The Mandos platform tracks 173 companies with a product in Agentic AI Security, and together they have raised $4.05B since the category appeared. That is the whole supply side of the category everyone is pitching right now. In the same week, Proofpoint agreed to pay $6.3B for Varonis, which is not an agent-security startup but a data security company founded in 2005. What Varonis does is map which people and systems can reach which data, clean up the excess access and watch for misuse, and that map is exactly what every AI agent inherits on the day it is switched on. So the premium was paid for the ground the agents will run on, not for a new agent feature. Workday made the same kind of call with C1.ai, which decides what an agent may open. Both buyers went for the company that holds the permission, not the one that reports on it.
Here is why I think it happened.
An agent is only as dangerous as what it can reach. So, if the risk lives in the reach, then the vendor who holds the policy on who can reach what is in the path of every new agent a customer adds. It gets paid again each time the agent count goes up. The vendor who watches the agent gets a report and a seat at the renewal. One of these compounds. The other gets compared on price.
Proofpoint owns the door data leaves through and it bought the room the data sits in.
Workday knows who was hired and it bought the thing that decides what people and agents get.
Harmonic and Pluto raised on the same logic one layer up: the control sits in the browser, at the moment of use. Different layers, same instinct. Get in the path, not next to it.
The uncomfortable part is that most AI security pitches I read are built the other way around. They find things. They surface, flag, score and visualize. Those are useful products, and some of them will sell for real money. But they sell to the platform that owns the policy, and the price is a team. A decision, allow or deny, that the customer's agents stop working without, is a company. If you're a founder, that is the line I would build around. Build the enforcement point, even if it is narrow. Narrow and in the path beats broad and next to it.
If you're an investor, the 173 companies and $4.05B are the supply side. The demand side, this week, paid for revenue plus a position in the path, and it paid more for the position than for the cleverness. I would ask each portfolio company one thing: when the customer turns you off, what breaks? If the honest answer is that a dashboard goes dark, that is a feature with a cap table.
Through the eyes of a CISO buyer, this is consolidation of the permission layer, and it is happening in places the security team does not control. By next year your email vendor may hold your data access map and your HR system your agent access policy. I would count how many places in my company hold a rule about what an agent may do, and push that number down before the agents multiply. Three policy engines that disagree is worse than one that is merely fine.
Where I could be wrong: Cohere buying AISLE is the opposite pattern, a model maker paying for vulnerability research, not for policy. And Thoma Bravo may simply be buying $726M of SaaS ARR at a price it likes after a sell-off, which is a private equity trade, not a thesis. One week with one big price is a signal, not a trend.
But categories get sorted the same way every time. There is always a moment when the buyer stops asking what a product can see and starts asking what it can stop. This week looked like that moment. In AI security, the money goes to whoever holds the permission.
- Wiz changed its homepage line from "Customers rate Wiz #1 in cloud security" to "#1 in cloud and AI security" between 13 and 18 October.
- Censys renamed "Supplier Intelligence" to "Critical Infrastructure Monitoring" on its homepage, with a new URL, between 12 and 15 October. Third-party risk is out. Exposed OT is in.
- ReliaQuest's homepage metrics got slower between 12 and 16 October: detect went from under 100 seconds to under 123, and resolution from 136 to 157 minutes. The week before, every one of those numbers had improved.
- Xage Security swapped "See AI Agents." for "The Identity Fabric" on its homepage on 17 October. Agents out, identity in.
- Chainguard moved from "Secure-by-default open source software" to "Prevent AI attacks with trusted open source" on 15 October, the week of its Assemble London launches. The headline now names the attacker, not the software.
- Gray Swan dropped "Offense informs defense." for "Deploy AI safely and securely with the only solution consistently at the frontier" on 17 October. Offense is out of the headline at a red-teaming company.
One question
If you're building or backing AI security, I want to know which side of that line you are on. Does your product decide, or does it watch? Reply and tell me what breaks at your customer if they switch you off for a day. The best replies get quoted, anonymously, next week.
Thank you for reading.
If you want more than the newsletter: get the full market picture on the Mandos platform, and if you are building or investing in this space, let's talk.
Talk to you next Monday.
Nikoloz
