Tel Aviv-based Act Security launched publicly with $60 million in total funding, split between a previously undisclosed $20 million seed round and a new $40 million Series A, betting that AI agents are about to become the biggest attack surface in enterprise cloud security.
The Problem It’s Solving
Act’s pitch centers on a specific, unglamorous statistic: the company says roughly 97% of cloud access permissions inside customer organizations sit dormant and unused, yet remain available if ever compromised.
Historically, that was a manageable risk because exploiting unused permissions required a human attacker moving at human speed.
Act’s founders argue that calculus has changed now that AI agents are being handed the same broad permissions and operating around the clock at machine speed, with none of the contextual judgment a person would apply before using them.
Rather than adding another layer of alerts for security teams to triage, a model the founders say has failed for a decade, Act’s platform enforces hard, deterministic access boundaries for humans, workloads, and AI agents simultaneously, aiming to structurally remove dormant permissions before they become exploitable.
Who’s Behind It
The seed round was led by Team8 and Bessemer Venture Partners, with Hetz Ventures and Claltech participating; the Series A was led by Notable Capital. Act was founded in 2025 by Jonathan Langer and Itay Kirshenbaum, who previously built Medigate, a medical device security startup they sold to Claroty for $400 million.
“AI agents now run inside production systems with real autonomy… access becomes the primary attack surface of the AI era,” Langer said, a framing that lines up closely with the same week’s Hugging Face breach headlines, even though the round itself was reportedly in the works well before that incident broke.
Quick Links: