Harmonic Security raised a $50 million Series B led by Crosspoint Capital Partners, lifting its total funding to $76 million. Calcalist put rival Prompt Security's sale at about $250 million on $23 million raised, the nearest price comparison.
Perspective Coverage
6 publishers
- Builder
- Builder 27%
- Operator
- Operator 38%
- Investor
- Investor 35%
Reality
- Evidence55
- Adoption35
- Hype gap+20
- Incentives65
- Confidence62
Descope's Agentic Identity Hub 3.0 puts a reviewer between employees and their AI agents
Descope's Agentic Identity Hub 3.0 provisions no employee-requested AI agent until a reviewer approves it. Descope says teams will not route around the workflow, but it did not disclose approval times.
Reality
- Evidence30
- Adoption25
- Hype gap+25
- Incentives70
- Confidence55
Pluto Security came out of stealth with $42 million in total funding for software that watches what employees build with AI tools. CEO Shahar Bahat argues that employees adopt tools faster than security teams can evaluate them; the usage figures behind that come from Pluto.
Perspective Coverage
9 publishers
- Builder
- Builder 21%
- Operator
- Operator 35%
- Investor
- Investor 44%
Reality
- Evidence35
- Adoption40
- Hype gap+20
- Incentives75
- Confidence60
IBM's 2026 breach study finds no proper AI access controls in 92% of AI-related breaches
IBM and Ponemon put the average data breach at a record $4.99 million, up 12%, in a study of 602 organizations. In Varonis's account, 92% of AI-related breaches lacked proper AI access controls, though AI-driven attacks also added about $1 million each.
Reality
- Evidence58
- Adoption40
- Hype gap+20
- Incentives70
- Confidence60
67% of AI-using small and mid-sized firms run tools they built, Pax8 survey finds
Pax8's survey of 1,150 business leaders finds 67% of AI-using small and mid-sized firms have built an AI tool now in regular use. In every market most builders lack a formal, documented review, so governance, security and cost questions fall to the IT providers who serve them.
Reality
- Evidence45
- Adoption55
- Hype gap+15
- Incentives70
- Confidence50
AppViewX's agent identity product adds a kill switch that reaches shadow AI agents
AppViewX's Agent Identity Security now finds browser-based and short-lived shadow AI agents and can terminate any agent and its sessions at runtime. It handles agents as identities to scope and revoke, and every claim about how well that works comes from AppViewX and one customer, ZoomInfo.
Reality
- Evidence30
- Adoption20
- Hype gap+45
- Incentives85
- Confidence35
Delinea survey finds about half of firms check AI access against policy in real time
Delinea's 2026 survey found 99.7% of IT and security leaders have a formal AI data policy, but only about 51% check AI access against it in real time. For responders, the shortfall comes after an agent starts acting: how fast out-of-scope access is seen, and how fast it is taken away.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence40
buildConfirmed3 publishers Glow's PixelLeak report found coding agents exposed more than 13,000 private screenshots from over 300 organisations by hosting them in public GitHub repos. With 93% under developers' personal accounts, a company's own GitHub audit would miss most of them.
Perspective Coverage
3 publishers
- Builder
- Builder 42%
- Operator
- Operator 50%
- Investor
- Investor 8%
Reality
- Evidence55
- Adoption50
- Hype gap+10
- Incentives55
- Confidence60
BlackFog's ADX Vision 2.0 screens AI agents' prompts on the endpoint before they reach a model
BlackFog's ADX Vision 2.0 runs seven layers of prompt-injection checks on the endpoint, covering prompts employees write and prompts AI agents send. Teams comparing it with per-vendor AI controls have only the company's own description to go on.
Reality
- Evidence22
- Adoption
- Not scored
- Hype gap+35
- Incentives75
- Confidence30
Detectify finds most exploitable flaws on customer perimeters have been open more than 90 days
Detectify found 86% to 97% of open critical and high flaws on 1,293 customers' internet-facing systems had been exposed for more than 90 days. Its scanner confirmed each with a working attack request, so these are known, reachable flaws left to age.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence55
LastPass turns its password manager extension into a shadow AI monitor for Business Max
LastPass added shadow AI discovery and sensitive-data warnings to Business Max, run from the browser extension its customers already use. Teams on that tier get a warning and an audit log for browser AI use, and the release describes hard blocks only for web categories.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+25
- Incentives75
- Confidence45
Omnissa pitches Elara at the unapproved AI assistants employees run on work devices
Omnissa launched Elara for AI governance, citing its own report that AI-assistant use on work devices grew nearly 1,000% in 2025, mostly via unapproved tools. For endpoint teams it is a new category to assess, and the controls Omnissa described attach most clearly to agents IT has already granted access.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+40
- Incentives75
- Confidence40
Accounting firms that cap AI usage at filing season trade an overage bill for shadow-AI risk
AI token caps are pushing accountants onto free chatbots as the Oct. 15 extension deadline nears, CPA Practice Advisor reports. The overage a firm saves is known in advance, while the cost of client records held by an unvetted vendor is set only after a breach.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+30
- Incentives62
- Confidence42
Stolen AI session cookies survive a password reset, SOCRadar's exposure report says
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+35
- Incentives85
- Confidence40
Stolen ChatGPT sessions turn up at 358 of 482 companies in SOCRadar's stealer-log study
SOCRadar found captured ChatGPT sessions at 358 of the 482 companies whose AI accounts turned up in 90 days of infostealer logs. The firm ties the spread to shadow AI, with employees opening work-email accounts that IT never sees.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence45
AWS report ties shadow AI to review queues that outlast the experiments
AWS's Reimagine 2026 report, built on 154 executive interviews, says review processes sized for six-month IT programs are driving AI use underground. AWS's answer is governance built into the systems themselves, with humans kept accountable for outcomes.
Reality
- Evidence40
- Adoption25
- Hype gap+10
- Incentives65
- Confidence45
Okta and 11 vendors including AWS, Google Cloud and CrowdStrike signed six shared principles for securing AI agents under a new Blueprint Alliance. Buyers can put the list to vendors in procurement now, while Okta's release describes a reference architecture with no stated way to test compliance.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+35
- Incentives70
- Confidence55
AI agents turn the endpoint inventory into a record of permissions and actions
Only 36% of IT staff in an Automox survey feel highly confident in their endpoint compliance visibility, as AI agents start acting on managed devices. Agents inherit their launcher's rights, so teams now need a record of what each may do and what it did.
Reality
- Evidence40
- Adoption50
- Hype gap+25
- Incentives80
- Confidence40
Microsoft extends Purview data blocking to the network layer for employees and their AI agents
Microsoft's Purview and Entra Global Secure Access can now block sensitive uploads to unsanctioned AI tools at the network layer, for users and agents. Licensing is not in the announcement, so tenants cannot yet tell whether it is a setting or a purchase.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives85
- Confidence40
Three quarters of security teams are funding AI without a budget line for it
An IANS and Artico survey puts AI at about 3 percent of the average security budget, and 24 percent of organizations have given it a line of its own. Bugcrowd's CEO says the rest comes out of what was already bought.
Reality
- Evidence40
- Adoption48
- Hype gap+15
- Incentives78
- Confidence45
Earlier coverage
- Uber exhausted a year of Claude Code budget in four months
Leadership · September 9, 2026 · One report1 publisher