Sequoia backs Cymphony's $25M round as AI agents widen enterprise attack surfaces

Cymphony, a cybersecurity startup focused on the risks introduced by AI agents, has closed a $25 million Series A round that values the company above $100 million. Sequoia Capital and SMBC's Fin Atlas Beyond Fund co-led the investment, a bet that enterprises racing to deploy autonomous software will need new kinds of protection. The funding arrives as IT teams grapple with agents that can execute tasks, move data, and make decisions with minimal human oversight.

The company's pitch is straightforward: traditional security tools were built for static applications and human users, not for software that acts on its own. AI agents, which can browse the web, access internal systems, and interact with other agents, create novel attack vectors — from prompt injection to unauthorized lateral movement. Cymphony says its platform monitors agent behavior, enforces permissions, and flags anomalies in real time, giving security operations teams visibility into what these systems actually do.

This is not a hypothetical concern. Enterprises are pouring money into agentic AI, with Gartner predicting that 40% of agentic AI projects will be canceled by 2027 due to poor governance and security gaps. Early adopters in finance, healthcare, and legal services have already reported incidents where agents accessed restricted data or took actions outside their intended scope. Cymphony's founders, who previously built security products at Palo Alto Networks and Okta, argue that the market is moving faster than most vendors' roadmaps.

The round's structure also signals where investors think the category is headed. SMBC, a major Japanese banking group, led through its fintech-focused fund — a hint that financial institutions, which face strict regulatory scrutiny, are among the first sectors demanding agent security. Sequoia's participation follows its recent investments in AI infrastructure and security startups, suggesting the firm views agent governance as a foundational layer rather than a niche add-on.

Cymphony plans to use the capital to expand its engineering team and open a second office in Tokyo, closer to SMBC's network. The company will also invest in research around multi-agent coordination, where security becomes even harder because agents can delegate tasks to each other, obscuring the original source of an action. Competitors like Lakera and Robust Intelligence are chasing similar problems, but Cymphony's early enterprise design wins give it a foothold.

The deeper question is whether security can keep pace with the speed of agent adoption. Vendors are releasing features monthly, while enterprises still lack standards for auditing agent behavior across different platforms. Cymphony's next test will be proving its tools work not just in demos but across the messy, fragmented stacks that real companies run. If it succeeds, this round could look prescient; if not, it will be another cautionary tale in the AI gold rush.