Your finance team might be running the riskiest software in your company, and your security team probably doesn’t know it exists. That’s the warning from Pluto Security, which just came out of stealth with $42 million in funding, according to TechCrunch AI. CEO and co-founder Shahar Bahat told the outlet that about 60% of the risks her company finds across its customers come from tools vibe-coded by non-developers.
Finance departments top that list. Marketing and legal follow. Developers come in fourth.
🚨 The Risk Is Already Inside
Bahat says a newly released AI tool can show up inside a company’s environment within two hours of launch. That’s faster than most security teams can review a vendor questionnaire, let alone approve a tool.
One example: Pluto’s tools found a vibe-coded app built by a finance employee at a Fortune 500 company. It managed customer information and churn data, and it was exposed to the open internet.
Bahat says that wasn’t a one-off. “In general, I’ll say there was not one POC in which we entered and didn’t find malicious stuff,” she told TechCrunch. “Whether those are extension packages or skills,” she added, “some of them had active live attacks while we did the POC.”
So in every proof-of-concept trial, the company found something malicious, and some of those attacks were live. If you run security at a company that has rolled out AI tools widely, assume you have the same problem.
💰 The Funding and the Traction
Pluto’s $42 million comes from two rounds:
- $8.5M seed led by TLV Partners, with the founders of cybersecurity firm Armis investing
- $34M Series A led by Jump Capital, with Skinos (Check Point co-founder Shlomo Kramer’s venture firm), Ansa Capital and angel investors participating
The company started selling only in April. It has already passed $2 million in annual recurring revenue and signed more than 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense. It has 40 employees across the U.S. and Israel.
Pluto isn’t alone. A new wave of security startups is raising big rounds on one shared belief: tools built to watch people can’t properly watch AI agents. Trying to stretch existing security software over AI tools, connectors and usage is a square-peg, round-hole approach.
🔍 Watching Agents, Not Just People
“We’re moving from user behavior to agent behavior,” Bahat said. That sentence sums up the shift. Traditional security tools track what employees click, download and share. AI agents act on a user’s behalf, with that user’s permissions, at machine speed.
Pluto’s software monitors:
- The AI tools employees use
- The skills, extensions and MCP servers those tools rely on (MCP, or Model Context Protocol, is the standard that lets AI agents plug into outside apps and data)
- The apps and agents employees build themselves
It plugs into existing endpoint security and device management systems, deploys sensors on devices, and collects prompts, commands, running processes, permissions and past user activity. Small on-device models then try to work out what an agent is actually doing.
What stands out is that Pluto can step in mid-task. If an agent tries to grab more permissions than the user intended, the system can block the action or feed new instructions into the session that tell the agent to ask for confirmation first. “We can inject context back to the session, and this way I can change how the agent is working,” Bahat explained.
Pluto also runs Plutonium, a free platform for checking the risks of public AI skills, connectors and add-ons, plus an MCP scanner and a catalog of verified components. Bahat says 70% of the company’s sales pipeline now comes from inbound interest.
🛡️ What Security Teams Should Do Now
You don’t need to buy anything to start closing these gaps. Here’s where to begin:
- Take inventory. Find out which AI tools, browser extensions, agent skills and MCP servers are already running on company devices.
- Look beyond engineering. Pluto’s data shows that finance, marketing and legal create more risk than developers do. Audit those teams first.
- Hunt for exposed apps. Check whether any internally built AI apps are reachable from the public internet, especially ones that touch customer data.
- Vet third-party components. Treat skills and connectors like any other software supply chain risk. Scan them before anyone installs them.
- Limit agent permissions. Agents shouldn’t get broad access just because the person running them has it.
What Comes Next
Pluto plans to spend the new money on product development, security research and growing in the U.S. The bigger trend is easy to read: monitoring what agents do is becoming its own security category, and investors are paying up for it. Expect more rounds like this one, and expect CISOs to face harder questions about the AI tools their companies are building in-house. The full story is on TechCrunch AI.