Pluto Security has raised $42 million to develop security software for enterprise AI agents. Its platform is designed to find agents across employee endpoints, cloud infrastructure and software-as-a-service applications, then record the models, tools and customisations attached to them. Figures mentioned are indicative and may vary depending on eligibility, assessment, region and market conditions.
That makes this a useful case study for operators. The issue is not whether a model can generate text or images. It is whether a business can identify every agent, understand what that agent can reach and define what should happen when a workflow attempts a risky action. This is different from a standalone discussion of computer vision or natural language processing: the focus here is software that can use tools and participate in business workflows.
Why AI agent security starts with visibility
An agent is assembled from more than its underlying model. A user may add a plugin, connect a file repository, attach prompts or link an external application. Each addition can change the agent’s practical access and behaviour.
Pluto’s platform is built to map these components across several environments. It collects telemetry about the model powering an agent, the tools it uses and the customisations users have added. That information gives security teams a way to examine the workflow rather than reviewing the model in isolation.
The operational challenge is straightforward: manual discovery can take significant time, and administrators may overlook agents that were created or modified outside a formal procurement process. An untracked agent is not necessarily malicious, but it can still create an unclear security boundary if its tools, repositories or integrations have not been reviewed.
What Pluto Security is actually offering
The company’s product has three connected elements. First, it maps agents and collects telemetry. Second, it uses policies to govern actions. Third, it provides research and a separate service for checking publicly available agent extensions, application connectors and MCP servers before installation.
When an agent attempts an action that a policy treats as risky, Pluto can send an instruction telling it to stop the workflow. Companies can define rules for specific situations. For example, a software startup could permit developers to run AI-generated scripts only when those scripts do not interact with a sensitive system.
That control has a practical trade-off. A policy is only useful when someone defines the protected systems, maintains the rule and handles exceptions. A growing policy set can reduce ambiguity around agent behaviour, but it can also add configuration and review work for security and engineering teams.
Pluto says its sensors use hardware-efficient AI models to identify malicious activity, and the platform can also use telemetry from a customer’s existing cybersecurity tools. This may reduce the need to collect every signal through a new deployment, but buyers still need to examine coverage, integration dependencies and the quality of the resulting telemetry.
What the funding and customer details reveal
Pluto raised about one-fifth of the total in a seed round led by TLV Partners. The remaining funding came through a Series A led by Jump Capital, with additional backers participating. Figures mentioned are indicative and may vary depending on eligibility, assessment, region and market conditions.
The company reportedly generates more than $2 million in annualised revenue from over 30 enterprise customers. Figures mentioned are indicative and may vary depending on eligibility, assessment, region and market conditions.
Pluto also offers Plutonium, a free service that checks publicly available agent extensions, connectors and MCP servers. The service provides data on more than 4,500 tools. Figures mentioned are indicative and may vary depending on eligibility, assessment, region and market conditions.
Those details matter because they show how the company approaches the problem: enterprise monitoring, pre-installation checking and security research are being presented together. For a buyer, that creates a useful evaluation question: do you need a discovery layer, a control layer, a testing service, or some combination of the three?
From model review to workflow review
Teams evaluating ai agents should separate three questions that are often collapsed into one:
- What exists? Can the organisation discover agents across employee devices, cloud infrastructure and SaaS applications?
- What can it reach? Which tools, repositories and external applications are connected to each agent?
- What should happen? Which actions should be allowed, blocked or escalated for review?
This distinction also clarifies where common engineering practices fit. Prompt engineering may affect how an agent interprets instructions, but it does not define every permission available through a connector. Penetration testing may help examine how an agent or integration behaves under hostile conditions, but it does not replace inventory and policy ownership.
Teams using reinforcement learning to improve behaviour still need to inspect the tools and data sources surrounding the model. Better task performance does not, by itself, establish that a workflow is appropriately constrained.
What founders should build around this gap
The opportunity is not simply to build another model. Pluto’s product points to narrower problems around agent discovery, connector review, telemetry, policy enforcement and security research.
A founder assessing this market should look for a specific control point:
- Discovery: identify agents that existing endpoint, cloud or SaaS systems may not describe clearly.
- Context: show the model, tools, integrations and user-created customisations attached to each agent.
- Decision: express a policy in terms that security and engineering teams can review.
- Intervention: provide a defined response when an agent attempts a restricted action.
The strongest products in this area will need to explain more than a risk score. Buyers will want to know which agent acted, which tool it invoked, which rule applied and what operational consequence followed. That evidence is valuable for troubleshooting, policy refinement and incident review, although collecting and retaining it can introduce additional governance work.
Where the ci cd pipeline fits
Agent controls should not be considered only after deployment. The ci cd pipeline can be a place to check agent configuration, connector changes and policy updates before they reach a production workflow. The exact checks will depend on the organisation’s systems and risk tolerance.
A practical starting checklist is:
- Record the agent owner, model, tools and connected data sources.
- Identify actions that could affect sensitive systems or external applications.
- Define which changes require review, especially new connectors and user-created customisations.
- Test a realistic workflow, including a case where the policy should stop the action.
- Review integration effort, alert handling, policy maintenance and exception ownership.
What caught my attention is the specificity of the control problem. The platform is not described as a general-purpose replacement for existing security operations. It is aimed at making agents and their connected components more visible, then giving organisations a way to apply rules around behaviour.
As software gains the ability to act through tools, security has to inspect the workflow—not only the model.
For more practical analysis of AI, automation and product execution, explore the Yanisa Execution blog or speak with the team about reviewing your automation stack.
Frequently Asked Questions
What problem does Pluto Security solve for enterprises?
Pluto Security is designed to help organisations discover AI agents across employee endpoints, cloud infrastructure and SaaS applications. It also records the models, tools and customisations associated with those agents so teams can review their operational exposure.
How can Pluto Security respond to a risky AI agent action?
Organisations can define cybersecurity policies for agent behaviour. When an agent attempts an action covered by a policy, Pluto can send an instruction that stops the workflow, subject to the policy’s coverage and configuration.
What is Plutonium used for?
Plutonium allows companies to check publicly available agent extensions, application connectors and MCP servers before installing them. It provides information about more than 4,500 tools. Figures mentioned are indicative and may vary depending on eligibility, assessment, region and market conditions.
Why do AI agents need monitoring beyond the underlying model?
An agent’s practical behaviour can depend on its plugins, prompts, file repositories and external application integrations. Reviewing only the model may therefore leave important parts of the workflow unexamined.
What should a company check before buying AI agent security software?
A company can assess whether the product discovers agents across its operating environments, identifies connected tools and customisations, integrates with existing security tools and supports clear policy decisions. It should also review the ongoing effort required for alerts, exceptions and policy maintenance.