Backslash Security

Backslash Security focuses on a security layer that traditional application-security, endpoint, and network products do not model well: the agentic AI fabric running inside employee workstations. The company describes a platform that continuously discovers AI coding agents, copilots, MCP servers, skills, hooks, plugins, rules, and the models and tools they invoke. It combines inventory and posture scoring with policy controls such as allowlists, blocklists, approval workflows, configuration hardening, and contextual permissions. Its protection layer is intended to detect or block prompt injection, tool poisoning, unsafe scope or privilege use, suspicious agent behavior, and data or source-code exfiltration before an agent's action reaches an external system. The product also records harness-layer events, including MCP communications, agent network access, and file access, for investigation and compliance reporting.

The commercial problem is becoming more concrete as enterprises move from chat assistants to autonomous coding and workforce agents. Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, OpenAI Codex, and similar tools can read files, execute commands, call APIs, install extensions, and use MCP-connected services. That creates a control problem for CISOs: the organization may need to permit rapid AI adoption while still knowing which tools are present, which identities or permissions they hold, what data they can reach, and whether a workflow is behaving as intended. Backslash's public positioning therefore sits between AI security, endpoint security, developer security, and software-supply-chain governance. The free MCP Server Security Hub and Skills Security Scanner also function as public educational and assessment surfaces, while the enterprise platform is sold around visibility, governance, and real-time protection.

The competitive case is plausible but not yet proven. Backslash differentiates itself by asserting that it observes agent intent and tool activity at the workstation or harness layer, rather than only processes, network traffic, repositories, generated code, or model inputs. That can complement GitHub Advanced Security, Snyk, Semgrep, Apiiro, Wiz, Palo Alto Networks, CrowdStrike, and AI gateway products, but the same adjacency creates buyer and budget ambiguity. Platform vendors can add controls to their own agents and IDEs, while endpoint and identity vendors can extend existing telemetry. Backslash must demonstrate that its cross-agent and cross-endpoint coverage remains materially better than combinations of native controls, EDR, DLP, identity policy, and software-supply-chain tools. The company's public materials identify enterprise users and a growing supported-tool set, but they do not provide independently verified revenue, retention, deployment scale, or customer concentration data.

Commercial momentum is supported by the company's February 2026 announcement of a $19 million Series A led by KOMPAS VC, with Maniv, Artofin Venture Capital, StageOne Ventures, and First Rays Capital participating; the announcement says this followed an $8 million seed round. The same release says funding is intended to expand research and development, deepen the platform, and scale go-to-market in the United States and Europe. LinkedIn currently lists the company in the 11-50 employee range, with a Tel Aviv headquarters and a 2022 founding year. Those are useful maturity signals, but they should not be treated as proof of product-market fit. Relevant diligence includes paid production deployments, endpoint-agent installation and bypass resistance, false-positive rates, support for regulated environments, renewal and expansion behavior, and whether the company can convert public research and assessments into durable enterprise contracts.

The dual-use case is credible but indirect. The core technology protects software-development and knowledge-work endpoints, not weapons or military systems. Nevertheless, defense contractors, government software factories, critical-infrastructure operators, and other mission-critical organizations increasingly face the same risks from autonomous agents, untrusted extensions, data access, and software supply-chain compromise. A platform that can inventory and constrain agentic actions could support secure development environments and contractor governance, subject to deployment, sovereignty, procurement, and classified-environment requirements. There is no public evidence in the reviewed sources of defense contracts or military deployments, so national-security relevance should be treated as an addressable market and diligence hypothesis rather than established traction.