Cymphony

**Product and the concrete problem it solves.** Cymphony is aimed at a security gap that becomes more serious as enterprises connect generative-AI tools and autonomous agents to business systems: an agent can inherit a person's permissions, reach multiple repositories at machine speed, and make the consequences of an old access mistake much larger than they were for a human employee. Traditional security programs split the problem across identity governance, data security, SaaS posture, employee behavior, and application logs. That fragmentation makes it difficult to answer a deceptively basic question: which person, machine, or AI agent can reach which sensitive information, what did it actually do, and was that access appropriate in the business context? Cymphony's product is positioned as an agentless AI-security layer for the new workforce. It seeks to give security teams one operational view of employees, contractors, machines, and AI agents, then help them prioritize and remediate risky access rather than merely produce another inventory or alert feed. The company's launch example is concrete: after an enterprise connected ChatGPT to SharePoint, an overly broad permission made highly sensitive litigation documents queryable by a much wider internal population than intended. Cymphony's value proposition is to connect the access path, the data, and the behavior quickly enough to close that exposure.

**Core technology and how it works.** The central technical abstraction is a unified context or workforce graph joining data, identity, and behavior. Cymphony says the platform continuously maps identities and AI agents to the systems, permissions, and information they can access, while also incorporating activity and organizational context. In practice, that requires connectors into identity providers, HR and organizational systems, SaaS applications, file and data platforms, AI-agent inventories, and activity telemetry; a normalization layer that resolves people, service accounts, agents, files, and permissions into a common model; and an analysis layer that identifies excessive, unexpected, or newly dangerous access paths. The platform then uses AI agents to investigate findings, rank what deserves attention, recommend or automate permission changes, and coordinate the human work required for exceptions. The company describes the product as agentless and capable of being live in a day, while offering a managed-services option for complex remediation. That is a useful deployment thesis because customers can add a context and decision layer without replacing Okta, Microsoft, their data stores, or their existing security stack. Public sources do not disclose the graph database, detection models, supported connector count, tenant-isolation design, model providers, or the boundary between autonomous remediation and human approval. Those details matter because a graph that is incomplete, stale, or wrong can create a new source of security risk rather than reduce one.

**Market, customers, and go-to-market.** Cymphony sells into enterprise security, identity, data-governance, and AI-adoption budgets. Its initial wedge is the growing overlap between workforce identity and AI-agent access: security leaders need to discover shadow AI, understand what agents can reach, find stale employee permissions, and establish a defensible path to reduce exposure without waiting for a multi-year identity-governance project. The company can land with an assessment or a focused access-remediation project, then expand across data repositories, SaaS applications, and agent fleets as the graph becomes more valuable. The official product framing emphasizes Data, Identity, Threat Center, and a Maestro Security Assistant, while the launch material says the platform can be deployed without an endpoint agent and can involve Cymphony experts in harder investigations. That combination supports a low-friction enterprise motion, but the buyer and budget owner may vary between the CISO, CIO, IAM leader, data-security team, and AI-governance group. CTech identifies paying customers including Syngenta, KKR, Cass Information Systems, and Athennian; TechCrunch independently reports a double-digit number of enterprise customers, with most currently in North America and early demand from Europe, the Middle East, and Africa. The company must prove that the product is a repeatable platform rather than a high-touch consulting engagement attached to a graph.

**Traction, funding, and third-party validation.** Cymphony publicly launched in September 2026 with $30 million in disclosed funding. The company's own release describes $30 million led by Sequoia and Fin Capital, while TechCrunch and CTech describe the capital as a previously undisclosed Sequoia seed followed by a $25 million Series A co-led by Sequoia Capital and SMBC Fin Atlas Beyond Fund; the exact presentation of the total should therefore be treated as a disclosure inconsistency, not silently collapsed into one round structure. TechCrunch reports that Cymphony reached seven figures in annual recurring revenue in its first year of sales, signed a double-digit number of enterprise customers, and helped one public company identify approximately 85,000 files exposed to AI tools and agents, with no evidence that those files had been accessed through the AI systems. CTech reports a large paying customer replaced two leading products with Cymphony's platform, while the company says the financing will support engineering, go-to-market, and international expansion. These are meaningful early commercial signals, and Sequoia's decision to fund the same founders again is a notable external validation. They remain partly company-reported: public sources do not establish audited revenue, retention, gross margin, customer concentration, independent efficacy benchmarks, or the number of agents monitored in production. Cymphony's website also claims SOC 2 certification and GDPR compliance, but the exact report scope, audit date, and applicability to defense or sovereign environments require diligence.

**Founders and team background.** Cymphony was founded by Shy Dekel, Idan Berkovits, and Edi Gotlieb, who met through Israel's Talpiot technology and leadership program. CTech reports that Dekel spent nearly six years in Unit 8200 and rose to lead its Cyber Department; Berkovits managed a research group in the Israeli Prime Minister's Office; and Gotlieb, an electrical engineer, worked at Apple and later in technological positions at Israel's Ministry of Defense. The official company biography confirms the Talpiot, Unit 8200, and Prime Minister's Office background without overclaiming specific operational accomplishments. This is unusually direct founder-market fit for an identity-and-agent-security company: the team combines offensive and defensive cyber exposure, government-security context, product engineering, and experience with sensitive data environments. The founders' technical pedigree also helped Sequoia underwrite the company before it had a clear product direction, according to TechCrunch. The public team is still small—CTech reports approximately 23 employees across Israel and the United States, while TechCrunch reports about 30—so the record should preserve the discrepancy rather than choose a false precision. The key organizational question is whether the founders can build enough connector engineering, graph reliability, enterprise support, sales, compliance, and safe-remediation expertise to serve large customers without becoming dependent on founder-led delivery.

**Competitive dynamics.** Cymphony competes across several overlapping categories rather than against one identical product. Microsoft Entra, Defender, and Security Copilot can bundle identity, endpoint, data, and AI-security controls into existing enterprise agreements. Okta and SailPoint own important identity and governance relationships, CyberArk is strong in privileged and machine-identity security, and Varonis brings deep data-access analytics and remediation. Wiz and Palo Alto Networks can approach AI-agent risk from cloud-security, exposure-management, and broader platform positions. The substitute is also a patchwork of IAM reviews, data-discovery tools, DLP, SaaS-management products, SIEM telemetry, and manual access-certification projects. Cymphony's thesis is that these tools do not provide a single model of identity, information, behavior, and business context, especially when AI agents become active principals rather than passive applications. Its early customer evidence suggests a consolidation wedge, but TechCrunch reports that customers currently adopt it mostly as an additional layer and that even Sequoia views incumbent replacement as a longer-term possibility. The company therefore needs to show that a unified graph produces materially better risk prioritization, faster remediation, and safer decisions than integrations between established vendors. Large incumbents can copy the language quickly; a durable edge would have to come from graph completeness, deployment speed, proprietary activity context, remediation outcomes, and trust earned in high-consequence environments.

**Defense, security, and resilience dual-use relevance.** Cymphony's dual-use case is credible because access governance is a core security requirement for defense organizations, government agencies, and critical infrastructure, even though the public record does not disclose an IDF, allied-government, defense-prime, or classified customer. Military and intelligence environments increasingly combine human operators with service accounts, automation, mission applications, data lakes, and AI-assisted analysis. A graph that can show which identity or agent can reach sensitive systems, what it actually accessed, and whether that path remains justified could support least privilege, insider-risk reduction, secure AI adoption, and incident containment in those environments. The same mechanisms are relevant to energy, water, health, transport, telecom, and financial infrastructure where a compromised identity or overpowered automation can cause operational disruption. Cymphony's Israeli cyber and government background gives it ecosystem proximity, and its agentless approach could be useful where endpoint deployment is constrained. The calibration is important: there is no public evidence of air-gapped operation, classified accreditation, sovereign deployment, military contract, export-control posture, or resilience testing during communications disruption. The strategic value is therefore an enabling cybersecurity capability with a credible transfer path, not a demonstrated defense product. Diligence should focus on data residency, deployment in restricted networks, human approval controls, auditability, cryptographic protections, and whether automated remediation can be safely bounded in mission-critical systems.

**Growth stage, trajectory, and key diligence risks.** Cymphony is best classified as mid-stage early growth: it has a real product, named enterprise customers, seven-figure revenue reported by the company, roughly two dozen employees, a $25 million Series A within a $30 million disclosed funding total, and a stated international expansion plan, but it is only about two years old and has not shown the operating scale of a mature security platform. Its trajectory depends on turning the agent-security moment into a durable control-plane category, expanding from identity-and-data visibility into repeatable remediation, and proving that the workforce graph remains accurate as employees change roles, permissions drift, agents create sub-agents, and customers add new data systems. Principal diligence risks are: (1) incumbent bundling by Microsoft, Okta, CyberArk, Varonis, and broader security platforms; (2) graph completeness and false-positive risk when connector data is stale or business context is ambiguous; (3) unsafe automated remediation that interrupts legitimate work or creates a new outage; (4) model and data-security risk because the platform itself processes sensitive identity, activity, and data-access information; (5) concentration in large North American enterprise buyers and long security-procurement cycles; (6) unclear funding-round presentation, revenue quality, retention, and customer concentration; and (7) limited public evidence for defense-grade, sovereign, or offline deployment. Milestones worth tracking include independently validated reduction in excessive access, expansion of named customers outside North America, audited recurring-revenue and retention metrics, mature approval and rollback controls, and a government or critical-infrastructure deployment that demonstrates the dual-use thesis under real constraints.