Kanopy Security

Kanopy Security is building an application-security and governance layer for software that is assembled outside the traditional developer-owned software development lifecycle. The company began as Nokod Security, focused on low-code/no-code applications and robotic process automation, and now presents the same control problem through the broader Shadow AI and business-built software lens. Its public product material describes discovery and inventory across platforms such as Microsoft Power Platform and Copilot Studio, Salesforce, ServiceNow, and UiPath, with visibility into agents, flows, integrations, owners, permissions, and connected data sources. The newer agent-security proposition adds runtime behavioral profiling, policy enforcement, anomaly detection, and the ability to block or intervene when an agent takes a risky action.

The underlying customer problem is concrete. A business user can create an internal application, workflow, connector, or AI agent that accesses sensitive data and triggers consequential actions without passing through AppSec review. Traditional scanners generally inspect source code, endpoints, or infrastructure and therefore miss much of this business-built layer. Kanopy’s value depends on turning opaque platform metadata and runtime activity into an inventory that security teams can prioritize, then giving platform owners and citizen developers practical remediation paths. Relevant findings include orphaned assets, tenant-wide sharing, excessive permissions, exposed credentials, unsafe webhooks, prompt or data injection, insecure external calls, and data moving through an unintended connector. The product is most compelling where a large enterprise has thousands of distributed builders and cannot govern each asset manually.

The commercial market is expanding but crowded. Kanopy sits between SaaS security posture management, identity and entitlement governance, data-security posture management, application security, and native governance products from Microsoft, Salesforce, ServiceNow, and other platform owners. Its differentiation is therefore not simply that it inventories low-code assets; it must maintain deep integrations, understand workflow topology and business context, and provide controls that work across several ecosystems. The company’s public materials cite enterprise and Fortune 500 use cases, a Salesforce integration announced in May 2026, a Retool expansion reported in March 2026, and research around Power Apps and Power BI exposure. These are useful commercialization and product-velocity signals, but they do not independently establish recurring revenue, customer retention, or category leadership.

The team has credible cybersecurity experience: the official company profile identifies CEO Yair Finzi as a SecuredTouch co-founder and CTO Amichai Shulman as an Imperva co-founder and former CTO. Kanopy also disclosed an $8 million seed round in June 2023 led by Acrew Capital, Meron Capital, and Flint Capital. Public LinkedIn information places the company in the 11–50 employee range and identifies Tel Aviv as its headquarters; a 2025 company announcement also described a U.S. headquarters in Boulder. This supports an early venture-backed company with meaningful product development and go-to-market activity, but public evidence remains insufficient to infer scale from the disclosed employee range or to confirm current revenue, customer concentration, certifications, or deployment in sensitive government environments.

The national-security relevance is credible at the technology and control-plane level, not yet proven by public defense contracts. Defense, intelligence, healthcare, financial, and critical-infrastructure organizations increasingly use sanctioned SaaS platforms and are likely to face the same hidden agent, connector, identity, and data-flow risks. A platform that maps and constrains those workflows could reduce accidental disclosure and operational misuse in such environments. Diligence should test whether Kanopy supports tenant isolation, private or customer-controlled deployment, detailed audit exports, data minimization, incident response integration, and the operational latency and reliability required for high-consequence environments. the diligence case is consequently an interesting strategic fit with substantial execution and category-definition risk rather than a validated defense-market thesis.