Koi Security

Koi Security developed a focused security platform for a structural shift in endpoint risk: modern endpoints are no longer defined only by operating systems, binary executables, and managed applications. Developers and business users now install browser extensions, IDE plugins, open-source packages, app-store add-ons, local AI models, MCP servers, coding agents, and autonomous tools that can hold credentials, read files, call APIs, update silently, and execute actions with the permissions of the user or workstation. Koi's thesis is that this "software perimeter" has become a distinct control plane, and that conventional endpoint detection and mobile device management controls were not designed to inventory or govern it at the speed of agentic AI adoption.

The product combines discovery, risk assessment, policy enforcement, and remediation across binary and non-binary software on macOS, Windows, and Linux. Koi's public product materials describe inventory for applications, code and operating-system packages, extensions, AI models, AI agents, MCP servers, and containers; risk scoring through the Wings engine, which evaluates code, behavior, ownership changes, update channels, network egress, and install source; and policy controls that can approve safe software, block risky installs, quarantine or remove problematic items, open tickets, and notify owners. The platform is positioned as agentless and workflow-aware: security teams can apply controls by user, group, risk level, software type, and asset sensitivity without forcing broad bans that slow developers and other high-velocity teams.

Commercial traction appears credible for a company founded in 2024. Koi announced $48 million across Seed and Series A funding in 2025, backed by Battery Ventures, Team8, Picture Capital, NFX, and Cerca Partners. Its own customer materials identify adoption by large security-sensitive organizations and describe a Cambia Health Solutions deployment that mapped 220,000+ software installations across 14 marketplaces and registries, including browser extensions, IDE plugins, open-source packages, and AI tooling. That case study is important because it shows the product value is not limited to an abstract AI security narrative; it also solves older but persistent shadow-IT and software supply-chain visibility gaps that become more urgent as coding agents and MCP servers gain access to internal systems.

Palo Alto Networks first announced its intent to acquire Koi in February 2026 and announced completion on April 14, 2026. Palo Alto positioned the acquisition as defining a new Agentic Endpoint Security category, with Koi extending Prisma AIRS visibility and controls to agentic AI on the endpoint and enabling a Cortex XDR module for identifying and remediating risks in the AI software ecosystem. Palo Alto also stated that Koi's capabilities would remain available as a standalone offering alongside existing EDR tools. This shifts Koi from a standalone Series A direct diligence target into a strategic technology component inside a major cybersecurity platform, but it also validates the category: a public incumbent considered endpoint-level AI agent governance important enough to acquire quickly after Koi's launch.

The dual-use relevance is substantial. Defense contractors, intelligence organizations, national laboratories, and critical-infrastructure operators face the same productivity pressure to adopt AI coding agents and autonomous tools as commercial enterprises, but with stricter requirements for compartmentalization, auditability, credential handling, and software provenance. Agentic endpoint controls can help govern which tools are allowed in sensitive development environments, detect risky MCP servers or extensions, enforce different policies for privileged users, and create evidence that software intake is being monitored continuously. The technology is not a weapon system, but it is directly relevant to secure software assurance, classified or export-controlled development workflows, and the broader problem of keeping autonomous tools from becoming privileged insiders on mission networks.