Pluto Security

**Product and the concrete problem it solves.** Pluto Security is addressing a security gap created when software creation moves outside the traditional engineering workflow. Its public materials describe a world in which employees in engineering, marketing, sales, IT, and other functions can use AI builders, browser-based development environments, no-code tools, and autonomous agents to create applications, automations, workflows, and customer-facing experiences. Those artifacts can reach production systems, sensitive data, and external users without passing through a conventional software-development lifecycle, security review, secrets-management process, or access-control design. Pluto's product thesis is that CISOs should not have to choose between blocking these tools and allowing them without supervision. The company presents its AI Workspace Security Platform as a control layer that gives security teams visibility into what is being built, an understanding of the associated risk, and real-time guardrails that can enforce policy while work is happening. The concrete buyer problem is therefore not simply whether an employee used an AI assistant; it is whether the organization knows which AI builders and agents exist, what artifacts they produced, which extensions or connectors they rely on, what permissions they can reach, and how to enable useful work without creating a new ungoverned application estate.

**Core technology and how it actually works.** Pluto's public documentation is deliberately product-level rather than an engineering white paper, so the precise implementation of its discovery, risk scoring, and enforcement logic is not disclosed. The official and Israeli export-ecosystem descriptions do establish an architecture centered on agentless visibility and automated governance. The monitored surface includes AI builders such as Lovable, Cursor, Replit, and n8n; the artifacts those tools create; MCP servers and connectors; AI browsers; IDE extensions; browser extensions; and the broader workspace around them. Agentless operation is strategically important because the relevant activity often occurs in browser sessions, third-party SaaS workspaces, local developer tools, and business-user workflows where installing and maintaining a conventional endpoint agent may be difficult or politically costly. Pluto says it connects to existing security and infrastructure systems rather than requiring the organization to replace its current stack, then applies contextual risk understanding and guardrails to creation workflows. The public record does not confirm whether discovery relies on identity-provider telemetry, browser or SaaS APIs, endpoint signals, network controls, direct integrations, or a combination of these methods. It also does not disclose the model architecture, policy language, latency, action granularity, or false-positive controls. Those unknowns are material: a security product that merely inventories approved tools is less valuable than one that reliably links a builder to its generated artifact, permissions, dependencies, and runtime exposure, while a product that blocks legitimate work too aggressively will drive users toward shadow workarounds.

**Market, customers, and go-to-market.** Pluto sells into the emerging overlap of AI security, application governance, endpoint visibility, software supply-chain risk, and identity or access control. The natural economic buyer is a CISO or security leader responsible for allowing generative-AI adoption across an enterprise, with adjacent stakeholders in IT, application security, engineering, data protection, compliance, and business-unit operations. The product can be positioned as an additive control layer because its stated purpose is to govern workflows that conventional security programs do not fully see, rather than to replace every EDR, DLP, IAM, or cloud-security investment. Startupim describes the business model as B2B subscription SaaS and reports a Tel Aviv-Yafo headquarters, which is consistent with a software-led enterprise motion. Pluto's own site emphasizes integration and invites organizations to bring their existing tools into the platform, suggesting that frictionless deployment and broad connector coverage are central to the go-to-market strategy. The likely path is design-partner-led enterprise selling: identify uncontrolled AI-building activity, demonstrate the exposure in a customer environment, establish policy guardrails, and expand from a small security team deployment into broader workspace governance. No named paying customers, annual recurring revenue, renewal data, deployment count, or contract values are publicly disclosed. Until those metrics appear, the market case should be framed as a credible and fast-growing security need rather than proven product-market fit.

**Traction, funding, and third-party validation.** Pluto has unusually strong ecosystem visibility for a company that remains early and private, but its public evidence is mostly qualitative. The official website says the company is backed by security and cloud ecosystems and is part of accelerator programs including AWS, CrowdStrike, and NVIDIA. The Israel Innovation Summit at RSA lists Pluto as an endpoint-security exhibitor and gives a concrete description of its visibility and governance coverage across AI builders, artifacts, MCPs, AI browsers, IDE extensions, and browser extensions; it also identifies Tal Ofer Regev as CPO and co-founder. Startupim reports a seed round led by TLV Partners with participation from Ariel Maislos in 2025, while leaving the amount undisclosed. That report also identifies Pluto Security Ltd. and presents Tel Aviv-Yafo as the headquarters; its page contains inconsistent founding metadata, listing 2022 in one header and August 2025 in its detailed Q&A and Israeli-company registry section. The safer conclusion is that the operating venture was publicly formed in 2025 and that the Israeli legal entity was incorporated on 31 August 2025, while the earlier date may reflect preliminary formation or directory error. Forbes Israel's December 2025 interview with Shahar Bahat provides independent validation of the problem urgency: she describes AI-generated applications reaching production, accessing sensitive systems, and bypassing secrets management, access control, and logging. These sources validate a real problem, a live company, an identifiable product thesis, and early investor or ecosystem support; they do not validate revenue scale, customer retention, benchmark efficacy, or production outcomes.

**Founders and team background.** The strongest public evidence concerns the founding team's security and product provenance. Shahar Bahat is identified by Forbes Israel as a Pluto co-founder and is described as a former Unit 8200 operator and product leader at Microsoft and at earlier startups. Her public framing of the market is specific: business users are becoming software builders, and security teams need contextual guidance and guardrails rather than blanket blocking. Gil Maman is identified by the SANS Institute as Pluto's CTO and co-founder. SANS reports that Maman spent more than six years in Israeli Military Intelligence in technical leadership roles spanning advanced cyber R&D and operational security engineering; it also describes earlier work as a founding engineer, engineering roles at eBay involving machine learning systems, security tooling, and OSINT-oriented tools, and academic research in static analysis, software integrity, and OSINT methods. He holds a BSc in Computer Science and an MBA from Tel Aviv University. The Israel Innovation Summit identifies Tal Ofer Regev as CPO and co-founder, while Startupim likewise lists Bahat and Regev as co-founders. Pluto's own about page summarizes the broader team as coming from Unit 8200, Microsoft, and Palo Alto Networks, but does not map each background to a named executive. This combination is well matched to a product that sits between cyber defense, developer tooling, and human behavior. It is not proof that the team has solved the harder scaling questions: the current headcount, engineering depth, customer-success capacity, and experience taking an agentless platform through large regulated deployments are not publicly quantified.

**Competitive dynamics.** Pluto enters a crowded market, but its exact category is still forming. Microsoft Defender for Endpoint, Intune, Defender for Cloud Apps, and Entra can bundle endpoint, identity, application, and SaaS governance into existing enterprise agreements. CrowdStrike and SentinelOne have installed endpoint agents, security telemetry, and partner ecosystems that could be extended toward AI-builder monitoring. Palo Alto Networks can approach the problem through Prisma Cloud, Cortex, browser security, and AI-security products, while Cisco AI Defense and Lakera compete around the policy, inspection, and runtime-governance layers of enterprise AI. Israeli companies such as Prompt Security and Noma Security pursue adjacent AI-use and AI-application controls, and application-security vendors can extend from code, dependency, or runtime analysis into the artifacts created by AI tools. Pluto's potential differentiation is not a new cryptographic primitive; it is the combination of an agentless discovery surface, an AI-builder-specific inventory, risk interpretation for artifacts and surrounding extensions or MCPs, and enforcement designed for non-developer workflows. The product may be easier to adopt than an endpoint replacement if it genuinely connects to tools that existing controls miss. The potential edges are: (1) seeing AI creation as a workspace and supply-chain problem rather than only a prompt or model problem; (2) translating technical findings into guardrails that business users can understand; (3) covering the surrounding ecosystem of extensions, connectors, and agents; and (4) using integration rather than rip-and-replace as the first enterprise wedge. Those edges remain hypotheses until Pluto publishes connector breadth, policy precision, time-to-value, independent evaluations, and evidence that customers keep the controls enabled after the initial AI-risk audit.

**Defense, security, and resilience dual-use relevance.** Pluto's dual-use case is credible through cyber-resilience and software assurance, not through a disclosed weapons or military product. Defense ministries, government agencies, defense contractors, hospitals, banks, utilities, and other critical operators are all beginning to let non-specialists use AI systems to write code, create automations, query sensitive data, or connect services. An unmanaged AI-built application can expose credentials, create unauthorized integrations, expand lateral-movement paths, or become an opaque dependency in a mission-support workflow. A visibility and governance layer that identifies these builders and artifacts could help a security team distinguish approved experimentation from a production-relevant risk, require review for sensitive actions, constrain dangerous connectors, and preserve an audit trail for software that never entered a conventional CI/CD pipeline. That is strategically relevant to allied digital sovereignty because defense and resilience increasingly depend on the integrity of software assembled from commercial AI tools and third-party components. The calibration is important. Pluto does not publicly claim a defense contract, classified deployment, government authorization, or critical-infrastructure customer. It has not disclosed disconnected or sovereign deployment, secure update procedures, data-residency controls, endpoint behavior under degraded connectivity, or compliance beyond the trust badges displayed on its site. A defense buyer would also require assurance that the guardrail layer cannot itself become a privileged control-plane attack surface. Pluto should therefore be classified as a commercial cyber-resilience capability with meaningful defense adjacency, not as a fielded defense technology.

**Growth stage, trajectory, and key diligence risks.** Pluto is best classified as early. The company appears to have been incorporated in Israel in 2025, reports a seed financing with undisclosed terms, remains small in public ecosystem profiles, and has only recently established a visible product and thought-leadership footprint. Its trajectory could be attractive if AI-built software becomes a permanent enterprise governance category rather than a temporary policy concern. The expansion path is coherent: start with agentless discovery of AI builders and their ecosystem, add contextual risk scoring and safe defaults, then move toward artifact review, least-privilege enforcement, continuous monitoring, and governance for autonomous agents operating in sensitive environments. The principal diligence questions are: (1) whether Pluto can discover activity without invasive agents or fragile integrations; (2) how accurately it maps a user, builder, artifact, connector, permission, and downstream data path; (3) whether policy actions are explainable and safe enough for production; (4) how it handles browser-based and local tools that change rapidly; (5) whether customers will pay for a distinct platform while Microsoft and larger security vendors bundle adjacent controls; (6) whether the founders can build enterprise distribution and support beyond early Israeli ecosystem access; and (7) whether the company can demonstrate operation in regulated, sovereign, or disconnected environments. Additional risk comes from sparse disclosure: the public record does not establish funding size, headcount, named customers, revenue, retention, product benchmarks, patent filings, or the exact division of responsibilities among the founders. The key milestones to track are named reference customers, a published integration catalog, measured reduction in shadow AI exposure, safe enforcement case studies, audited security posture, and a government or defense-industrial evaluation.