Rogue Security

**Product and the concrete problem it solves.** Rogue Security targets the moment when an AI agent stops generating text and starts doing something consequential. Coding agents such as Cursor, Claude Code, Copilot, and custom agents can read repositories, run shell commands, call APIs, access credentials, create pull requests, and in some cases reach production systems. Traditional security controls were built around human users, static applications, or network traffic, while agent behavior changes dynamically with the prompt, the retrieved context, the tools available, and the permissions inherited at runtime. Rogue's product is an agent-security platform designed to discover agents, assess their posture, red-team them before deployment, and enforce policy over their live actions. Its initial wedge is coding-agent runtime security because the failure modes are easy to understand and high impact: an agent can leak a production key, execute an injected command, alter a deployment, or delete data faster than a human reviewer can intervene. Rogue's broader goal is a single control layer for AI that an enterprise uses, embeds, or builds, rather than a collection of narrow scanners that each sees only one agent framework.

**Core technology and how it actually works.** The company's central mechanism is RISC, described as a runtime intent-classification engine that intercepts agent actions before they execute. The official product material and AWS Marketplace listing describe evaluation of shell commands, file operations, tool calls, API calls, and MCP requests, with decisions to allow or block based on policy and detected risk. Rogue says its micro-model approach can operate inline with sub-five-millisecond latency and can run inside a customer's VPC or on premises so agent data does not leave the protected environment. Around that enforcement point, Rogue describes four related capabilities: AI Security Posture Management for discovering shadow agents and classifying risk; AI Detection and Response for behavioral monitoring, containment, and audit trails; AI Application Security for pre-deployment red teaming and CI/CD integration; and access controls for MCP tools, skills, hooks, and approved AI applications. The open-source Rogue evaluator adds a separate testing path for agents over A2A, MCP, or direct Python interfaces, with scenario evaluation, adversarial red teaming, CVSS-style scoring, and mappings to OWASP, MITRE ATLAS, NIST AI RMF, and other frameworks. The architecture is technically concrete, but most performance figures, the 122,000-plus add-on analysis, and the claimed malicious-rate findings are vendor-published rather than independently validated.

**Market, customers, and go-to-market.** Rogue sells into the intersection of application security, security operations, developer platforms, and AI governance. The initial buyer is likely a CISO or AppSec leader whose organization has already deployed coding assistants but cannot answer which agents exist, what permissions they hold, or whether a prompt injection can turn a legitimate tool call into an exploit. The entry motion can be a discovery assessment or pre-deployment red-team exercise, followed by a runtime sidecar, SDK, gateway, browser extension, or IDE hook that enforces policy without requiring a rewrite of the customer's agent. The AWS Marketplace listing provides a procurement and deployment channel, with both an AIDR runtime option and a larger bundle combining runtime enforcement, shadow-AI discovery, and agent red teaming. Rogue also lists support for major model and enterprise platforms including OpenAI, Anthropic, Bedrock, Gemini, Salesforce, and ServiceNow, although integration depth and customer adoption by connector are not publicly disclosed. The commercial logic is to consolidate several point tools around one runtime control plane. A public company post describes a well-known unicorn consolidating three AI-security vendors into Rogue, but the customer is unnamed and the claim should be treated as company-reported. Public sources do not establish ARR, retention, customer count, or contract concentration.

**Traction, funding, and third-party validation.** CTech's September 20, 2026 company profile identifies Rogue Security as a Seed-stage company founded in 2023 with nine employees and describes its selection for ScaleUp House's inaugural cohort as it pursues international growth. LinkedIn lists the company in Tel Aviv, a 2-10 employee range, and 11 visible employees, which is directionally consistent but not an audited headcount. The AWS Marketplace listing is meaningful commercial evidence because it presents a purchasable product, explicit deployment modes, contract options, onboarding, support commitments, and a listed full-platform annual price of $115,997, while also warning that product claims are vendor-provided. The public GitHub repository supplies a tangible developer-facing artifact: an evaluator and red-team platform with CLI, TUI, CI/CD, reproducible scans, 75-plus vulnerability coverage, and support for A2A and MCP. Rogue's official site also publishes research and advertises an open-source small language model called Sentinel V2. These signals show a live product and ecosystem motion, not merely a pitch deck. However, no reliable public source reviewed here discloses venture investors, total funding, valuation, revenue, named enterprise customers, independent red-team results, or third-party confirmation of the claimed latency and attack-detection rates; funding_stage is therefore recorded as Seed with amount Unknown rather than guessed.

**Founders and team background.** CTech names Ariel Dan as CEO, Dror Ivry as CTO, and Gilad Ivry as CPO, and the company is presented as an Israeli startup headquartered in Tel Aviv. Ariel Dan's public profile describes more than two decades of leadership, sales, and marketing experience and identifies previous roles at Cloudify and Porticor; public company material also describes his arrival as a co-founder and CEO of the underlying Qualifire effort before the Rogue Security branding became prominent. The Ivry founders are less fully documented in reliable public sources, which is itself a diligence limitation: the public record reviewed here does not provide complete biographies, previous exits, military-service claims, academic credentials, or the team's engineering breakdown. The available evidence does support a product-oriented founding group that has moved from agent evaluation and red teaming toward inline prevention, a sensible progression as customers shift from finding agent weaknesses to controlling production behavior. Nine employees is a small team for a platform spanning posture management, detection and response, AppSec, access control, integrations, and customer support. The central team question is whether Rogue can maintain a high-quality threat-research corpus and integration surface while supporting low-latency enforcement in sensitive enterprise workflows, or whether the product scope will outrun its engineering and field-operations capacity.

**Competitive dynamics and potential edge.** Rogue competes across several layers. AIR Security, Noma Security, and Zenity approach agent discovery, governance, supply-chain risk, and runtime controls; Protect AI and HiddenLayer bring model and AI-supply-chain security; Pillar Security and Prompt Security cover application testing and AI runtime protection; and large vendors such as Microsoft, Palo Alto Networks, CrowdStrike, AWS, and Google can bundle partial controls into existing developer, cloud, identity, or endpoint platforms. Rogue's proposed edge is enforcement at the tool-call boundary. A posture report or post-incident alert is useful, but it does not prevent an agent from running a dangerous command; an inline engine that can see the intent and block the action may be closer to the operational control point. The combination of pre-deployment red teaming, shadow-agent discovery, runtime action control, and local inference could also reduce the number of separate products a buyer needs. That edge remains unproven. Deterministic policy checks, model inference, or a competitor's sidecar can reproduce parts of the design; sub-five-millisecond latency may constrain analysis depth; and cloud, IDE, and model vendors own distribution. Rogue must show that its decisions are accurate, explainable, and low-friction across heterogeneous agents, and that it prevents real incidents without blocking legitimate developer work.

**Defense, security, and resilience dual-use relevance.** Rogue's core technology has direct cyber and resilience dual-use relevance because defense organizations, government agencies, critical-infrastructure operators, and defense contractors are beginning to use AI assistants and agents with access to code, documents, operational data, and enterprise tools. Runtime inspection of shell commands, file access, API calls, and MCP requests could help prevent prompt injection, tool abuse, credential misuse, data exfiltration, and unauthorized changes in environments where a compromised agent could affect mission systems or sensitive intellectual property. In-VPC, on-premises, and zero-egress deployment options are directionally relevant to high-assurance buyers that cannot send agent context to a public SaaS. The open-source red-team path and mappings to OWASP, MITRE ATLAS, and NIST AI RMF also fit security-assurance workflows. The evidence must be calibrated: no public source establishes a defense contract, classified deployment, government accreditation, air-gapped certification, or operational military use. Rogue is therefore a cybersecurity and AI-infrastructure company with credible government and defense applicability, not a demonstrated defense supplier. Diligence should test offline operation, policy behavior under degraded connectivity, log integrity, secure updates, tenant isolation, administrator separation, human approval controls, and the possibility that inline enforcement itself becomes a high-value attack target.

**Growth stage, trajectory, and key diligence risks.** Rogue is classified as early because it is a 2023-founded Seed company with a nine-person public profile and an emerging international go-to-market motion, even though it has a purchasable AWS Marketplace product and a broad platform ambition. Its trajectory is to move from coding-agent protection into a general runtime control plane for every enterprise agent, using product integrations and a growing library of attack techniques to become the policy enforcement point for agentic software. The strongest upside is strategic: if agents become privileged software identities, the ability to authorize or block their actions at execution time could become as important as endpoint or cloud-runtime controls. Principal risks are (1) detection and classification error, where a false negative causes a damaging action and a false positive stops legitimate development; (2) latency and availability risk from inserting an inline decision point into production workflows; (3) model drift and adversarial adaptation as attackers learn the enforcement boundary; (4) integration burden across fast-changing agent frameworks and MCP implementations; (5) platform risk from Microsoft, AWS, Google, model vendors, and security incumbents bundling similar features; (6) evidence risk because customer, revenue, efficacy, and funding disclosures are thin; and (7) organizational risk because a nine-person team must deliver research, product, integrations, sales, support, and security assurance simultaneously. The next diligence milestones are named customer references, independently reproducible blocking and false-positive benchmarks, retention and expansion data, audited security attestations, successful offline or sovereign deployments, and evidence of protection in defense-industrial or critical-infrastructure environments.