Pluto Security Raises $42M—Vibe-Coded Apps Drive 60% of Its Findings

In its October 13, 2026 launch post, Pluto Security said it was emerging from stealth with $42 million in total funding. The company also claimed coverage of more than 1.5 million enterprise endpoints worldwide and multimillion-dollar annual recurring revenue. Its product is intended to give security teams visibility into the AI tools employees use and the applications and agents they build.

TechCrunch’s funding report and interview breaks the total into an $8.5 million seed led by TLV Partners and a $34 million Series A led by Jump Capital; CEO Shahar Bahat said about 60% of risks detected across Pluto’s customers occur in AI-built tools created by non-developers, put annual recurring revenue above $2 million and enterprise customers above 30, and summed up the change as “We’re moving from user behavior to agent behavior.” The risk share describes findings within Pluto’s customer base, not a measured rate across all enterprises.

Two rounds, one funding total

The $42 million combines the earlier seed with the newer Series A. That distinction matters because the larger round is the fresh financing tied to Pluto’s public launch, while the smaller one funded its earlier development. Jump Capital and TLV Partners led different rounds, bringing investors into the company at different stages.

In CTech’s October 13 account, the Israel-based company identified Skinos Ventures and AlphaDrive Ventures as participants in the latest round, Ansa Capital as a seed investor, and Shahar Bahat, Tal Ofer Regev and Gil Maman as its founders; it also claimed more than 40 paying enterprise customers. The customer thresholds given to the two publications can both be true: a count above 40 is also above 30. Neither figure is an independently audited customer count.

The founders bring experience from cybersecurity and technology companies, but the commercial question is more specific than their résumés: whether security teams will pay for controls that follow software assembled by employees outside a conventional engineering release process. Pluto plans to use the capital for product development, security research and expansion in the United States. Those are intended uses of the funding, rather than outcomes already delivered by it.

Why non-developers figure so prominently

The reported risk share concerns tools built with AI by people who are not developers. Finance was the largest source of such findings in the customer environments described in the interview, followed by marketing and legal; developers ranked fourth. That order gives the company’s pitch its focus: security review has to reach applications created in departments that may never submit code through an engineering team.

One example was a finance employee’s application for managing customer information and churn that was exposed to the public internet. The case illustrates how an internal business task can become an external data exposure when a newly built application is put into use. It does not establish how often that failure occurs elsewhere, and Pluto has not published the underlying dataset or a methodology for reproducing its reported percentage.

The concern also extends beyond an application’s own code. An employee can assemble an AI workflow from skills, browser extensions, connectors or Model Context Protocol servers, then grant it access to company systems and data. Each component can change what the resulting agent can do. The relevant security question is therefore about the behavior and permissions of the assembled workflow, as well as the identity of the employee who started it.

What the platform can observe and interrupt

SiliconANGLE’s product account describes software that maps agents across employee endpoints, cloud infrastructure and software-as-a-service applications, identifying their models, tools and customizations. The described endpoint approach also uses existing security and device-management systems or sensors deployed on devices. Its telemetry can include prompts, commands, running processes, permissions and a user’s previous activity. Together, those signals are meant to give a security team context for judging what an agent is trying to accomplish.

The intervention is aimed at an action while an agent is working. If it seeks permissions beyond the employee’s intended task, the system can stop that action or insert instructions asking the agent to seek confirmation. A policy can also restrict a risky skill or an application’s access to sensitive data while allowing other permitted work to continue. These are described product capabilities; the public accounts do not provide an independent performance test across different agents and customer systems.

That distinction between seeing activity and changing it is central to Pluto’s commercial case. An inventory may reveal that an employee has installed a connector, but it cannot by itself determine whether a particular request should reach customer records or credentials. Acting at the endpoint gives a control a chance to respond at the moment an agent attempts the request, when the tool, user permissions and intended task can be considered together.

What the traction figures establish

The endpoint and revenue totals are company-reported measures of reach and sales, with different meanings. An endpoint count describes devices the company considers covered; it does not show how many agent actions were blocked or how much risk was removed. Annual recurring revenue is a run-rate measure, not a disclosure of audited revenue for a completed financial year. The named customers include Oscar Health, Workato, Sixt and AlphaSense.

The launch and customer reports put Pluto beyond a product concept, but they leave buyers with a consequential question: how consistently can its controls distinguish a risky agent action from an authorized one across the mix of tools employees actually use? As the newly funded company expands its deployments, evidence about coverage, interventions and disruption to legitimate work will matter more than the size of its endpoint footprint alone.

Also read:

• Hadrian Raises $40M—Offensive AI Becomes a Funding Category
• Namespace Raises $42M—Revenue Grew Eightfold in 12 Months
• Nettle Raises $4.8M—Its Fivefold Speed Claim Is Still Vendor-Reported