Pluto Security raises $42M to address enterprise AI security gaps

The funding consists of an $8.5 million seed round led by TLV Partners, with founders of cybersecurity firm Armis also investing, and a $34 million Series A led by Jump Capital. Skinos, the venture firm of Check Point co-founder Shlomo Kramer, Ansa Capital and other angel investors participated in the Series A.

Pluto began selling in April and has crossed $2 million in annual recurring revenue, CEO and co-founder Shahar Bahat told TechCrunch AI. The company has more than 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense.

Bahat said the pace of AI adoption is central to the problem. A newly announced AI tool can appear inside a company's environment within two hours of its release, she said. About 60% of the risks Pluto detects across its customer base are in tools vibe-coded by non-developers. Finance departments are the biggest source of those risks, followed by marketing and legal teams; developers rank fourth.

One example Pluto's tools found was a vibe-coded app built by a finance employee at a Fortune 500 company to manage customer information and churn. The app was left exposed to the internet.

Pluto is among a new crop of security startups that have quickly emerged to address those gaps. They are raising large sums from investors on the conviction that using existing security software alone to monitor and control AI tools, connectors and usage is a square-peg-round-hole approach, according to the report.

Bahat said the breadth of the risk is not isolated to large tech companies that lead AI adoption. She said the issues vary by the mindset of the chief information security officer and how willing an organization is to adopt AI, but risks appear anyway. "In general, I'll say there was not one POC in which we entered and didn't find malicious stuff," she told TechCrunch AI. "Whether those are extension packages or skills — some of them had active live attacks while we did the POC. Which again, for me, product-wise is amazing. For the companies, it's not very good."

Pluto's software monitors the AI tools employees use, the skills, extensions, MCP servers and other components those tools rely on, as well as the apps and agents being created. The company says it can identify risky components, spot potentially dangerous agent activity and enforce security policies without stopping employees from using or making AI tools.

To do that, Pluto connects to endpoint security and device management systems and can deploy its own sensors through them or directly onto devices. It gathers prompts, commands, running processes, permissions and users' previous activity, and uses its own lightweight models on endpoints to assess what an agent is trying to do.

The system can intervene while an agent is working, Bahat said. If an agent tries to gain permissions beyond what a user intended, for example, the system can stop the action or add instructions into the session that prompt the agent to ask for confirmation. "We can inject context back to the session, and this way I can change how the agent is working," she said.

Pluto also uses a free platform called Plutonium, launched in April, that lets anyone check risks associated with publicly available AI skills, connectors and add-ons. It includes an MCP scanner and a catalog of verified components. Bahat claims thousands of security professionals use Plutonium and that the community around it has become an important source of feedback and prospective customers. She said 70% of Pluto's sales pipeline now comes from inbound interest, without breaking down how much comes directly through Plutonium.

Pluto said it plans to invest the new capital in developing its product and expanding its security research efforts.