Pluto Security raises $42 million to monitor workplace AI

The risks show up in routine work

Pluto CEO Bahat told TechCrunch that a new AI tool can enter a company’s infrastructure within two hours of its release. The exposure is not limited to large technology companies leading AI adoption: employees across organizations can create applications and agents without involving developers.

Pluto came out of stealth with more than $2 million in annual recurring revenue and over 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense. It began selling its product in April.

The $42 million consists of an $8.5 million seed round led by TLV Partners, with participation from the founders of cybersecurity company Armis, and a recently raised $34 million Series A led by Jump Capital. Investors in the Series A also included Skinos, the venture firm of Check Point co-founder Shlomo Kramer, Ansa Capital and other angel investors.

For a young company, those customer and revenue figures are notable, though not unique in the current AI funding market. The more important test is whether security teams can use Pluto’s controls without blocking employees from experimenting.

Watching agents, not just users

Bahat said Pluto found malicious components in every proof of concept it conducted, including extension packages and skills. In some cases, attacks were already underway during the evaluation. That makes the findings useful for Pluto’s sales pitch—and a troubling signal for the companies being assessed.

“We’re moving from user behavior to agent behavior,” Bahat said.

Pluto’s software tracks employees’ AI tools and the skills, extensions, MCP servers and other components they use, as well as the applications and agents they create. The company says it can identify risky components and potentially dangerous agent actions, then apply security policies without preventing employees from using AI tools.

To do this, Pluto connects to endpoint protection and device-management systems. It can install its own sensors through those systems or place them directly on devices. The software collects prompts, commands, running processes, permissions and information about users’ previous actions. Lightweight Pluto models running on endpoints then help assess what an agent is trying to do.

The system can intervene during an agent’s operation. If an agent requests more permissions than a user intended to grant, Pluto can stop the action or add instructions to the session telling the agent to seek confirmation. Bahat said Pluto can feed context back into the session to change the agent’s behavior.

A free scanner as a sales channel

Pluto is also using a free product to attract customers. In April, it launched Plutonium, a platform anyone can use to check publicly available AI skills, connections and add-ons. It also includes an MCP scanner and a directory of verified components.

Thousands of security professionals use Plutonium, Bahat said. The community provides feedback and potential customers; 70% of Pluto’s sales pipeline is inbound, though Bahat did not say how much comes directly through Plutonium.

Pluto plans to spend the funding on product development, security research and expanding its presence in the US. It has 40 employees in the US and Israel.

I think the harder question is not whether Pluto can flag risky behavior, but how much context it needs to collect to do so. Its system gathers prompts, commands, permissions and user history, then uses that information to influence agents mid-session. The promise is control without slowing adoption; the tension is that meaningful control may depend on seeing a great deal of what employees do.