The financing event
Obsidian Security said on August 4 that it raised $85 million in a Series D led by Crescent Cove Advisors, with Greylock Partners and Menlo Ventures participating. Reuters reported a $1.1 billion valuation and said the company expects the capital to last until positive cash flow.
The more important signal is the category the money is chasing. Obsidian is positioning itself around agents that can reach customer records, source code, SaaS applications, and enterprise data—not around protecting one chatbot window.
The object being secured is an automated identity that combines instructions, data access, tools, credentials, and actions across systems.
Why existing categories do not fully cover agents
| Layer | What it sees | What may remain invisible |
|---|---|---|
| Identity and access | Accounts, roles, sign-in, entitlements | Agent logic, tool selection, chained actions |
| SaaS security | Configuration and data exposure | Cross-platform execution and ephemeral agents |
| Model evaluation | Capability and behavior under tests | Real credentials, data paths, production connectors |
| SIEM/logging | Events emitted by systems | Agent owner, prompt, intent, and effective authority |
| Agent-security layer | Discovery, authority, tool calls, runtime behavior | Coverage still depends on integrations and telemetry |
Seven capabilities define the category
Inventory sanctioned, user-created, third-party, orphaned, and shadow agents.
Tie agents to humans, service identities, credentials, and tools.
Understand access to customer data, source code, files, and records.
Capture tool calls, MCP interactions, cross-app actions, and anomalies.
Detect agents outside normal review or left active after owners change.
Disable agents, block actions, rotate credentials, and preserve evidence.
Use one risk model where agents span vendors and connectors.
How to read Obsidian’s product claims
Obsidian says its platform can discover agents across systems including Copilot Studio, Agentforce, and Claude; map owners, models, tools, MCP servers, and permissions; monitor tool calls; and enforce policy before high-risk actions complete. These are vendor claims, not proof of universal coverage.
Buyers should ask which builders, hosts, connectors, and SaaS applications are supported; how discovery works; what happens when telemetry is missing; how quickly policy can intervene; and how prompts, arguments, and sensitive content are retained.
The demand signal
Reuters reported that Obsidian’s chief executive said nearly 70% of its customers already allow agents to interact with business data. That figure describes the company’s customer base, not the entire economy. It still shows the vendor’s core problem: agents are moving into systems with real authority.
As model costs fall, organizations can create more narrow agents. The number of identities, connectors, credentials, and policy decisions then grows faster than manual review. Governance becomes a separate budget line after security teams discover native controls are fragmented.
Discovery is necessary but insufficient
- Purpose: every agent needs an owner, workflow, allowed data, tools, and review date.
- Effective authority: permissions should be reduced based on observed need.
- Runtime: configuration cannot reveal every prompt injection or action chain.
- Revocation: stopping must cover the model platform, credentials, connectors, and downstream jobs.
- Evidence: incident review needs identity, instructions, tool calls, access, decisions, and outcome.
A kill switch is a system property
Block new runs and interrupt active high-risk actions.
Disable tokens, connectors, service identities, and secrets.
Freeze queued changes, messages, deployments, or payments.
Retain logs, prompts, tool calls, identities, and decisions.
Reduce permissions, retest, and require approval before reactivation.
What buyers should prove
| Question | Evidence |
|---|---|
| Can it find shadow agents? | A controlled agent created outside provisioning |
| Can it map effective authority? | Owner, identity, credentials, tools, entitlements, and data scope |
| Can it see cross-platform actions? | Trace from instruction to tool call to downstream change |
| Can it block before completion? | Measured intervention latency and failure mode |
| Can it support an incident? | Exportable evidence with time, identity, action, and outcome |
The category is real but unsettled
The round does not prove that Obsidian will lead the category or that agent security will remain standalone. Identity, cloud, SaaS-security, observability, and model vendors will move into the same territory. The durable requirement is clearer: enterprises need continuous knowledge of which agents exist, whose authority they inherit, what they reach, what they do, and how to stop them.
Frequently asked questions
Controls used to discover agents, map owners and permissions, monitor tools and data, enforce policy, revoke authority, and investigate actions.
They may not understand agent logic, prompts, tool chains, downstream authority, or cross-platform runtime behavior.
An agent created or deployed outside normal IT and security review, including user-built, third-party, orphaned, or forgotten automations.
No. It shows demand. Buyers still need evidence of integration coverage, detection accuracy, intervention, and data handling.
Sources and references
- Obsidian Security raises funding at $1.1 billion valuation on AI security demandReuters · secondary
- AI Agent SecurityObsidian Security · primary
- AI Agent MonitoringObsidian Security · primary
- AI Agent Runtime SecurityObsidian Security · primary
- AI Risk Management FrameworkNIST · reference