Enterprises are moving from testing a few AI agents to deploying hundreds that browse the web, write code, access files, trigger APIs and interact with internal systems. The shift has opened a market for agent security built around narrow control points, with Kiteworks acquiring Bonfy. AI for real-time data classification and Huskeys raising a $27 million Series A led by Blackstone for traffic analysis. The reason it matters is that companies must now control software actors that act on their behalf, not only users, devices and applications.
Control points behind the agent security map
An agent with access to corporate files, databases, email and code execution needs permissions, monitoring and governance similar to an employee, but with wider reach. Companies will need records of which agent accessed what information, which systems it connected to and whether each action was authorized. The source frames this as a new identity layer for the enterprise: agents query databases, send emails and execute code across systems. As deployments grow from experiments to hundreds of agents, tracking those actions becomes a core cybersecurity task rather than an extension of existing user management.
The difficulty comes from agents being active identities. Unlike a user account or service account with fixed rights, an agent moves between systems, invokes tools and makes decisions during a task. That behavior breaks the assumption that access can be checked once at login and then trusted. The emerging answer is specialization by control point: one product governs agent identity, another limits data the agent can see, while others inspect prompts, MCP servers, plug-ins, network traffic or audit trails. Each layer answers a different question about what the agent is allowed to do and how its path can be reconstructed.
Two recent deals illustrate how those layers are separating into distinct businesses. Kiteworks acquired Israeli startup Bonfy. AI, focused on real-time data classification and policy enforcement, which points to control at the data-access point. Huskeys, another Israeli cybersecurity startup, raised a $27 million Series A led by Blackstone to understand and secure complex internet traffic, including traffic generated by autonomous systems, which points to control at the traffic point. Strategic adviser Itay Sagie argues that identity providers, data-security vendors, cybersecurity platforms, cloud companies and enterprise software vendors will need to embed such capabilities directly into their products.
What agent security changes for companies
For companies adopting agents, procurement will likely split across several vendors instead of a single suite labeled "AI security". Identity teams may extend governance to autonomous agents, while data owners set classification and access rules that follow files and database records into agent workflows. Cloud and enterprise software suppliers may bundle basic agent controls, leaving specialized products for prompts, plug-ins, MCP servers and auditability. Small firms will feel this as more checks during vendor selection, while large firms running hundreds of agents will need consistent logs across identity, data and traffic tools to prove authorization.
The map does not mean every control point is mature or mandatory today. A product labeled "AI security" may cover only one layer, such as traffic inspection or data classification, without governing identity or reconstructing agent actions. Buyers should ask what exactly a vendor controls, which systems and tool calls are logged, how policies are enforced in real time and where gaps remain with service accounts and existing access management. The source cautions entrepreneurs against broad positioning, and the same test applies to buyers: a broad claim without a defined control point deserves verification in a pilot with real file, database and API access.
A practical marker to watch is whether identity providers and data-security vendors add agent governance and agent-aware access rules to standard product releases. If embedded controls and further acquisitions around identity, data and traffic follow the Kiteworks and Huskeys examples, the layered map will be confirmed as the buying model for agent deployments in business operations.
