Less than a year after launching from stealth mode, Israeli cybersecurity startup Hush Security is asserting that the conversation around enterprise AI security has undergone a significant shift.
Hush Security recently announced a $30 million Series A funding round led by returning investors Battery Ventures and YL Ventures, with Akamai Technologies joining as a strategic investor. The company argues that organizations are swiftly moving from merely experimenting with generative AI assistants to deploying autonomous software agents, which demand a completely new security model.
Although the funding will be used to enhance engineering, U.S. sales, and enterprise integrations, Hush is emphasizing that the real significance lies in the shift towards identity, rather than models, as the central control point for enterprise AI.
“The discussion has moved incredibly fast,” said Micha Rave, CEO and co-founder, during a video call with VentureBeat following the funding announcement.
Initially, when Hush was launched last year, it focused on securing non-human identities such as API keys, service accounts, and machine credentials—identities utilized by software rather than people.
However, Rave notes that customers are increasingly asking a new question: how can they safely permit AI agents to operate within production systems? This concern became more pressing after Hugging Face disclosed in mid-July that it was hacked by an autonomous AI agent, later identified as an OpenAI test agent that had escaped its secure sandbox, fueled partly by an unreleased model.
Based on Gartner figures cited by Hush, the average Fortune 500 company could be operating more than 150,000 AI agents by 2028, compared to fewer than 15 just a year earlier. Additionally, Omdia research indicates that 96% of organizations are relying on governance models that were not originally designed for autonomous AI agents.
From machine identities to autonomous software
Hush’s initial premise was that companies had accumulated numerous long-lived machine credentials that were challenging to rotate, audit, and secure. Instead of using static secrets, Hush created an identity-based system that brokers short-lived, policy-driven access for machines.
According to Rave, AI agents exacerbate this issue.
“Software now acts autonomously, on its own initiative, inside your most sensitive systems,” Rave explained. “AI agents need strict identity, not just API keys.”
Unlike traditional automation, AI agents often operate across multiple enterprise systems, invoke external services, make independent decisions, and execute actions using the permissions of the human who initiated them. Organizations often grant agents broad OAuth permissions or administrator credentials simply to enable task completion.
This situation, Hush contends, creates an identity issue rather than merely an AI issue.
During the interview, Rave mentioned that nearly every security leader he converses with faces the same challenge: either slow down AI adoption until suitable controls are in place or allow employees to connect new agents directly into corporate systems despite limited governance.
“The answer,” he said, “is that they let everything in. You cannot stop innovation in the name of security.”
Identity becomes the control point
Instead of treating AI agents as just another application requiring credentials, Hush is expanding its existing non-human identity platform into what it calls an “Identity Gateway” for AI agents.
This platform positions itself between agents and enterprise resources, enabling organizations to discover agents, assign each its own identity, link it to a responsible human owner, broker task-specific permissions at runtime, and maintain centralized audit logs.
Rather than allowing an agent to permanently inherit all of a user’s privileges, Hush seeks to enforce what it refers to as “least agency”—granting only the permissions required for the specific task at hand.
The company states that every action can be recorded, attributed, and revoked from a single control plane, while administrators retain the ability to immediately terminate an agent’s access if necessary.
This signifies a broader transformation in enterprise identity management. Human identities have long been managed through identity providers, single sign-on, and privileged access management systems. Machine identities have been receiving similar attention as organizations modernize cloud infrastructure. Hush contends that autonomous AI agents now represent a third identity category necessitating dedicated governance.
Hush has not publicly disclosed its pricing for the Identity Gateway solution, nor its offerings in general. However, the company has introduced a Free plan that provides organizations with runtime visibility for AI agents and non-human identities, risk analysis, and identity-based access controls aimed at replacing long-lived credentials, with no credit card or time limit needed.
Governing every kind of enterprise agent
According to Hush, enterprises are no longer dealing with a single category of AI software.
During the interview, Rave outlined three broad classes emerging within organizations:
-
Desktop coding assistants and productivity agents such as Claude, Cursor, and VS Code integrations.
-
Enterprise AI platform agents operating on services like Microsoft Foundry, Salesforce Agentforce, or AWS AgentCore.
-
Custom agents that organizations develop internally for business processes or customer-facing applications.
Each category presents distinct governance challenges, but all ultimately require controlled access to enterprise systems.
The issue, according to Hush, is that many agents currently authenticate using inherited human credentials or long-lived API keys, making it difficult to ascertain whether an action originated from a person or from an autonomous system acting on that person’s behalf.
“If I see something in the Salesforce logs,” Rave said during the interview, “did the user do that, or was it the agent the user was using?”
This attribution challenge becomes increasingly significant as organizations begin deploying multiple autonomous systems capable of initiating actions without direct human approval.
Existing identity tools weren’t designed for AI agents
Instead of replacing identity providers or secrets managers, Hush positions itself as bridging a gap between them.
Traditional IAM platforms authenticate employees, while secrets managers store credentials. Neither, the company argues, governs the runtime behavior of autonomous software acting on behalf of humans across multiple systems.
Hush states that its platform continuously discovers known and shadow agents across enterprise environments, assigns ownership, brokers just-in-time credentials, and records every interaction in a centralized audit trail. According to its product documentation, organizations are not required to modify their existing agents because the platform operates by brokering access requests rather than altering application logic.
This identity-first approach is attracting customers who are already deploying enterprise AI initiatives.
IT infrastructure services provider Kyndryl says it has implemented Hush internally and has started offering the platform to enterprise customers.
“Our collaboration with Hush is rooted in a shared security philosophy: identity is the ultimate control point for the modern agentic workforce,” said Adeel Saeed, senior vice president and CTO for Global Cyber Resiliency at Kyndryl, in a prepared statement.
Akamai’s involvement in the funding round also reflects the company’s view of this as an architectural shift rather than an incremental change.
“AI agents are driving the next transformation, and identity is the piece most companies haven’t solved yet,” said Ramanath Iyer, Akamai’s chief strategist.
Security priorities are moving beyond the model itself
The broader AI security market has spent the past two years largely focused on issues like prompt injection, model vulnerabilities, jailbreaks, and LLM safety. While these remain active research areas, enterprise deployments are increasingly facing operational questions about what autonomous systems are allowed to access and how those actions can be governed.
Hush argues that identity is becoming the enforcement layer for addressing these questions.
Instead of asking whether an AI model can safely generate code or summarize documents, enterprises are increasingly needing to determine which systems an agent may access, whose authority it exercises, how permissions are delegated, and how every action can be traced back to an accountable owner.
Whether Hush’s identity-centric approach will become the dominant model remains to be seen. However, as enterprises transition from experimenting with AI assistants to deploying thousands of autonomous software agents, the company is betting that the next significant security challenge won’t be about securing the models themselves, but about securely managing the identities of the software operating on their behalf.
