Clutch Security secures the identities that are not people: API keys, service accounts, tokens, secrets and, increasingly, AI agents. It finds them across cloud, SaaS and code, ties each one to the people and systems behind it, and helps security teams govern, monitor and replace them with safer short-lived credentials.
The platform is for security and identity teams that have lost track of how many machine credentials their organisation has created and who is responsible for them. Its scope runs from cloud to code to AI.
At A Glance
| Vendor | Clutch Security |
|---|---|
| Category | NHI Platforms and Machine Identity, Secrets Management |
| Identities covered | Non-human identities, AI agents, secrets and human identities |
| Deployment | Agentless SaaS, connected through APIs |
| Agentic AI | Agent discovery, Agent Guardrails, agent threat detection, Shadow AI Discovery |
| Customers | NTT Data, Fluidra, OpenWeb, Dexcom, Bank United |
| Funding | Venture backed by Lightspeed Venture Partners and SignalFire |
| Market classification | NHI Platforms & Machine Identity; also Secrets Management |
What Clutch Security Does
Every integration, pipeline and automation creates a credential, and most of them outlive the project or the person that created them. Clutch gives teams a single view of that non-human attack surface and the means to “discover, govern, and secure” it. The work runs in five stages, Discover, Govern, Secure, Detect and Protect, ending with static credentials replaced by short-lived ones. The same approach covers human identities, secrets and AI agents, so all of them can be managed in one place.
Products
Clutch Platform For Non-Human Identities
The core of the platform answers four questions about every machine identity: what is it, who owns it, how risky is it and is it being misused.
| Discovery & Inventory | Maps each non-human identity to the people and systems behind it. |
|---|---|
| Lifecycle Management | Tracks ownership, expiry and access reviews. |
| Posture & Risk Management | Ranks identity risks by access scope and blast radius. |
| Threat Detection & Response | Spots anomalous identity behaviour and supports a response with full context. |
Clutch Platform For Secrets
Secrets end up in code, pipelines and chat as well as in vaults. This part of the platform manages secret lifecycle, ownership and hygiene across environments, scans for leaked secrets and adds blast radius and remediation context to each finding. Vault Augmentation shows what is missing from a vault and what has been copied out of it, which helps teams that already run a vault close the gaps around it.
Open-Source Tools
Clutch publishes AWS Key Lockdown, Federator and a VS Code extension. Federator, released on GitHub under the GPL-3.0 licence, provides Terraform templates for federating CI/CD pipelines to cloud accounts and for cloud-to-cloud IAM federation between AWS, Azure and GCP, including GitHub Actions to cloud. It is a practical starting point for replacing long-lived keys with short-lived federated access.
How It Works
The platform is agentless and API-based, with more than 100 integrations. It connects to cloud providers, SaaS applications, code repositories, CI/CD pipelines and vaults, and builds its inventory from those connections.
| Component | What it does |
|---|---|
| Identity Lineage | A graph that links each entity to its origin, owners, storage location, consumers and the resources it can reach, so every finding comes with an owner and a blast radius. |
| Zero-knowledge architecture | Sensitive data never leaves the customer’s environment. |
| Remediation path | Findings feed the Protect stage, where static credentials are migrated to short-lived alternatives such as federated access. |
Identities And Systems Covered
| Non-human identities | API keys, service accounts, tokens and other machine credentials. |
|---|---|
| Secrets | Secrets stored across environments and in vaults. |
| AI agents | Managed and unmanaged agents and the access they hold. |
| Human identities | Covered alongside machine identities. |
| Cloud and platforms | AWS, Azure, Google Cloud, Kubernetes and AKS. |
| Identity providers | Okta, Auth0 and Microsoft. |
| SaaS and data | Salesforce, Snowflake, Databricks, Amazon Redshift, Jira and Confluence. |
Agentic AI Capabilities
Agent Discovery And Posture
Clutch finds every AI agent, including unmanaged shadow AI, and maps what each one can access. Each agent is traced from the person who deployed it through its tools and credentials to the resources it can reach, and its risk is assessed on that basis. Coverage extends to Claude, OpenAI and Anthropic models, LangChain, CrewAI, Cursor, GitHub Copilot and MCP.
Agent Guardrails And Detection
Agent Guardrails set boundaries on the permissions, tools and credentials an agent may use. Threat detection for agents looks for credential theft, manipulation and data exfiltration carried out by agents.
Integrations
| Area | Integrations |
|---|---|
| Code and CI/CD | GitHub, GitLab, Bitbucket, CircleCI, Jenkins, Azure DevOps, Terraform |
| Vaults and password managers | HashiCorp, CyberArk, Delinea, AWS Secrets Manager, 1Password, LastPass |
| Operations and security | Splunk, Datadog, Slack, PagerDuty, CrowdStrike, Anomali, Akamai |
Company Background
| Founded | October 2023. |
|---|---|
| Headquarters | Tel Aviv, Israel. |
| Founders | Ofir Har-Chen (co-founder and CEO), Sagi Haas and Tal Kimhi. |
| Funding | An $8.5 million seed round led by Lightspeed Venture Partners with Merlin Ventures when the company came out of stealth in July 2024, then a $20 million round led by SignalFire in January 2025. |
| Angel investors | Nir Polak, Shlomo Kramer and Armon Dadgar. |
| Recognition | Fortune Cyber 60, Globee Awards, Cyber Defense Magazine, Cyber Security Excellence Awards, CYBER 150 and CRN Stellar Startups. |
Note: This overview is compiled from Clutch Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.