Lumia Security is an AI security and governance company that gives enterprises visibility and control over how employees use generative AI tools and how autonomous agents act on their behalf. Security teams use it to find shadow AI, stop sensitive data leaking into AI services and keep agents within approved limits.
The platform works at the network layer, reading AI traffic from browsers, native apps and the operating system alike, so the same rules follow employees across every tool they try.
At A Glance
| Vendor | Lumia Security |
|---|---|
| Category | AI usage control, agentic AI security and governance |
| Identities covered | Employees using AI tools, AI agents, MCP sessions |
| Deployment | Within existing network infrastructure or as a standalone proxy |
| Agentic AI | Agent action control, MCP governance |
| Customers | BigPanda, LPL Financial, Payoneer, Ropes & Gray, Sumitomo Chemical |
| Funding | Seed round led by Team8 (December 2025) |
| Market classification | AI Governance & Compliance; also Agentic AI Identity |
What Lumia Security Does
AI use inside a company has two sides. Employees paste content into chat tools and coding assistants, and agents increasingly take actions with real permissions. Lumia covers both from one place. Each interaction, by an employee, an agent or an application, is scored for risk and checked against policy before it completes, and sensitive information is stopped before it reaches an AI service. Since enforcement sits on the network rather than inside each app, AI built into business software is governed the same way as standalone tools.
Products
Lumia sells one platform, offered as Lumia for Employees and Lumia for Agentic AI, with seven solution areas.
Shadow AI Detection
Security teams often do not know which AI services staff use. Shadow AI Detection identifies the service, the content exchanged and the topics and intent of each conversation, whether the AI is an agent embedded in a business application or a standalone tool.
Coding Assistant Security And Agent Guardrails
These two areas govern AI that takes actions. Every action, such as sending a message, modifying files, calling an API or running a workflow, is tracked and checked before it runs. High-risk or unauthorised actions are stopped, and the log records what was attempted, executed or prevented, which gives engineering and audit teams a clear trail.
MCP Security & Visibility
MCP connections extend an employee’s own permissions to an LLM, so one integration can reach many systems. This area gives continuous visibility into MCP integrations, governs which servers and tools may be used, decides whether actions such as git commits or database writes are allowed, blocks prompt injection and sets when sensitive values must be redacted.
Data, Compliance And Cost
Leakage and Oversharing Prevention inspects AI traffic, stops sensitive content and educates the user who sent it. Maintaining Compliance supports reporting against regulations and standards, and AI Cost Control analyses and guides spending on AI services.
How It Works
Lumia deploys within existing network infrastructure or as a standalone proxy. Onboarding has three steps: integrate, assess risk and enforce policy.
| Component | What it does |
|---|---|
| Protocol Analysis Engine | Reads browser, native app and operating system traffic to pull out user prompts and responses, agent actions and metadata, across thousands of AI applications. |
| Deep Packet Inspection | Working at network level gives three layers of visibility: the AI service, the content exchanged and the topic and intent. |
| Topic Engine | Lets teams describe sensitive topics in plain language. Detection uses LLM and SLM models and covers voice and images as well as text. |
| Enforcement | Applies block, redact or log actions in real time. |
Identities And Systems Covered
| Employees | AI usage linked to user identity, with privacy stance and retention policy metadata for each service |
|---|---|
| AI agents | Permissions in use and the scopes under which autonomous actions are allowed |
| MCP sessions | User identity, granted permissions, installed tools and plugins, and who is running agents |
| AI services | Browser, native app and operating system AI traffic, including embedded and standalone agents |
Agentic AI Capabilities
Agent Action Control
Each agent action is judged as permitted, restricted or needing human oversight, based on the permissions the agent holds and the scope it is working under. For example, an agent handling password resets may read HR contact and department details but not salary data.
Claude Compliance API Support
Lumia supports for Anthropic’s Claude Compliance API for Claude Enterprise, giving visibility into Claude conversations, file uploads and agent activity, including Claude Code and Cowork. The API reports activity after it happens, so real-time enforcement uses Lumia’s optional inline deployment.
Company Background
| Headquarters | New York, United States |
|---|---|
| Founders | Omri Iluz (Co-Founder and CEO) and Bobi Gilburd (co-founder) |
| Funding | An $18 million seed round announced on 4 December 2025, led by Team8 with support from New Era |
| Recognition | Included in the Gartner Cool Vendors in Securing AI report (2026) |
Note: This overview is compiled from Lumia Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.