Noma Security builds a security and governance platform for AI agents. It helps enterprise security teams let employees and developers adopt agents across SaaS platforms, endpoints and cloud environments without losing track of what those agents can reach or do.
Most agents never appear in a company’s identity provider, yet they act for real users and touch real data. Noma finds them, ties each one to an owner, limits what it may do and watches its actions at runtime, with red teaming to catch weaknesses before release.
At A Glance
| Vendor | Noma Security |
|---|---|
| Category | AI agent security and governance |
| Identities covered | AI agents, MCP servers, skills and tools, linked to human owners and IdP groups |
| Deployment | Gateways, agent hooks, EDR, MDM and direct APIs; on-premises and SaaS options for MCP security |
| Agentic AI | Agentic identity, action-level access control, runtime detection and response |
| Customers | Pfizer, Mercado Libre, Dow, UiPath, Kantar |
| Certifications | SOC 2 Type II, ISO 27001, ISO/IEC 42001, HIPAA, GDPR, CCPA |
| Funding | Series B led by Evolution Equity Partners (2025) |
| Market classification | NHI Platforms & Machine Identity; also Agentic AI Identity |
What Noma Security Does
Noma follows the life of an agent, from discovery and testing before release to access control and detection while it runs, and treats each agent as an identity with a human owner. The stages share data: red team findings can become runtime policies, and posture context feeds the Runtime Context Engine that informs enforcement.
Under its Open Enforcement model, policy is kept separate from the infrastructure that enforces it. The same rules can then be applied through whichever gateway, hook or endpoint tool a customer already runs.
Products
AI-SPM
AI-SPM answers the first question most security teams have: which agents exist, and how risky are they? It finds every agent, MCP server, toolset, skill and model across endpoint, SaaS and cloud. It then looks for toxic combinations of tools, data access, triggers, users and connected agents, and flags misconfigurations such as excessive agency, unsandboxed agents and secrets embedded in agent instructions. Supply chain checks inspect MCP servers, models and skills against a registry of approved components, and findings map to NIST AI RMF, the EU AI Act, ISO 42001, the OWASP LLM Top 10 and MITRE ATLAS.
Agent Access Control
Agent Access Control keeps a live registry of approved agents, MCP servers and skills and sets what each may do. Permissions are scoped to individual operations rather than whole tools. Policies key off IdP groups, users or tool sensitivity, so two agents with different owners can have different access to tools on the same MCP server. When an agent attempts something outside its intended task, the product can block the action, alert, mask sensitive data or send it to a human for approval, and every decision is logged. The product also checks that what an agent actually does stays consistent with its stated purpose, which is how drift and hijacked sessions show up.
AI-DR
AI-DR is for teams that need to stop a misbehaving agent mid-session. It judges each action using session context, identity, data access and intent, and detects prompt injection (including indirect injection through tool responses), data leakage, tool poisoning, scope violations and malicious intent. Responses range from blocking or masking to redirecting the agent, requiring human approval or triggering a killswitch, and prompts, tool calls and responses are kept as a full action trail.
AI Red Teaming
AI Red Teaming lets developers find weaknesses before an agent ships. It runs multi-turn campaigns and attack simulations inside a CI/CD pipeline to uncover edge cases, maps results to compliance presets and passes findings to AI-DR as runtime policies.
MCP Security
For organisations whose agents depend on MCP, Noma shows which MCP servers are installed, which agents use them and which tools they expose. It flags unpinned packages, excessive permissions and exposed secrets, and inspects tool responses for hidden instructions.
How It Works
AI-DR deploys through infrastructure the customer already runs, and Agent Access Control does not require a gateway.
| Component | What it does |
|---|---|
| Discovery connections | Noma connects to cloud platforms, SaaS platforms, code repositories and endpoints, with endpoint discovery running through existing EDR or MDM tools such as CrowdStrike. |
| Enforcement points | AI gateways, MCP gateways, agent hooks, agent SDKs, EDR and MDM integrations and direct APIs. |
| Policies | Hundreds of out-of-the-box policies and protection profiles, with each detector tunable on its own. |
| Deployment options | MCP security is available on premises or as SaaS. |
Identities And Systems Covered
| AI agents | Each agent is treated as an identity in the organisation. |
|---|---|
| Human owners | Every agent is linked to the person it acts for and their IdP group. |
| MCP servers, skills and tools | Discovered, approved, reviewed or blocked, down to individual tools. |
| Secrets | Found in agent instructions and MCP server configurations. |
| Platforms | Google Cloud, Microsoft Azure, AWS, Google Gemini, Hugging Face and Salesforce, among more than 80 supported services. |
| Agent frameworks and assistants | LangChain, CrewAI, Claude, Cursor, GitHub Copilot and Microsoft Copilot. |
Company Background
| Founded | 2023. |
|---|---|
| Leadership | Niv Braun, co-founder and CEO. |
| Funding | A $100 million Series B in July 2025, with Ballistic Ventures and Glilot Capital, following a $32 million Series A; Databricks is also an investor. |
| Recognition | Included in Gartner’s Market Quadrant for AI Application Security, Start-Up Vendors. |
Note: This overview is compiled from Noma Security’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.