Pluto Security secures the AI tools, agents and apps that employees build and use at work. Its platform finds the coding assistants, agent builders, low-code automations, MCP servers, skills and plugins running on company endpoints, assesses their risk, and enforces policy while agents work, so security teams can let staff adopt AI without losing control.
The problem is that employees now build and run their own agents and automations faster than security teams can review them, and each one brings its own access, add-ons and supply chain. Blocking the tools outright pushes the work out of sight.
At A Glance
| Vendor | Pluto Security |
|---|---|
| Category | Security for AI tools, agents and employee-built apps |
| Identities covered | AI agents, AI tools, MCP servers, skills and plugins on endpoints |
| Deployment | Lightweight local models on endpoints, deployed through endpoint security and device management |
| Agentic AI | Discovery, risk triage and runtime policy for agents and MCP servers |
| Customers | SIXT, AlphaSense, Oscar, Agoda, Workato |
| Certifications | SOC 2 Type 2, ISO 27001 |
| Market classification | Agentic AI Identity; also Cloud Security |
What Pluto Security Does
Pluto Security starts from the view that security has to follow AI into everyday work rather than block it. It looks at employees’ AI tools and their components, such as skills, extensions and MCP servers, along with the apps and agents being built. Coverage spans tool access and configuration, the commands agents execute, prompt risks, third-party supply chains and the artifacts that AI generates. The emphasis is on what agents do while they run, not only on which tools are installed, and on applying policy at that moment instead of reporting afterwards. Employee-built apps can also be required to use authentication or to be hosted internally.
Products
Explorer And Risk Radar
Explorer is the starting point for a security team that does not know which AI tools and agents are in use. It discovers them across the organisation and adds context about each one. Risk Radar then triages what Explorer finds against Pluto Security’s research risk database, so teams can focus on the tools and add-ons that carry real risk.
Space Shield
Space Shield is the enforcement layer. Its intent-based policies apply while an agent is working, so an action can be stopped or held for confirmation mid-task. They can:
- block unauthorised agent actions
- require approval for sensitive API access
- quarantine untrusted MCP servers
- block risky skills
Marketspace
Marketspace gives employees a curated catalog of AI add-ons that have been vetted as safe to adopt, steering them towards approved options instead of leaving them to install whatever they find.
Plutonium
Plutonium is a community tool built on the RisksDB database. It catalogs remote and local MCP servers, official and community skills and plugins, reviewing listings and publishers, mapping compatibility and scanning source code. Each item is flagged for behaviours such as data modification, third-party data sharing, persistent access tokens, command execution and data deletion. It also offers an MCP Inspector, safe-use guides and a Plutonium Skill for agents.
How It Works
Lightweight models run locally on each endpoint to collect preventative telemetry without significant CPU or latency overhead, on laptops and in sandboxes. The platform connects to endpoint security and device management systems and deploys its sensors through them or directly onto devices. Discovery, risk scoring and policy enforcement then run from that telemetry, so the same sensor feeds Explorer, Risk Radar and Space Shield. For the Plutonium catalog, an agentic risk engine examines the capabilities, risk and reach of each listed item.
Identities And Systems Covered
| AI agents | Agents that employees use and build, including those made in agent builders and automation platforms |
|---|---|
| AI coding tools | Cursor, Claude Code, GitHub Copilot, Windsurf, Kiro, Replit and Lovable |
| AI models and platforms | OpenAI, Gemini, AWS Bedrock and AgentCore, and Microsoft Foundry |
| Automation and low-code | N8n, Make, Retool and Workato |
| Enterprise data and search | Glean and Snowflake |
| MCP servers, skills and plugins | Remote and local MCP servers and third-party AI add-ons |
| Endpoints | Laptops and sandboxes, with a reported 1.5 million endpoints secured |
Company Background
| Founded | 2025. |
|---|---|
| Headquarters | Tel Aviv, Israel, with staff across Israel and the United States. |
| Leadership | Shahar Bahat, co-founder and CEO; co-founder Tal Ofer Regev. |
| Funding | $42 million in total, announced when the company came out of stealth in October 2026; the seed round was led by TLV Partners and the latest round by Jump Capital, with Skinos and Ansa Capital also taking part. |
Note: This overview is compiled from Pluto Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.