Sweet Security protects cloud environments and AI agents at runtime. It is built for security, cloud and SOC teams that need to see attacks as they happen inside workloads, applications and cloud infrastructure, and stop them, rather than work through long lists of posture findings.
The same runtime view is applied to AI, from the model layer through to the actions autonomous agents take.
At A Glance
| Vendor | Sweet Security |
|---|---|
| Category | Runtime CNAPP and AI security |
| Identities covered | Cloud identities, secrets, entitlements, AI agents |
| Deployment | eBPF-based sensor combined with cloud logs |
| Agentic AI | Agent discovery, AIDR guardrails, MCP Gateway enforcement |
| Customers | Fireblocks, ShipStation, Kaltura, Cast & Crew, Tripledot |
| Market classification | Cloud Security |
What Sweet Security Does
Sweet Security starts from runtime data. A lightweight sensor inside each workload is combined with cloud logs, so the platform knows what is actually running, which identity is acting and how an attacker could move from one layer to the next. Detection, investigation and response are built on that shared context, and the same view drives posture, vulnerability and entitlement work. Environments are tested against new threats, fixes are applied, and those fixes become runtime guardrails, with each cycle feeding the next. For AI agents, attack paths are traced from the prompt through to the data the agent touches.
Products
Runtime CNAPP
The Runtime CNAPP brings a wide set of cloud security modules onto one runtime layer, so teams do not have to correlate separate tools by hand:
- Cloud, application and cloud application detection and response (CDR, ADR and CADR).
- Identity Threat Detection and Response (ITDR), which spots unusual activity involving secrets and identities.
- Cloud Infrastructure Entitlement Management (CIEM), which finds and prioritises identity risk across multi-cloud environments.
- Vulnerability Management, CI/CD, API Security, Data Security (DSPM) and DAST.
- CSPM, Governance and Compliance, Cloud Visibility and Cloud Workload Protection.
Windows workloads are supported, and Virtual Patching shields production systems until a permanent fix is deployed.
Detection And Response
Detection and response combines CDR, ADR and CWPP for SOC and incident response teams. An AI-Generated Storyline lays out everything that happened in an incident as an ordered sequence, surfaces the key events and names the responsible identity, pod, role or account. Automated playbooks can then terminate malicious processes, either manually or automatically.
AI Security Platform
The AI Security Platform is for organisations putting models and agents into production. It keeps an AI-BOM and AI security posture, and adds a control plane for agents and MCP.
| Agent discovery | Finds every AI agent running in an environment, including ones nobody registered, traces each agent’s actions and intent across workflows, and checks whether it reaches data directly or through secured APIs. |
|---|---|
| Guardrails and AIDR | Detects and blocks attacks on agents, from prompt injection to hallucinations. Guardrails run inline in under 100ms, and a behavioural baseline lets the platform block a rogue agent as soon as it deviates. |
| MCP enforcement | Policies are enforced per operation for each token or identity passing through the MCP Gateway, so a risky action can be revoked without ending the whole session. |
| Red teaming | Agents are tested under adversarial conditions to expose weaknesses before attackers find them. |
How It Works
| Component | What it does |
|---|---|
| eBPF sensor | A lean sensor based on eBPF profiles applications inside each workload. |
| Cloud logs | Sensor data and cloud logs are merged to build a behavioural baseline for every environment. |
| LLM detection engine | Detection runs on a patent pending engine built on large language models, with a reported reduction of cloud detection noise to 0.04%. |
| AI Gateway and MCP Gateway | AI traffic passes through an AI Gateway, and workload sensors connect to the MCP Gateway, which checks each agent operation in context. |
Identities And Systems Covered
| Cloud identities | Linked to workloads, assets and logs in the incident storyline. |
|---|---|
| Secrets | Watched by ITDR. |
| Entitlements | Governed by CIEM across clouds. |
| AI agents | Including shadow or unmanaged agents. |
| Clouds | AWS, Azure and Google Cloud, across public, private and hybrid deployments. |
| AI services | AWS Bedrock, Azure AI Foundry, ChatGPT Enterprise, Copilot Studio, Google Vertex AI, Microsoft 365 Copilot, Power Platform, Salesforce Agentforce and ServiceNow. |
Integrations
| Area | Integrations |
|---|---|
| CI/CD and code | GitHub, GitLab, Jit |
| Privileged access | CyberArk Privileged Access Manager, CyberArk Conjur, CyberArk Workforce Password Management |
| SIEM | Splunk, Microsoft Sentinel, Chronicle, Sumo Logic, Panther Labs, AWS Security Hub |
| Security workflows | Torq, Siemplify, Intezer |
| Ticketing and notification | Jira, Slack, Microsoft Teams, Opsgenie |
| Open-source risk | Illustria |
Company Background
| Founded | 2022. |
|---|---|
| Headquarters | Tel Aviv, Israel. |
| Founders and leadership | Dror Kashti (co-founder and CEO), Eyal Fisher (co-founder and CBO), Orel Ben Ishay (co-founder and CPEO), Tomer Filiba (CTO) and Yana Melnick (CFO). |
| Funding | A $75M Series B in November 2025, with Evolution Partners, Munich RE, Glilot Capital, CyberArk Ventures and Key1 among its backers. |
Note: This overview is compiled from Sweet Security’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.