Vorlon is a security company that protects the connections between enterprise apps, identities, data and AI agents. It is built for security teams that need to see and control what AI agents, integrations and service accounts do across SaaS, cloud and homegrown systems, and to stop a risky action before the transaction completes.
The Vorlon Platform gives those teams one map of how apps, integrations and data connect, and one place to act on what it shows.
At A Glance
| Vendor | Vorlon |
|---|---|
| Category | AI agent runtime security, SaaS and non-human identity security |
| Identities covered | Service accounts, OAuth tokens, API keys, AI agent credentials, secrets, bots, human users |
| Deployment | Agentless, read-only API connections, no proxies |
| Agentic AI | Guardian runtime enforcement, MCP tool call monitoring, AI Agent Flight Recorder |
| Customers | ThoughtSpot, Splitit, Dutchie, CarGurus, NAF |
| Founded | 2022 |
| Market classification | NHI Platforms & Machine Identity |
What Vorlon Does
Most SaaS risk now sits in the links between systems: OAuth grants, API tokens, integrations and, increasingly, AI agents acting on a user’s behalf. Non-human identities far outnumber people, with a reported ratio of 50 to 1, and many of these connections are created without IT approval. Vorlon’s approach is to observe those links, enforce policy on them at runtime and keep a record of agent activity, all from a single discovery layer, so a token can be traced from the app that issued it to the data it reaches.
Products
AI Agent Runtime Security
AI Agent Runtime Security is built around Guardian, an enforcement gateway that sits between AI agents and the enterprise systems they call. It inspects each MCP tool call as it happens and can block a policy violation, mask sensitive fields in transit or hold an agent to read-only access. Read-only mode limits writes at the protocol level, so teams can rein in an agent without revoking its credentials. Guardian also learns how each credential normally behaves and flags deviations.
Total Identity Security
Total Identity Security is for teams that cannot say which OAuth grants, tokens and service accounts exist across their SaaS estate. It discovers every grant and token, including those created without IT approval, and scores each identity on its observed behaviour and the sensitive data it can reach. Risky access can be revoked or restricted quickly, with the action routed to the identity provider or app owner. It works alongside secret managers such as HashiCorp Vault and AWS Secrets Manager rather than replacing them.
Data-Centric SaaS Security
Data-Centric SaaS Security shows where sensitive data actually moves between SaaS apps, AI tools, integrations and shadow apps. Built-in classifications cover PII, PHI, PCI and other regulated fields, and live traffic is watched for token theft, AI misuse and data exfiltration.
Compliance Automation
Compliance Automation turns the same discovery into audit evidence, producing reports in support of SOC 2, ISO 27001, GDPR and other frameworks.
App Directory And SOC Tools
For the security operations team, the platform adds an App Directory of connected services alongside exposure management, threat hunting, forensics and incident response. Behaviour baselines also apply to agents, so an agent that reaches data outside its intended scope is flagged.
How It Works
Vorlon connects through read-only APIs, with no agents and no proxies, and observes more than 1,000 apps and services. Any app or data store with an API or MCP server becomes a governed endpoint, and connecting one needs no SDK instrumentation or changes in production.
| Component | What it does |
|---|---|
| DataMatrix | Builds the map of apps, integrations, identities and data flows across the ecosystem. |
| Guardian | Sits inline at the API and MCP layers, so a decision is made before the call completes. |
| AI Agent Flight Recorder | Logs each MCP communication with the agent, tool, timestamp and the class of sensitive data involved, which is classified at the MCP layer. |
| Action Center | Carries out remediation such as revoking tokens, disabling integrations and quarantining identities. |
Identities And Systems Covered
| Non-human identities | Service accounts, OAuth tokens, API keys, AI agent credentials, secrets and bots |
|---|---|
| AI agents | Sanctioned and shadow agents, agent-to-SaaS and machine-to-machine traffic, MCP connections |
| Human users | People mapped to the sensitive data they can reach |
| Systems | SaaS apps, integrations, AI tools, cloud data stores and homegrown systems |
| Identity providers | Okta, Microsoft Entra ID, PingIdentity and Duo |
Integrations
| Area | Integrations |
|---|---|
| SIEM | Google SecOps, Splunk, Sumo Logic, Observe, Devo |
| SOAR | Tines, Torq, XSOAR |
| ITSM | ServiceNow, Jira |
| Productivity | Slack, Teams, Notion, Google Workspace |
| Security and intelligence | Netskope, CrowdStrike, Cyberint, VirusTotal, Ipregistry |
Company Background
| Founded | 2022, by Amir Khayat and Amichay Spivak |
|---|---|
| Leadership | Amir Khayat, co-founder and CEO; Amichay Spivak, co-founder and CTO |
| Funding | A reported $15.7 million Series A led by Accel in April 2024 |
| Recognition | Included in the CRN 2025 Stellar Startups list for Security |
Note: This overview is compiled from Vorlon’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.