All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Autonomous Security sells AI agent security to enterprise security teams. Its software identifies agents such as Claude and Cursor on employee computers and blocks their unauthorized commands. Founded in 2021 as Piiano, a data-privacy company, it moved into AI agent security in 2025 as MCPTotal. Co-founders Gil Dabah and Ariel Shiftan sold their earlier security firm, NorthBit, to Magic Leap. The IVC company database lists 20 employees. YL Ventures led its $9 million seed round, and George Kurtz, CrowdStrike’s chief executive, is an investor. Its homepage quotes a customer who reports visibility into unapproved AI tools on 4,000 endpoints. It competes for the same budget with CrowdStrike, Microsoft and Palo Alto Networks, which sell endpoint controls for AI agents.
| Description | Autonomous Security is an endpoint security platform for AI agents that gives security teams shadow AI discovery, risk assessment and remediation, and real-time guardrails across workstations. | [f1] |
|---|---|---|
| Founded | 2021 | [f2] |
| Funding | $9M total | [f3] |
| Latest funding | Seed extension, April 2024 (amount not disclosed) | [f4] |
| Deployment | SaaS | [f5] |
| Product | What it does |
|---|---|
| Autonomous Security | Autonomous Security: Secures AI agents at the endpoint with an MCP gateway, a vetted MCP catalog, sandboxed MCP hosting, and a centralized token vault. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Autonomous Security runs on the endpoint, discovering shadow AI across workstations, assessing agent risk and credential exposure, and enforcing real-time guardrails through an MCP gateway, sandboxed MCP hosting and a central token vault. It is mapped to the AI Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Autonomous Security names a specific buyer, the security team that cannot see what AI agents do on employee endpoints, and names concrete risks such as exposed configs, hardcoded secrets and off-script commands. Its sharpest quantification is its own August 2026 review of 100,000 agent sessions. The launch risk list sits in its own PR Newswire release, so the pain is specific but measured by the vendor rather than independently. [s1, s4, s6] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | The vendor’s pages describe three concrete layers. They cover shadow AI discovery with exposure analysis, runtime policy that blocks off-script commands, and a hosted MCP cloud with a gateway, sandboxing, a token vault and a pre-scanned catalog. The documentation site at docs.a16y.ai returns a login prompt, and the reviewed sources carry no third-party evaluation or open code, so the detail is concrete but not independently verified. [s1, s11, s19] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Anthropic open-sourced MCP in November 2024, and the rebrand post describes agents such as Claude Code and Cursor moving from developer curiosity to core infrastructure, a credible enabler. The demand evidence is mostly supply-side: CrowdStrike’s March 2026 release and Microsoft and Palo Alto Networks pages for endpoint agent controls. The buyer-side signals are the company’s own study and one unnamed customer quote, so demand stays indirect. [s16, s2, s12, s13, s14, s4] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | Gil Dabah and Ariel Shiftan co-founded NorthBit in 2012, which NoCamels and GamesBeat report Magic Leap acquired, and YL Ventures says the pair went on to lead product security there. TechCrunch separately covered their next company, Piiano, and its data-pseudonymization tools and vault in 2021, so the pair shows more than one in-domain build with independent reporting behind it. [s17, s18, s8, s9, s10] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 2/5 | The homepage quotes an unnamed public-company CISO reporting visibility across 4,000 endpoints, and a company-supplied description on YL Ventures’ portfolio page claims native agents on thousands of machines. Both are the company’s own figures, IVC’s company card lists an initial-revenues stage, and the reviewed sources name no customer or partner, which is the unnamed-customer level. [s1, s11, s10] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | TechCrunch reported a $9 million round led by YL Ventures, which IVC’s company card lists as an October 2021 seed. The same card records an April 2024 seed extension without showing its amount, and a 20-person team. That modest capital sits beside a shipped endpoint product, broadly proportional to a seed-stage company, but no revenue or growth metric is disclosed, so efficiency stays unconfirmed. [s9, s10, s1] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Buyers can place the product in the emerging AI agent security category, and CrowdStrike, Microsoft and Palo Alto Networks now publish endpoint controls for AI agents, which makes the slot recognizable. The slot is still forming, and the reviewed sources carry no analyst placement for Autonomous Security, so placement still leans on the vendor’s own framing of endpoint security for agents. [s12, s13, s14, s1] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 1/5 | CrowdStrike’s March 2026 release extends AI agent discovery, shadow AI governance and runtime threat detection from the endpoint. Microsoft Defender blocks malicious coding-agent behavior inline and maps agents to MCP servers, and Palo Alto Networks sells visibility into models, MCPs and extensions with real-time prevention. Three incumbents already ship the discovery, governance and endpoint runtime controls Autonomous Security sells, so the capability is already a checkbox in incumbent platforms. The deployment and session figures that could argue for friction come from company pages. [s12, s13, s14, s1, s4] |
Autonomous Security sells to the security team that cannot see what AI agents do on employee endpoints. The homepage states that traditional endpoint security can’t see AI agent behavior, and it names exposed configs, hardcoded secrets and off-script commands among the risks agents bring to workstations.
The company has put its own numbers behind the problem. Its August 2026 study reports going over 100,000 agent sessions from its platform. It describes agents that hit a blocked task and go looking for credentials, which it counts as roughly a third of confirmed findings. These figures come from the vendor’s own telemetry.
The timing traces to a protocol and a class of tools. Anthropic open-sourced the Model Context Protocol in November 2024. The rebrand post describes Claude Code and Cursor moving from developer curiosity to core infrastructure across every function. [s1, s4, s16, s2]
Autonomous Security places its controls on the endpoint. The rebrand post explains the choice. The machine where agents run is where the company can see prompts, intercept tool calls, vault secrets and enforce policy, while network-level controls cannot see what a local agent does inside an IDE.
The Autonomous Security platform has three layers. Discovery maps shadow AI on endpoints and identifies exposed configs and hardcoded secrets. A governance layer applies centralized policy, identity and audit and automatically blocks off-script, unauthorized and dangerous commands. A hosted MCP cloud runs MCP servers with a built-in gateway, sandboxed execution, a centralized token vault and a pre-scanned catalog.
The homepage says the product supports more than 50 popular AI agents and names Claude, Cursor, Codex Desktop, ChatGPT, Antigravity and Opencode. The documentation site at docs.a16y.ai returns a login prompt, so a reviewer without an account works from the marketing pages, the Security Policy page and the company’s research posts. [s2, s1, s11, s19]
Autonomous Security competes with established endpoint security vendors. CrowdStrike’s March 2026 release extends AI agent discovery, shadow AI governance and runtime threat detection from the endpoint and discovers MCP servers. Microsoft Defender now provides inline runtime protection for coding agents, starting with Claude Code and GitHub Copilot CLI, and Palo Alto Networks markets agentic endpoint security. CrowdStrike says its Falcon sensor already captures the activity of all applications on the endpoint, agentic ones included, so its customers can gain agent visibility from a sensor they already run.
Startups compete for the MCP slice of the same problem. Software Strategies Blog counted about $40 million of disclosed pure-play MCP security funding across four companies, Operant AI, Runlayer, Helmet Security and Manufact.
One investor ties the company to a named rival. The company’s About page lists George Kurtz, co-founder and CEO of CrowdStrike, among its investors alongside YL Ventures. [s12, s13, s14, s15, s5]
Autonomous Security publishes customer evidence without naming customers. Its homepage quotes an unnamed public-company CISO who reports visibility into shadow AI and the software supply chain on 4,000 endpoints. A company-supplied description on YL Ventures’ portfolio page claims native agents protecting thousands of Mac, Windows and Linux machines. Those deployment figures are the company’s own claims rather than references a buyer can contact.
The motion runs through demos. The homepage pairs a Book a Demo link with an Open app link, and IVC’s company card lists the company at an initial-revenues stage.
The company also publishes research drawn from its deployments. Its August 2026 study of 100,000 agent sessions draws on telemetry from its own platform, which records what AI agents do on enterprise endpoints. [s1, s11, s10, s4]
Gil Dabah and Ariel Shiftan have built security companies together before. NoCamels reported in 2016 that they co-founded NorthBit in 2012 and that Magic Leap acquired it, and YL Ventures states that the two went on to lead product security at Magic Leap.
Their next company was the privacy startup Piiano, which TechCrunch covered as it raised a $9 million round for data-pseudonymization tools and a vault. IVC’s card for Piiano Privacy Solutions Ltd. carries MCPTotal in its name and records the company as formerly Piiano, and the founders relaunched it as MCPTotal in 2025 and renamed it Autonomous Security in May 2026.
The rebrand post says the company, the mission and the team stayed the same while the scope grew beyond MCP. The About page describes both founders as veterans of the IDF’s elite cybersecurity units. [s17, s8, s9, s10, s7, s2, s5]
Autonomous Security states on its Security Policy page that it is SOC 2 Type II compliant and undergoes independent annual audits and penetration tests. Customers on eligible plans can request the SOC 2 report, and the company supports a data processing agreement.
The data practices are stated in specifics. For endpoint data, the policy caps retention of any data type at 60 days, and it says neither the company nor its subprocessors use customer data for model training. Hosted MCP servers run in a single-tenant environment per customer per space, and a token vault limits which containers can reach which credentials. [s3]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| CrowdStrike | competes with | Endpoint platform vendor competing for the same security team with AI agent discovery and runtime detection from the endpoint. | |
| Microsoft Defender | competes with | Competes for the same endpoint security budget with local AI agent protection in Defender. | |
| Palo Alto Networks | competes with | Competes through its Cortex agentic endpoint security offering for the same endpoint AI agent problem. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Runlayer | competes with | Competes for the enterprise buyer governing how agents reach tools through MCP. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Capsule Security | competes with | Adjacent agent-security startup competing for the same agent-governance budget. |
Add analyzed competitors to compare them side by side with Autonomous Security.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
pivot urgently
Autonomous Security’s strengths are demanding engineering and a curated catalog. Recording and scoring what AI agents do on enterprise endpoints, blocking commands at runtime, and hosting MCP servers in single-tenant sandboxes takes specialized work. Its pre-scanned catalog of vetted MCP servers sits behind sign-in. Customers buy software their own teams operate, and SOC 2 Type II eases procurement without blocking a replacement. Leaving means rebuilding the policies and vaulted credentials a customer set up in it. CrowdStrike and Microsoft now ship endpoint controls for AI agents, so the company competes with established endpoint vendors for the same budget.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers buy a software platform, endpoint discovery, runtime policy and a hosted MCP cloud, and the customer’s security team operates it and owns the outcomes. The reviewed sources describe no managed service or accountability the company takes on. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Leaving means removing the desktop agent from the endpoints where it runs and rebuilding the centralized policies and vaulted credentials a customer set up in it, meaningful friction in integrations and workflows. The cited record documents that setup but does not size a migration and shows no network effect or vendor-bound residency, so the friction is integration and workflow work. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Autonomous Security states SOC 2 Type II compliance with annual audits and supports a data processing agreement, assurances a funded rival obtains through ordinary enterprise preparation. The reviewed sources show no authorization or mandate that would block a replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Recording every prompt, tool call and command from AI agents on enterprise endpoints, scoring those sessions, and blocking off-script commands at runtime is real-time systems work. The company also runs hosted MCP servers in single-tenant sandboxes, which adds cloud isolation engineering to the endpoint work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | The product targets enterprise security teams, with SSO/SCIM and SIEM integration, and an unnamed public-company CISO endorses it on the homepage. The reviewed sources name no regulated-enterprise or government buyer, so the evidence does not establish a regulated-enterprise buyer class. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Autonomous Security is a platform with application features: discovery, runtime policy and a gateway for hosted MCP servers on top of an endpoint agent. The reviewed sources do not show other software built on it or depending on it to run, so it does not reach the infrastructure level. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | The captured record shows no retained asset that accrues to the company. The security policy caps retention at 60 days, limits backend access to each tenant’s own data and says customer data is not used for model training, and the blog’s 100,000 analyzed sessions do not establish cross-customer accumulation. Security Boulevard describes hundreds of vetted MCP servers, and the app catalog sits behind a sign-in page, which shows access control rather than a non-public retained asset. |
Autonomous Security targets security teams that need to govern AI agents running on employee desktops. The About page states that the company builds security and governance for AI agents running on desktops, and the homepage says traditional endpoint security can’t see AI agent behavior.
The segment is the endpoint, not the network or the model. The rebrand post explains that the company moved off the network layer because the machine where agents run is where prompts, tool calls and secrets are visible. That puts the company among agent-governance vendors while staking the narrower claim that the laptop is the control point.
The target agents span coding tools and general assistants. The homepage names Claude, Cursor, Codex Desktop, ChatGPT, Antigravity and Opencode among supported agents. The rebrand post describes agents moving into core infrastructure across every function, so coding tools read as an entry point rather than the edge of the market.
Autonomous Security combines endpoint discovery, runtime governance and a hosted MCP cloud. The homepage describes exposure analysis for exposed configs and hardcoded secrets, centralized policy with identity and audit, and automatic blocking of off-script commands. Its secure MCP cloud adds a built-in gateway, sandboxing, a token vault and a pre-scanned catalog.
The claimed advantage is visibility into agent intent. A company-supplied description on YL Ventures’ portfolio page says the product monitors AI intent where agents interact with the system rather than monitoring binaries, and that it audits the source code, dependencies and configurations of non-binary software.
The company also publishes research drawn from its telemetry. Its August 2026 study says its desktop agent records every prompt, tool call, command and tool result on enterprise endpoints and then scores and investigates those sessions, and it reports going over 100,000 sessions. The documentation site at docs.a16y.ai returns an Unauthorized response.
Autonomous Security sells through demos with a product login alongside. The homepage pairs Book a Demo with Open app, and its customer evidence is an unnamed public-company CISO quote about visibility across 4,000 endpoints.
Launch coverage and research posts carry the outreach. MCPTotal distributed its October 2025 launch through PR Newswire, and Security Boulevard covered it separately the same day. Since the May 2026 rebrand the company has published research such as its August 2026 study of agent sessions.
IVC’s company card lists the company at an initial-revenues stage with 20 employees.
Autonomous Security’s homepage lists no price. Prospects reach the company through a Book a Demo link beside an Open app link.
The charging unit does not appear on the homepage. Whether the company meters by endpoint, by agent or by seat would signal whether it frames itself as endpoint security or as agent governance.
Autonomous Security delivers a desktop agent plus a hosted cloud. The study describes a desktop agent that records agent activity on enterprise endpoints, and the Security Policy page says hosted MCP servers run in a single-tenant environment, a dedicated pod per customer per space.
The hosting practices are documented. The policy states that data is stored in AWS US data centers by default, caps retention of endpoint data at 60 days, and uses a token vault that limits which containers can reach which credentials.
Autonomous Security states SOC 2 Type II compliance on its Security Policy page, with independent annual audits and penetration tests. The report is available on request to eligible customers, and the company supports a data processing agreement.
Its data commitments are specific. The policy says neither the company nor its subprocessors use customer data for model training, caps endpoint data retention at 60 days, and keeps hosted MCP servers in single-tenant environments.
The token vault is a trust feature. The policy explains that the vault limits each container to a specific set of credentials, and the homepage presents it as protection for sensitive credentials.
Autonomous Security sits over agent ecosystems it does not own. The homepage lists supported agents from several vendors, and the rebrand post cites 12,900-plus MCP servers and 91,000-plus skills as the ecosystem it governs.
The pre-scanned MCP catalog is its main ecosystem asset. Security Boulevard described it at launch as hundreds of MCP servers vetted by cybersecurity professionals, and the catalog in the company’s app sits behind a sign-in page.
The platforms it governs also compete for the control point. CrowdStrike discovers MCP servers from its own sensor, Microsoft Defender protects coding agents inline, and Palo Alto Networks markets agentic endpoint security, so endpoint vendors can pull agent governance into their own products.
Autonomous Security is led by founders with a prior security acquisition. NoCamels reported that Gil Dabah and Ariel Shiftan co-founded NorthBit in 2012 and that Magic Leap acquired it, and YL Ventures says the two led product security there afterward.
The same founders built Piiano, which TechCrunch covered at its 2021 seed, and IVC’s card for Piiano Privacy Solutions Ltd. carries the MCPTotal name. They relaunched the company as MCPTotal in 2025 and renamed it Autonomous Security in May 2026, and the rebrand post says the team is the same.
IVC lists 20 employees. The About page lists George Kurtz, co-founder and CEO of CrowdStrike, as an investor alongside YL Ventures.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Autonomous Security: homepage | official | 2026-09-22 |
| f2 | YL Ventures on backing Gil Dabah and Ariel Shiftan at the company's 2021 seed (then Piiano) | press | 2026-06-14 |
| f3 | TechCrunch on the company's $9M seed (raised as Piiano, October 2021) | press | 2026-06-14 |
| f4 | IVC Data & Insights: company card for Piiano Privacy Solutions Ltd. (MCPTotal), financial rounds | other | 2026-09-22 |
| f5 | AI Defense Matrix Catalog entry | other | 2026-06-10 |
| f6 | AI Defense Matrix Catalog mapping | other | 2026-08-21 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.