Capsule Security

• Microsoft and Salesforce are hardening Copilot Studio and Agentforce, in part by patching the vulnerabilities Capsule Security disclosed. If platform-native agent governance satisfies enterprise auditors, the cross-platform layer becomes optional spend.
• No customer evidence is public. If no named customers or case studies appear by mid-2027, the company faces its next raise with research credibility but no traction proof on a $7 million seed.
• Other startups are building agent-security platforms for the same emerging budget, and security incumbents that already own the buyer relationship are moving toward AI runtime protection. If the category consolidates before Capsule Security lands reference customers, the company competes on features against vendors with longer runways.
• ClawGuard and the Agent Control Standard bet on open agent ecosystems. If platform vendors rally behind a competing control standard, the standardization investment strands.
• Each public disclosure teaches the target platform to close the gap Capsule Security monetizes. A research-led brand that improves Microsoft and Salesforce faster than it converts buyers shrinks its own addressable problem.

Capsule Security frames enterprise AI agents as a new class of privileged user that security teams cannot yet govern. CEO Naor Paz argues that agents act at machine speed, do not behave like deterministic software, and create a gap between what teams can govern and what agents do in production. The pitch targets the moment between prompt and action, where the company says legacy tools have no visibility.

Independent evidence supports the pain. Gartner defined guardian agents, AI-based technologies that oversee and protect other AI, in June 2025 and predicts they will account for at least 10 to 15% of the agentic AI market by 2030. The same Gartner release reports a May 2025 poll of 147 CIOs in which more than a quarter said they had already deployed AI agents.

The company demonstrated the attack class itself rather than citing others' incidents. Its ShareLeak research showed indirect prompt injection in Microsoft Copilot Studio, which Microsoft fixed and published as CVE-2026-21520 with a CVSS score of 7.5, a record carried independently at NVD and in the MITRE CVE list, and its PipeLeak research showed prompt injection through lead forms in Salesforce Agentforce, which Help Net Security notes Salesforce confirmed it addressed. [s8, s11, s13, s3, s10, s16, s17]

The Capsule platform spans discovery, observability, runtime enforcement, and red teaming. The homepage describes agentless integration that connects in minutes, discovers agents across home-grown systems, SaaS agent platforms, and endpoints, maps agents, tools, data, and actions into an agent security graph, and blocks unsafe behavior in real time before actions execute. White-box red teaming feeds discovered weaknesses back into runtime protection.

The claimed mechanism is AI watching AI. The stealth-exit release describes fine-tuned small language models that form a multi-agent system of guardian agents covering posture and low-latency runtime protection, a description Forgepoint's Damien Henault echoes. The company lists coverage across AWS Bedrock, Azure Foundry, GCP Vertex, Claude Code, Cursor, GitHub Copilot, ChatGPT Enterprise, Microsoft Copilot Studio, and Salesforce Agentforce, with no proxies, gateways, SDKs, or browser extensions.

Technical writing documents an architectural stance. CTO Lidan Hazout argues that MCP gateways are the wrong abstraction because they see only one protocol, and that hooks inside the agent runtime observe MCP tools, shell commands, SDK calls, and HTTP requests while secrets stay in the customer's environment. ClawGuard, the company's open-source enforcer, applies the same idea as a pre-invocation checkpoint for OpenClaw agents.

Public verification of the defensive product lags the research. The site offers no documentation portal, sandbox, or trial among its pages, so the artifacts a buyer can inspect, the CVE-backed disclosures and the open-source code, validate the team's offensive understanding more than the platform's efficacy. [s1, s11, s5, s6, s4, s14, s3]

Capsule Security positions as an independent control layer against platform-native governance. SecurityWeek describes a solution that works as an independent layer across frameworks, environments, and tools, and the company's own disclosures showed gaps in the agent platforms Microsoft and Salesforce govern themselves. The implicit argument is that enterprises running agents on many platforms need one enforcement point that no single platform vendor provides.

The startup field around that argument is crowded. Several venture-backed companies sell agent-security platforms to the same emerging budget, and the security incumbents are moving too, with established vendors marketing AI runtime security and CrowdStrike running the accelerator that selected Capsule Security as a finalist. The company's claimed differentiators are enforcement inside the execution path without proxies, gateways, or SDKs, and research depth demonstrated on the platforms buyers actually run.

The counterweight is absorption speed. Each disclosure that Microsoft or Salesforce patches narrows the gap an independent layer fills, and an agent-governance feature is a plausible quarterly release for platform vendors that already own the buyer relationship. [s8, s3, s12, s11]

No demand evidence is public. Fetched sources name no customers, design partners, case studies, or commercial partnerships, and the launch coverage carries investor and advisor endorsements where peer launches carry customer logos. Two months past stealth, that absence is unsurprising, and it remains the central gap in the record.

The founders front the selling. Demo booking across the site routes to CEO Naor Paz's personal calendar link, the sitemap shows no careers page, and no go-to-market hires appear in fetched sources. For a company at this stage, founder-led selling matches the playbook rather than contradicting it.

Indirect signals stand in for traction. Lama Partners and Forgepoint Capital International led the seed, the CrowdStrike, AWS, and NVIDIA accelerator selected the company as one of six finalists from nearly 1,000 applicants, and the company announced advisors including Chris Krebs, the founding CISA director, and Omer Grossman, CyberArk's former global CIO. Those names open enterprise doors, but none of them is a customer. [s8, s9, s11, s1, s14, s12]

The founders' backgrounds fit the product. CTech reports in its own voice that CEO Naor Paz came from F5 and Unit 8200 and that CTO Lidan Hazout came from Securedtouch and Transmit Security, and the company's release adds that Hazout was VP R&D at Securedtouch when Ping Identity acquired it. Behavioral monitoring and identity security are close prior art for runtime agent oversight.

Research output is the team's strongest public credential. The disclosures and the Agent Control Standard post are authored by named researcher Bar Kaduri, and Microsoft's CVE assignment confirms the work's substance independently. A startup whose research moves two major platform vendors to ship fixes within months of founding has demonstrated domain depth that titles alone would not establish.

Bench depth beyond that is not yet assessable. Fetched sources identify the two founders and one researcher, disclose no headcount, and name no other executives, so the advisor roster, announced by the company with direct quotes from Chris Krebs and Omer Grossman, carries the rest of the credibility load. [s9, s11, s3, s7]

Trust collateral is thin but not absent. The site footer renders two self-claimed certification shields, an AICPA SOC 2 badge and an ISO 27001 badge, both served as image files that share the same misleading alt text naming only SOC 2, so the ISO 27001 claim shows up only in the rendered pixels. No trust center, security page, downloadable report, or vulnerability disclosure policy appears among the site's pages, and no fetched source documents the attestation behind either shield. For a vendor asking to observe and block agent actions inside enterprise systems, buyers will want more than two footer images.

The disclosure record is the stronger trust signal. ShareLeak ran through a coordinated process with the Microsoft Security Response Center from a November 2025 report to an April 2026 public disclosure, and Salesforce confirmed it addressed the PipeLeak issue. A young vendor that handles two major-platform disclosures cleanly demonstrates the security maturity its marketing claims.

The product's position raises the bar. Runtime enforcement places Capsule inside the execution path of business workflows, so procurement reviews will probe availability, data handling, and failure modes that no public material yet addresses, and company age will lengthen every one of those reviews. [s15, s14, s3, s10, s8]

Add analyzed competitors to compare them side by side with Capsule Security.

Capsule Security targets enterprise security teams at organizations adopting AI agents across SaaS and coding platforms. The supported-platform list signals where the company expects buyers, spanning managed AI services such as AWS Bedrock, Azure Foundry, and GCP Vertex, coding agents such as Claude Code, Cursor, and GitHub Copilot, and business-agent platforms such as Microsoft Copilot Studio, ServiceNow, and Salesforce Agentforce.

Segmentation beyond that platform coverage is undisclosed. Fetched sources name no verticals, deployment sizes, or geographies beyond the Tel Aviv headquarters, and with no customers public, the target segments are inferred from coverage rather than demonstrated by deployments.

The demand-proof clock is worth recording at the baseline. Dated public activity runs through at least a June 17, 2026 post on mitigating the agentic AI threat, which follows the May 27, 2026 Agent Control Standard announcement, so the company keeps publishing, but no dated proof of demand exists at any point in the record. The launch positioning already addresses the current platform generation, including MCP and agent skills, so the pitch is current yet unproven.

The claimed pain points are concrete and the claimed mechanism is consistent across every fetched description. Capsule Security names manipulation, rogue behavior, and silent data exfiltration as the failure modes, and vendor and press materials agree the product discovers agents, observes their reasoning and execution, and blocks risky actions inside the execution path rather than at a network edge.

The claimed AI advantage is purpose-built models rather than a data corpus. Forgepoint's Damien Henault describes fine-tuned small language models forming a multi-agent guardian system that covers posture and low-latency runtime protection, and the company's ClawGuard post argues the same intent-level evaluation distinguishes its approach from NVIDIA's sandbox-style NemoClaw, which constrains the environment but cannot read why an agent acts.

Demonstrated capability is offensive, while defensive efficacy remains asserted. The Copilot Studio disclosure, published as CVE-2026-21520 and carried at NVD and in the MITRE CVE list, and the Agentforce finding prove the team can break agent platforms, and the open-source enforcer shows working control code, but no documentation portal, benchmark, trial, or third-party evaluation of the commercial platform is public.

Capsule Security runs founder-led enterprise selling with no self-service path. Demo booking across the site routes to CEO Naor Paz's personal calendar link, the sitemap shows no separate careers page though the About page carries a Join us recruiting form, and fetched sources name no sales hires, which fits an early-stage vendor whose reference customers and deal status are undisclosed.

Distribution runs through credibility rather than channel. No marketplace listing, reseller, or MSSP motion appears in fetched sources. Instead the company publishes disclosures that generate press coverage, gives away ClawGuard to the OpenClaw community, and joined the CrowdStrike, AWS, and NVIDIA accelerator as one of six finalists from nearly 1,000 applicants, a motion that puts the product in front of practitioners and ecosystem partners without a quota-carrying team.

The advisor roster is the visible door-opener. The About page as currently fetched lists six advisors, including Chris Krebs, Jim Routh, and Yonesy Núñez, down from the eight the June 2026 capture showed, names that reach CISO buyers directly, and that network plus the investor brands stands in for the customer logos the record lacks.

Capsule Security publishes no pricing, and no pricing page exists among the site's pages, which signals negotiated enterprise deals and a sales-assisted motion. For a pre-reference vendor that is the expected posture, and it leaves buyers no way to size the spend without a conversation.

The charging unit is the undisclosed decision that will say the most. Pricing per monitored agent would match how buyers count the problem, pricing per action volume would track the runtime work Capsule performs, and platform-tier pricing would ease procurement, and nothing public commits the company to any of them. The choice will reveal whether the company believes buyers pay for coverage breadth or for enforcement volume.

The Capsule platform deploys agentlessly and claims minutes to visibility. The homepage describes connecting without proxies, gateways, SDKs, or browser extensions, discovering agents across home-grown systems, SaaS platforms, and endpoints, and routing agent telemetry into the customer's existing security workflows and response processes.

Inline enforcement sets a high operational bar the public record does not yet address. Blocking actions before they execute places Capsule in the critical path of business workflows, so latency, availability, and failure-mode questions will dominate technical evaluations, and no SLA, status page, or deployment documentation is public.

The architecture argument doubles as a data-exposure answer. CTO Lidan Hazout's technical writing argues that runtime hooks live inside the customer's environment and agent code, that secrets stay in existing systems, and that no third-party gateway accumulates credentials, a posture that addresses the obvious objection to inserting a young vendor into the execution path.

Trust collateral trails the access the product requires. The site footer displays two self-claimed certification badges, an AICPA SOC 2 shield and an ISO 27001 shield, both rendered from image files that the prior pass under-counted because both carry the same misleading alt text naming only SOC 2. Rendered-pixel verification confirms the ISO 27001 badge is present alongside the SOC 2 one. These are table-stakes signals rather than a moat, and no trust center, security documentation, downloadable report, or vulnerability disclosure policy appears among the site's pages, so the attestations behind the badges are not publicly inspectable. A vendor that observes agent reasoning and blocks business actions will face procurement reviews that two footer images do not answer.

The company's own disclosure conduct is its best trust evidence. ShareLeak ran through a coordinated Microsoft Security Response Center process from a November 2025 report to an April 2026 coordinated publication, and Salesforce confirmed it addressed the PipeLeak finding, conduct that demonstrates the security maturity the marketing claims.

There is an asymmetry worth resolving. Capsule Security sells auditable telemetry for governance, investigation, and compliance teams while publishing little about its own compliance posture, and closing that gap is cheaper than losing a procurement cycle to it.

Breadth across agent platforms is the platform claim. Capsule Security positions as one control layer spanning named managed-AI, coding-agent, and enterprise-agent platforms, a neutral coverage posture across platforms rather than a control tied to any one of them.

The Agent Control Standard is the strategic centerpiece of the ecosystem story. The company sits on the core team of ACS, an open, MIT-licensed standard for runtime governance of AI agents announced in May 2026, alongside vendors, platforms, and security companies. A young vendor that co-writes the standard for stopping agents is trying to turn its enforcement point into shared infrastructure, which would outlast any single feature comparison.

The open-source footprint seeds the developer side. ClawGuard gives OpenClaw users a free pre-invocation checkpoint, and the company frames it as complementary to NVIDIA's NemoClaw sandbox, a framing that aligns Capsule Security with NVIDIA rather than against it in the open agent ecosystem. No partner program, marketplace listing, or public API documentation exists yet.

The founding pair maps to the problem from two directions. CEO Naor Paz came from F5 and Unit 8200, per CTech's own reporting, and CTO Lidan Hazout is formerly associated with Securedtouch and Transmit Security, behavioral and identity security experience that runtime agent monitoring extends naturally.

The research bench has at least one named member beyond the founders. Bar Kaduri authored the ShareLeak disclosure and the Agent Control Standard post, and the output cadence, two major-platform disclosures, an open-source tool, a research report, and a standards seat within months, is dense for a company this new. Headcount, other executives, and go-to-market leadership remain undisclosed.

Investor and advisor validation is dense for the stage. Forgepoint Capital International and Lama Partners led the seed with board seats, and the announced advisors, eight names including Chris Krebs, Omer Grossman, Jim Routh, and Yonesy Núñez, bring the CISO-side perspective the founding team lacks directly.