All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Capsule Security sells a runtime control layer for enterprise AI agents, software that watches what agents do and blocks unsafe actions before they execute. Founded in 2025 in Tel Aviv by Naor Paz and Lidan Hazout, it exited stealth in April 2026 with $7 million from Lama Partners and Forgepoint Capital International. The public record validates the threat rather than the demand. The team demonstrated working exploits against Microsoft Copilot Studio and Salesforce Agentforce, and Microsoft published a CVE for one, yet no customer, deployment, or production partnership appears in public. Buyers can connect Capsule in minutes without agents or proxies, public evidence shows no durable switching cost, and platform vendors or security incumbents may absorb parts of the control layer.
| Description | Capsule Security monitors AI agent behavior at runtime and intervenes as soon as it detects anomalous or unsafe activity, across enterprise, coding, and agent-builder platforms. | [f1] |
|---|---|---|
| Founded | 2025 | [f2] |
| HQ | Tel Aviv, Israel | [f2] |
| Funding | $7M total | [f3] |
| Latest funding | Seed, $7M (April 2026) | [f4] |
| Deployment | SaaS | [f5] |
| Product | What it does |
|---|---|
| Capsule Security | Capsule Security: Runtime security layer that discovers enterprise AI agents, observes their behavior, and blocks unsafe or risky actions before execution. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Capsule Security is a runtime security layer that discovers enterprise AI agents, observes their behavior, and blocks unsafe or risky actions before execution. It is mapped to the AI Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score |
|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs, demos, and third-party validation. | 3/5 |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 2/5 |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 2/5 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
pivot urgently
| Dimension | Score |
|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 1/3 |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Capsule Security: AI Agent Runtime Security Platform | official | 2026-07-09 |
| f2 | CTech on the Capsule Security seed round (April 15, 2026) | press | 2026-06-11 |
| f3 | SecurityWeek on the Capsule Security stealth exit | press | 2026-06-11 |
| f4 | Capsule Security stealth-exit press release (Business Wire, April 15, 2026) | press | 2026-06-11 |
| f5 | AI Defense Matrix Catalog entry | other | 2026-06-10 |
| f6 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Capsule Security homepage “Capsule detects and blocks unsafe, unintended, or risky agent behavior in real time, preventing incidents without slowing agents or engineering teams.” | official | 2026-06-11 |
| s2 | About Capsule page “Trust Your Agents. Stay in Control.” | official | 2026-06-11 |
| s3 | ShareLeak research post on Copilot Studio (CVE-2026-21520, April 9, 2026) “Jan 15, 2026 - Microsoft deployed fix and published CVE-2026-21520 with CVSS 7.5 (High)” | official | 2026-06-11 |
| s4 | ClawGuard open-source release post (April 12, 2026) “ClawGuard operates inside the decision loop itself, reading the full session context to understand not just what the agent is calling but why it is calling it” | official | 2026-06-11 |
| s5 | State of AI Agent Security 2026 post “We continuously monitor AI agent behavior and intervene during runtime at the first sign of anomalous or unsafe activity, across AWS Bedrock, Azure Foundry, GCP Vertex, Claude Code, Cursor, GitHub Copilot, ChatGPT Enterprise, Microsoft Copilot Studio, Salesforce Agentforce, and more.” | official | 2026-06-11 |
| s6 | Why MCP Gateways are a Bad Idea post (March 20, 2026) “The best place to secure agents is inside the agent runtime itself, not at the edge of a single protocol.” | official | 2026-06-11 |
| s7 | Agent Control Standard announcement post (May 27, 2026) “ACS is an open, vendor-neutral, MIT-licensed standard for runtime governance of AI agents. The core team spans vendors, platforms, and security companies. Capsule is one of them.” | official | 2026-06-11 |
| s8 | SecurityWeek on the Capsule Security stealth exit “Capsule Security, an Israeli startup aiming to add a security layer to agentic AI, today emerged from stealth mode with $7 million in seed funding.” | press | 2026-06-11 |
| s9 | CTech on the Capsule Security seed round (April 15, 2026) “Capsule was founded in 2025 by CEO Naor Paz, formerly of F5 and Unit 8200, and CTO Lidan Hazout, formerly of Securedtouch and Transmit Security. It is headquartered in Tel Aviv.” | press | 2026-06-11 |
| s10 | Help Net Security on the Capsule Security launch (April 15, 2026) “(Salesforce confirmed it has addressed the issue.)” | press | 2026-06-11 |
| s11 | Capsule Security stealth-exit press release (Business Wire, April 15, 2026) “Capsule fine-tuned Small Language Models (SLMs) to create a multi-agent system of 'Guardian Agents' that can protect AI with AI, covering both posture and low-latency runtime protection.” | press | 2026-06-11 |
| s12 | CrowdStrike accelerator finalists press release (March 19, 2026) “Selected from nearly 1,000 global applicants, this year’s finalists represent a new wave of innovation” | press | 2026-06-11 |
| s13 | Gartner guardian agents press release (June 11, 2025) “By 2030, guardian agent technologies will account for at least 10 to 15% of agentic AI markets, according to Gartner, Inc.” | research | 2026-06-11 |
| s14 | Capsule site sitemap | official | 2026-06-11 |
| s15 | Capsule Security homepage footer trust badges (rendered-pixel verification) “Footer renders two badge images, Frame 1707485486.avif and Frame 1707485485.avif. Rendered pixels show a CERTIFIED ISO 27001 shield and a CERTIFIED AICPA SOC 2 shield, while both image alt texts read aicpa soc 2 certified, so the ISO 27001 claim appears only in the rendered shield.” | official | 2026-06-18 |
| s16 | NVD entry for CVE-2026-21520 (Copilot Studio information disclosure) “Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector” | other | 2026-06-29 |
| s17 | MITRE CVE record CVE-2026-21520 (Microsoft Copilot Studio) “assignerShortName: microsoft ... state: PUBLISHED ... product: Microsoft Copilot Studio ... baseSeverity: HIGH, baseScore: 7.5” | other | 2026-06-29 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Capsule Security homepage “Capsule connects in minutes using agentless integration to automatically discover AI agents across home-grown systems, SaaS agent platforms, and endpoint environments” | official | 2026-06-11 |
| s2 | About Capsule page “Advisors: Chris Krebs, Jim Routh, Omer Grossman, Yonesy Nunez, Mandy Andress (CISO, Elastic), Michael Dolinsky (Ermetic), Oz Golan (NoName Security), Dotan Bar Noy (Authomize). Join us: We want to build the developer organization we have always dreamed of.” | official | 2026-06-18 |
| s3 | ShareLeak research post on Copilot Studio (CVE-2026-21520, April 9, 2026) “Nov 26, 2025 - Initial report submitted to Microsoft Security Response Center (MSRC)” | official | 2026-06-11 |
| s4 | ClawGuard open-source release post (April 12, 2026) “ClawGuard operates inside the decision loop itself, reading the full session context to understand not just what the agent is calling but why it is calling it” | official | 2026-06-11 |
| s5 | State of AI Agent Security 2026 post “We continuously monitor AI agent behavior and intervene during runtime at the first sign of anomalous or unsafe activity, across AWS Bedrock, Azure Foundry, GCP Vertex, Claude Code, Cursor, GitHub Copilot, ChatGPT Enterprise, Microsoft Copilot Studio, Salesforce Agentforce, and more.” | official | 2026-06-11 |
| s6 | Why MCP Gateways are a Bad Idea post (March 20, 2026) “Hooks are built into the agent framework and trigger whenever tools are used.” | official | 2026-06-11 |
| s7 | Agent Control Standard announcement post (May 27, 2026) “ACS is an open, vendor-neutral, MIT-licensed standard for runtime governance of AI agents. The core team spans vendors, platforms, and security companies. Capsule is one of them.” | official | 2026-06-18 |
| s8 | SecurityWeek on the Capsule Security stealth exit “It operates as an independent layer that can be used with multiple frameworks, across any environment or tool, to monitor agents’ reasoning, interactions, and execution and block risky commands, tools, and exposures without disrupting the AI.” | press | 2026-06-11 |
| s9 | CTech on the Capsule Security seed round (April 15, 2026) “Capsule was founded in 2025 by CEO Naor Paz, formerly of F5 and Unit 8200, and CTO Lidan Hazout, formerly of Securedtouch and Transmit Security. It is headquartered in Tel Aviv.” | press | 2026-06-11 |
| s10 | Help Net Security on the Capsule Security launch (April 15, 2026) “(Salesforce confirmed it has addressed the issue.)” | press | 2026-06-11 |
| s11 | Capsule Security stealth-exit press release (Business Wire, April 15, 2026) “Capsule fine-tuned Small Language Models (SLMs) to create a multi-agent system of 'Guardian Agents' that can protect AI with AI, covering both posture and low-latency runtime protection.” | press | 2026-06-11 |
| s12 | CrowdStrike accelerator finalists press release (March 19, 2026) “Selected from nearly 1,000 global applicants, this year’s finalists represent a new wave of innovation” | press | 2026-06-11 |
| s13 | Gartner guardian agents press release (June 11, 2025) “By 2030, guardian agent technologies will account for at least 10 to 15% of agentic AI markets, according to Gartner, Inc.” | research | 2026-06-11 |
| s14 | Capsule site sitemap | official | 2026-06-18 |
| s15 | CTech naming the Capsule seed investors “Capsule Security, a cybersecurity startup focused on AI agents, has emerged from stealth with $7 million in Seed funding led by Lama Partners and Forgepoint Capital International.” | press | 2026-06-13 |
| s16 | Capsule Security homepage footer and demo link “Get a demo (https://calendly.com/naor-capsule/30min) ... aicpa soc 2 certified ... Capsule © 2026” | official | 2026-06-15 |
| s17 | Capsule Security homepage footer trust badges (rendered-pixel verification) “Footer renders two badges. Frame 1707485486.avif shows a green shield reading CERTIFIED ISO 27001, Frame 1707485485.avif shows CERTIFIED AICPA SOC 2. Both carry the same wrong alt text aicpa soc 2 certified, so ISO 27001 shows only in pixels.” | official | 2026-06-16 |
| s18 | Capsule: Mitigating the Agentic AI Threat post (June 17, 2026) “Bar Kaduri, June 17, 2026. This post addresses the other side of that picture, what the industry is building in response, where the defensive architecture is starting to take shape, and the questions security leaders need to be asking right now.” | official | 2026-06-18 |
| s19 | NVD entry for CVE-2026-21520 (Copilot Studio information disclosure) “Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector” | other | 2026-06-29 |
| s20 | MITRE CVE record CVE-2026-21520 (Microsoft Copilot Studio) “assignerShortName: microsoft ... state: PUBLISHED ... product: Microsoft Copilot Studio ... baseSeverity: HIGH, baseScore: 7.5” | other | 2026-06-29 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Do not republish its content or share access without the operator's permission.