Clutch Security

• CyberArk, which acquired Venafi’s machine-identity business for over $1.5 billion, could bundle NHI discovery and governance into identity contracts it already holds, narrowing Clutch’s foothold to the enforcement layer.
• Several similarly staged startups, among them Astrix, Oasis, Token, and Aembit, sell NHI and agent-identity security. If buyers consolidate on one or two vendors before Clutch lands named reference customers, the contest shifts from product breadth to distribution.
• Public traction evidence is still four homepage logos and vendor-stated sectors dating to the January 2025 raise. If no named customer or independent traction report appears by mid-2027, go-to-market has not kept pace with product velocity.
• The zero-trust pitch asks customers to change how workloads authenticate by moving to ephemeral credentials. If buyers stall at discovery and posture, Clutch competes as a visibility tool in the segment where rivals are thickest.
• IAM incumbents such as Okta and Microsoft are positioned to add AI-agent identity features to suites enterprises already license, which would absorb the agentic line that currently differentiates the platform.

Clutch Security targets the gap between identity programs built for people and environments now dominated by machine credentials. The company’s materials describe service accounts, API keys, tokens, certificates, and AI agents spread across cloud, SaaS, on-prem, code, and CI/CD with no owner, no lifecycle, and no enforcement, and its positioning page argues that tools built for human identity leave these unmanaged.

Independent sources corroborate the scale in their own voice. TechCrunch cites Venafi research that machine identities in a typical large enterprise grew from 320,000 in 2022 to 1 million in 2024, and a Keeper Security survey of Infosecurity Europe 2026 attendees found 68% of respondents running AI agents as privileged identities while only 15% claimed full visibility into NHIs across their environments. SecurityWeek frames the same credentials as increasingly targeted in attacks. The OWASP Non-Human Identities Top 10, an industry standards effort, codifies secret leakage and long-lived secrets as named NHI risk classes, and NVD CVE-2025-30066 documents a 2025 supply-chain flaw exposing CI/CD secrets in action logs.

The sharpest quantified claims remain vendor research. The assertion that exposed secrets are exploited within minutes, which anchors the company’s case against rotation schedules, comes from Clutch’s own research rather than a third party, so buyers will want to validate the urgency against their own incident history. [s9, s17, s19, s16, s12, s22, s23]

One correlation graph carries three product families. The platform connects to cloud providers, SaaS applications, code repositories, CI/CD pipelines, vaults, password managers, endpoints, and AI platforms, and its Identity Lineage graph maps each identity, agent, and secret to its origin, owners, storage locations, consumers, and reachable resources. Non-human identities, AI agents, and secrets each get discovery, posture, and detection-and-response coverage on that shared foundation.

The agentic line extends the same model to AI systems. Agent guardrails let teams set policy on each link of the chain the vendor describes, the person who deployed an agent, the agent, its tools, the identities it authenticates with, and the resources it reaches, and shadow-AI discovery inventories MCP servers running on developer machines outside traditional controls, a capability the company introduced in September 2025.

Enforcement is staged rather than immediate. The homepage describes a progression from behavioral baselines on auto-pilot through ACL enforcement to ephemeral credentials, the model the Series A coverage summarizes as validating identity usage in real time and rendering exposed secrets useless to attackers.

Verifiable depth comes from integrations and code rather than documentation. TechCrunch reports close to 60 integrations, and the GitHub organization hosts public tools including AWSKeyLockdown and Federator, but the site offers no documentation portal, sandbox, or trial, so capability assessment outside a sales process depends on vendor pages and press descriptions. [s2, s1, s7, s10, s13, s16, s17, s15]

Clutch positions on breadth, one platform for every identity that is not a person. The platform page claims identities, agents, and secrets in a single product, and the why-Clutch page contrasts that scope with point tools built for narrower slices, a pitch aimed at buyers who would otherwise assemble separate secret scanners, NHI inventories, and agent-governance tools.

The startup field is crowded and well funded. TechCrunch names Astrix Security with a $45 million round, Oasis with $40 million, Silverfort, and Token Security, whose own $20 million Series A closed days earlier, and Aembit competes from the opposite direction by brokering short-lived credentials for workloads and agents, enforcement-first where Clutch leads with discovery and governance. Differentiation among the discovery-led rivals rests on correlation quality and coverage, which public materials cannot settle.

Against incumbents the company coexists with vaults and competes with platforms. Vault augmentation positions Clutch alongside existing secret stores rather than replacing them, while CyberArk, which acquired Venafi’s machine-identity business for over $1.5 billion, owns the adjacent budget line and could bundle discovery and governance features into contracts it already holds. [s2, s9, s17, s4]

Customer proof is vendor-displayed and has not visibly grown since the raise. The homepage shows NTT Data, Fluidra, OpenWeb, and Cedar under a trusted-by banner, and the Series A post claims enterprises in banking, financial services, insurance, and technology, but no fetched independent source names a customer and none speaks publicly. The newest independent demand evidence remains the January 2025 funding coverage, while vendor-origin materials from September 2025 add a design-partner account, a financial-services customer the company says it worked with on shadow-AI discovery.

The commercial organization arrived earlier than most Series A peers. The leadership page lists a VP Sales, a VP Sales Engineering, and a VP Product alongside the founders, the careers page advertises a senior sales engineer role remote in the US, and the CEO fronts the company’s announcements and research posts.

Distribution runs on content rather than channels. The company publishes the NHI Index mapping non-human identities across vendors, free masterclasses on NHI and agentic-AI security, a research series attacking rotation practices, and open-source tools, a top-of-funnel motion aimed at practitioners. No marketplace listing, reseller, or MSSP program appears in fetched sources. [s1, s12, s3, s11, s15, s13]

The founders’ backgrounds map onto both halves of the product. Calcalist identifies Ofir Har-Chen as the former COO at Hunters and a Sygnia alumnus, operations-side experience in detection and incident response, and places Sagi Haas and Tal Kimhi at Axonius, whose asset-correlation pedigree is the closest prior art to an identity lineage graph. TechCrunch adds that Har-Chen spent 20 years across Israeli government and private-sector security roles.

The bench is deep for the stage. Six leaders are publicly named, the three founders plus VPs of sales, product, and sales engineering, and Calcalist reports 30 employees across Tel Aviv and US offices at the time of the raise. No advisory board or independent recognition beyond the funding coverage appears in fetched sources. Israel’s national company registry independently confirms the entity, listing Clutch Security as an active private company incorporated in November 2023. [s18, s17, s3, s21]

Trust collateral exists but stays at the claim level. The trust center states SOC 2 Type II and ISO 27001 certifications, describes a zero-knowledge architecture in which sensitive data never leaves the customer’s organization, and notes that the company runs its own product internally. For a vendor whose product maps every credential in a bank’s estate, those are the right claims to make.

What the public record lacks is verification depth. The trust center publishes no attestation documents, subprocessor list, vulnerability disclosure policy, or security whitepaper in fetched pages, so third-party risk teams must request evidence through the sales process. Regulated-sector deployments, if the vendor’s sector claims hold, suggest some buyers have already cleared that review. [s5, s12]

Add analyzed competitors to compare them side by side with Clutch Security.

Clutch sells to enterprise identity and security teams that have lost track of their machine identities. Non-human identities, the service accounts, API keys, tokens, certificates, and the credentials AI agents use, now outnumber employees in a typical organization, and they sit scattered across cloud, SaaS, on-prem, and CI/CD pipelines. Independent bodies have codified the risk: the OWASP Non-Human Identities Top 10 for 2025 names secret leakage and long-lived secrets among the top exposures, and a 2025 supply-chain flaw let attackers read secrets straight out of CI/CD action logs.

The buyers Clutch displays are world-recognized brand logos and a security executive's testimonial rather than named case studies, and the reviewed record does not break those logos down by sector or document their use. That still signals a serious enterprise buyer with real budget for the problem. The category is also crowded, with rivals such as Semperis and Astrix Security pursuing overlapping machine-identity problems, so Clutch competes on breadth and depth rather than by defining the space.

The Clutch platform covers the machine-identity lifecycle in one place: discovery, governance, posture and risk management, and threat detection and response across cloud, SaaS, and on-prem. Its Identity Lineage maps where each identity lives, what it does, and what it touches, and the platform connects through many API-based, agentless integrations.

AI is a subject Clutch secures rather than a label it wears. Its agentic AI governance discovers and governs the identities AI agents use before they become an unmonitored path into systems. The more durable capability is enforcement: migrating workloads off the static secrets that linger and leak toward short-lived credentials, the exposure OWASP ranks near the top.

Clutch runs a demo-led enterprise motion at Series A stage. The company raised a $20 million Series A in January 2025 led by SignalFire, with Lightspeed Venture Partners and Merlin Ventures, bringing its total to $28.5 million, against roughly thirty employees.

Its proof today is presentation more than evidence. The homepage shows named enterprise logos and a security executive's testimonial, but no public case study, reference call, or independent customer account describes a deployment's results. Open-source tools on its GitHub, a CI/CD federation project and a leaked-key lockdown script, plus a CrowdStrike Falcon Marketplace listing, widen the top of the funnel and the paths to purchase.

Clutch does not publish pricing. The reviewed sources show no public price page, tier, or list rate, so packaging and the pricing metric sit behind a sales conversation and a demo. That is consistent with an enterprise motion at this stage, but it means a buyer cannot gauge cost without contact, and the public record does not show whether pricing aligns to the value the platform delivers.

Clutch deploys agentlessly and connects over APIs, which keeps time-to-value short: the company describes inventorying an environment's identities, agents, and secrets in minutes across a broad set of integrations with no infrastructure changes. A zero-knowledge architecture keeps customer data inside the customer's own network and, the vendor says, stores or transmits no credentials.

That design suits enterprise procurement, where data residency and blast radius are gating concerns. It also shapes what Clutch can offer operationally: because nothing leaves the tenant, the product runs as software the customer configures and operates rather than a managed service that takes on running the program.

Clutch self-displays the attestations enterprise buyers expect: its trust center states SOC 2 Type II and ISO 27001. These are table-stakes assurances that ease procurement rather than a barrier a competitor lacks, and no federal authorization or regulated mandate appears in the record.

The zero-knowledge, in-tenant architecture is the more distinctive trust signal, since it lets a security-conscious buyer adopt the platform without exporting sensitive identity data. As a company incorporated in late 2023, Clutch is early in building the audit and reference history that longer-tenured vendors accumulate.

Clutch positions as a platform for everything that is not a person, but it operates as a layer on top of the identity providers, clouds, and SaaS it connects to. Its leverage comes from breadth of integration, plus distribution through a CrowdStrike Falcon Marketplace listing and open-source tooling that seeds awareness among practitioners.

That position carries the standard layer risk. The discovery and posture that open deals overlap with what identity incumbents can add as features, so Clutch's standing depends on staying deeper and broader on machine identity than a general identity platform chooses to go.

Clutch's founders carry senior in-domain pedigree. CEO Ofir Har-Chen was previously COO at Hunters and worked at the incident-response firm Sygnia, and co-founders Sagi Haas (CTO) and Tal Kimhi (VP R&D) came from Axonius. The company incorporated in Tel Aviv in late 2023 and employs roughly thirty people across Israel and the United States, backed by SignalFire, Lightspeed, and Merlin Ventures.

The pedigree is real operating experience without a founder exit or sustained public research record in the reviewed sources. Israel's national company registry independently lists Clutch Security Ltd as an active private company, corroborating the founding timeline the vendor and press report.