All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Natoma sells enterprises a gateway that connects AI agents to company tools over MCP, an open standard for linking AI assistants to business systems. The gateway authorizes and logs each agent action routed through it. Snowflake completed its acquisition of Natoma on June 3, 2026, and its quarterly filing puts the preliminary consideration at 128.3 million dollars. HPE Networking is Natoma’s named customer and uses it for chat, coding and autonomous agents. Snowflake says it has also deployed Natoma across its own organization. Founded in 2024, Natoma raised a 7 million dollar seed round in May 2025 led by Index and Greylock, per DataBreachToday. Snowflake now controls Natoma’s product direction and plans to integrate its capabilities into its AI Data Cloud.
| Description | Natoma is a governed MCP gateway that connects AI clients and agents to enterprise tools and centralizes identity-aware authorization over which tools each agent can use. | [f1] |
|---|---|---|
| Acquisition | Snowflake, announced 2026-05-27 | [f2] |
| Founded | 2024 | [f3] |
| HQ | San Francisco, California, United States | [f3] |
| Funding | $7M total | [f3] |
| Latest funding | Seed (May 2025), led by Index Ventures and Greylock | [f3] |
| Deployment | SaaS, Self-hosted | [f4] |
| Product | What it does |
|---|---|
| Natoma | Governed MCP gateway that treats AI agents as non-human identities, enforcing identity-aware authorization and per-tool policy over agent access to tools, with shadow-AI discovery and audit. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Natoma is a governed MCP gateway that treats AI agents as non-human identities, enforcing identity-aware authorization and per-tool policy over agent access to tools, with shadow-AI discovery and audit. It is mapped to the AI Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Natoma names the buyer as the enterprise that wants agents in production and needs to control which tools they use. CIO quotes HFS Research CEO Phil Fersht describing ungoverned MCP as a shadow AI risk, which corroborates the pain in words. The figures that size it are Natoma’s own, such as 225 shadow AI instances per enterprise. No independent quantification appears in the cited sources. [s1, s2, s9] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Natoma’s own pages give concrete detail. They describe Cedar-based authorization, attribute-based policy keyed to user, group, device and AI client, managed or customer-supplied credentials, and audit logs for SIEM export. Snowflake and The Register describe the same tool-call enforcement . No benchmark, open code or third-party technical evaluation appears in the cited sources. [s2, s3, s7, s11] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | The enabler is MCP, which Natoma’s site dates to Anthropic’s release in November 2024. Two buyer-side signal kinds are independent and recent. Analyst commentary in CIO in May 2026, from HFS Research and Constellation Research, addresses governing agent tool access. SiliconANGLE reporting carried by CB Insights in July 2026 names Meltwater as an early adopter of the Snowflake gateway built on Natoma, and quotes its CTO on the controls that adoption has to preserve. Natoma published the HPE story itself. Fersht said most enterprises are not yet fully prepared to consume tools via MCP. [s14, s1, s9, s6, s5] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | DataBreachToday reports that CEO Pratyus Patnaik sold atSpoke, a workplace operations platform, to Okta in 2021 for 79.3 million dollars. He then spent more than two years as a senior director at Okta. That is a verifiable exit outside identity plus senior tenure at an identity vendor. The co-founders’ Okta, Microsoft, Google and Salesforce backgrounds come from the company’s own seed announcement. No in-domain exit or independently evidenced in-domain build appears in the cited sources. [s8, s12, s6] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | HPE Networking is the named customer, with its CIO quoted in Natoma’s case study on governing chat, coding and autonomous agents. Snowflake’s blog says Snowflake deployed Natoma across its own organization, and its release says the platform is deployed at large enterprises without naming them. A Fortune 500 AI architect is quoted anonymously on Natoma’s site. HPE plus a deployment reported by the acquirer itself is present traction without independent corroboration of scale. [s5, s7, s6, s1] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | DataBreachToday reports a 7 million dollar seed in May 2025 and 27 employees. On that capital Natoma shipped a priced platform with a named enterprise customer, and Snowflake completed its acquisition of Natoma on June 3, 2026. Snowflake’s quarterly filing puts the preliminary consideration at 128.3 million dollars, about 110.5 million in common stock and 17.7 million in cash. An acquirer paying that for a 27-person company after a 7 million dollar seed is evidence of output per dollar from outside the company. Natoma discloses no revenue or margin that would show operating efficiency. [s20, s8, s3, s5, s6, s19] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | CIO, The Register and DataBreachToday place Natoma as a governance gateway for agent tool calls over MCP . CB Insights files the same company under non-human identity management and lists C1, formerly ConductorOne, among its competitors. Two outside placements in different categories, around a protocol released in late 2024, describe a category that is recognizable but still contested. [s9, s11, s8, s14] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Analysts quoted by CIO say SaaS vendors are embedding agentic orchestration and hyperscalers are consolidating agent toolkits with similar tools and functions. Those vendors could offer tool governance inside products buyers already license. Tool calls routed through Natoma run under customer-written Cedar policies, managed credentials and role-based toolkits, so a customer that replaces it rebuilds that setup. The cited record shows no proprietary data or procurement position behind that setup, so bundling could eventually replicate it. [s9, s2, s7] |
Natoma sells to enterprises that want AI agents in production and need control over which tools and data those agents use. The company’s founding post says agents would only reach production if organizations could trust and control how agents access data, use tools, and take action. Its site adds shadow AI to the problem: MCP servers and agent connections that employees set up without approval.
Outside voices describe the same risk. HFS Research CEO Phil Fersht told CIO that MCP without identity, policy, privileged access controls and auditability can quickly become a shadow AI risk. Fersht also said most enterprises are not yet fully prepared to consume tools via MCP, which places the need ahead of broad adoption. [s18, s1, s9]
Natoma is a platform that connects AI clients and agents to company tools through MCP servers and governs those connections. It offers a verified MCP server library, custom servers built from an OpenAPI specification, and Profiles, which are role-based toolkits distributed through one managed endpoint. It runs in the cloud, in a customer VPC, on premises, or against desktop MCP servers.
The control layer is authorization and audit. Customers write attribute-based policies in Cedar, keyed to user, group, device and AI client, with managed or customer-supplied credentials and data filters. Natoma says its structured audit logs record the user identity, AI client, tool name and outcome of each tool call, and can be forwarded to SIEM platforms. Snowflake describes the same enforcement at the tool-call level for actions routed through Natoma.
Natoma’s site says it provides 100+ verified MCP servers. Google Patents records a patent titled System for managing non-human identities, as granted on April 28, 2026 to Natoma Labs on an application filed in January 2024. [s2, s1, s3, s7, s15]
Natoma competes for control of how enterprise agents reach tools. CB Insights classifies it under non-human identity management and lists C1, formerly ConductorOne, among its competitors. CIO’s analysts describe SaaS vendors such as Salesforce, ServiceNow and Workday embedding agent orchestration. They add that Microsoft, AWS and Google are consolidating agent toolkits with similar tools and functions.
Snowflake acquired this layer, closing on June 3, 2026. Its release says Natoma’s capabilities will be integrated into Snowflake’s AI Data Cloud. Constellation Research analyst Michael Ni told CIO that Natoma gives Snowflake the missing layer between insight and execution. Snowflake now decides Natoma’s product direction. [s20, s14, s9, s6]
Natoma sells through a free plan and sales-led Pro and Enterprise plans, with a Book a Demo link in its site navigation. HPE Networking is the named customer. Natoma’s case study quotes CIO Venky Rangachari. It describes a rollout that began with 500 ChatGPT users connected to Salesforce and Gong, then extended to Claude Code and to autonomous agents in Copilot Studio.
Snowflake announced the acquisition in May 2026 and closed it on June 3, 2026, and its release says Natoma’s platform is already deployed at large enterprises it does not name. Snowflake’s quarterly filing puts the preliminary consideration at 128.3 million dollars, most of it in common stock. DataBreachToday reports that Natoma raised a 7 million dollar seed in May 2025, led by Index Partners and Greylock Management. [s20, s3, s5, s6, s19, s8]
Pratyus Patnaik has led Natoma since its founding, per DataBreachToday. He sold atSpoke, which the outlet describes as a workplace operations platform, to Okta in August 2021 for 79.3 million dollars. He then spent more than two years as a senior director at Okta.
Will Potter, Zachary Hart and Paresh Bhaya co-signed the founders’ post on joining Snowflake. The company’s seed announcement, relayed by the funding site Signalbase, describes the founders as identity experts from Okta, Microsoft, Google, and Salesforce. Snowflake credits the team with expertise in MCPs, gateway infrastructure, identity governance and privileged access management. [s8, s18, s12, s6]
Natoma’s site lists SOC2 certified, GDPR compliant, CCPA and US Data Privacy in a footer that appears on its homepage and pricing page.
The product’s own controls address a security reviewer’s questions: Cedar policy, audit logs for SIEM export, customer-supplied vaults and DLP filters on the Enterprise plan, and on-premises deployment. The Enterprise plan commits to 99.999% uptime, which matters for a component that tool calls route through. [s1, s3, s2]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Aembit | competes with | Competes for enterprise spending on governing non-human and agent access to resources. | |
| Astrix Security | competes with | Competes in non-human identity security, the category CB Insights uses for Natoma. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Zenity | competes with | Competes for the enterprise team that governs AI agents and what they can access. | |
| MintMCP | competes with | Competes for the enterprise MCP gateway buyer. | |
| C1 | competes with | CB Insights lists C1, formerly ConductorOne, among Natoma’s competitors. | |
| Microsoft | adjacent | Analysts quoted by CIO name Microsoft among hyperscalers consolidating agent development toolkits with similar tools and functions. | N/AMicrosoft is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| Snowflake | adjacent | Acquired Natoma on June 3, 2026 and plans to integrate its capabilities into the Snowflake AI Data Cloud. |
Add analyzed competitors to compare them side by side with Natoma.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Natoma’s gateway is in the path between AI agents and company tools. Tool calls routed through Natoma run under policies the customer writes, with credentials and role-based toolkits configured in the gateway. A customer that leaves would rebuild those policies and connections in another product. Natoma Labs is the assignee of a granted US patent on managing non-human identities. It sells software the customer configures. Its SOC 2, GDPR and CCPA labels are assurances other vendors can also obtain, so they do not block a substitute. Snowflake plans to integrate Natoma’s capabilities into its AI Data Cloud.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Natoma sells software the customer configures, from a free plan to sales-quoted Pro and Enterprise plans, deployed as a managed service, in a VPC or on premises. The cited sources describe no service layer that takes responsibility for outcomes, so customers pay for features. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Tool calls routed through Natoma run under customer-written Cedar policies, managed credentials and role-based Profiles, so leaving means rebuilding that configuration and re-pointing clients at a replacement. The cited sources do not document policy portability or migration cost. The friction is meaningful, and the record documents no expensive exit. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Natoma’s site lists SOC2, GDPR, CCPA and US Data Privacy labels. Those are assurances a funded competitor can obtain through ordinary enterprise preparation, and the cited sources show no authorization or retained liability that would block a substitute. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Natoma authorizes and logs agent tool calls in real time as they pass through its gateway. It runs across cloud, VPC, on-premises and desktop servers. Natoma advertises 99.999% uptime for its Enterprise plan. Its site reports 1.8m tool calls per day. The Register describes enforcement at the level of individual tool calls, including whether each action should proceed, which makes the gateway real-time systems work. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | HPE Networking uses Natoma, and Snowflake says large enterprises run the platform. No regulated-industry or government buyer appears in the cited sources. Natoma targets finance and healthcare in its site navigation, so the evidence stops short of the regulated buyer class. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | Agents reach enterprise tools through Natoma’s MCP runtime and proxy, which authenticates with OAuth 2.1 and authorizes each routed tool call before it proceeds. Agent applications that use it depend on the gateway to reach those tools, which makes the product infrastructure. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Google Patents records the patent System for managing non-human identities as granted on April 28, 2026. Natoma Labs filed the application in January 2024, and its legal status is active. That granted patent is retained intellectual property assigned to Natoma. The cited sources name no non-public dataset. |
Natoma targets enterprises rolling agents out across many teams and systems. Its named customer, HPE Networking, runs chat, coding and autonomous agents through the platform, and Snowflake says large enterprises already run Natoma, without naming them. Natoma’s site also quotes an unnamed enterprise AI architect at a Fortune 500 company.
Natoma also prices a plan for small teams. The Free plan covers 5 MCP servers, up to 5 users and 5k tool calls per month. Enterprise controls such as on-premises deployment, customer vaults, DLP filters and SIEM integration sit in the Enterprise plan, which prices through sales.
Natoma’s product is an access path between agents and tools. The Free plan includes an MCP runtime and proxy with OAuth 2.1 authentication and tool call authorization. Snowflake describes a centralized gateway enforcing identity, policy and audit at the tool-call level. Customers set access rules using attributes of the user, group, device and AI client.
Natoma also discovers unmanaged AI and logs tool calls. Natoma says it identifies an average of 225 shadow AI instances per enterprise. It also says its audit logs record the user identity, AI client, tool name and outcome of each tool call. The cited sources describe no proprietary model and name no non-public dataset behind the product.
Natoma runs a demo-led enterprise motion with a free plan as the entry point. HPE Networking is the named reference, and the case study traces its rollout from 500 ChatGPT users to the full organization, then to Claude Code and autonomous agents.
Snowflake’s acquisition of Natoma, announced in May 2026 and closed on June 3, 2026, is strategic validation from a data-platform vendor with its own enterprise base. Snowflake’s release adds that the platform is already deployed at large enterprises, without naming customers. Snowflake’s blog says Snowflake deployed Natoma across its own organization. Snowflake’s quarterly filing reports preliminary consideration of 128.3 million dollars.
Natoma publishes three plans. Free costs nothing and includes 5 MCP servers, up to 5 users and 5k tool calls per month. Pro adds unlimited servers and users, 20k tool calls per month plus credits, SSO and access policies, with a 99.99% uptime SLA. Enterprise adds unlimited tool calls, on-premises deployment, customer vaults, DLP filters and a 99.999% uptime SLA. Pro and Enterprise prices come through sales.
Natoma meters servers, users and tool calls rather than agents, so a customer can run any number of agents within plan limits. Free caps usage at fixed limits, and Pro adds tool-call credits beyond its 20k monthly allowance. Enterprise removes the tool-call cap and prices by custom quote.
Natoma is software the customer configures. The platform runs as a managed service, in a customer VPC, on premises, or with desktop MCP servers, and the customer writes the policies and chooses the toolkits. The cited sources describe no analyst-staffed service layer.
Because tool calls routed through Natoma pass through its gateway, its availability affects whether those agents can act. The pricing page commits to 99.99% uptime on Pro and 99.999% on Enterprise, and Enterprise adds audit logs, SIEM and OpenTelemetry integration, and custom data retention.
Natoma’s site footer lists SOC2 certified, GDPR compliant, CCPA and US Data Privacy.
Those labels are procurement assurances that other funded vendors can also obtain, so they ease procurement without blocking a substitute. A buyer will also weigh how the gateway handles credentials and tool calls. Natoma’s Enterprise plan adds customer-supplied vaults, DLP filters and audit logs.
Natoma works as a connection layer between AI clients and enterprise systems. Its homepage lists Claude Code, ChatGPT, Cortex and Snowflake Intelligence among supported clients. The platform page lists a verified MCP server library and custom servers built from OpenAPI specifications.
Snowflake plans to connect Cortex Agents, Snowflake Intelligence and Cortex Code to enterprise systems through Natoma. Its release says Natoma’s capabilities will be integrated into Snowflake’s AI Data Cloud and available to customers soon, which points the platform toward Snowflake’s customer base.
Pratyus Patnaik leads Natoma. DataBreachToday reports that he sold atSpoke, a workplace operations platform, to Okta in 2021 for 79.3 million dollars. He spent more than two years as a senior director at Okta before founding Natoma. Google Patents lists him with William Potter, Paresh Jawahar Bhaya and Zachary Thomas Hart as inventors on a patent assigned to Natoma Labs.
DataBreachToday reported 27 employees, and The Register reported the deal would bring 20 employees to Snowflake. Snowflake credits the team with expertise in MCPs, gateway infrastructure, identity governance and privileged access management.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Natoma: MCP Gateway Platform | official | 2026-09-15 |
| f2 | Snowflake announces intent to acquire Natoma | official | 2026-09-15 |
| f3 | DataBreachToday on Natoma founding year and team | press | 2026-09-15 |
| f4 | AI Defense Matrix Catalog entry | other | 2026-06-09 |
| f5 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.