Noma Security

• AWS could ship native agent security inside Security Hub and drop Noma from the curated Security Hub Extended roster.
• Microsoft, Salesforce, ServiceNow, Databricks and AWS each own an environment Noma covers, and any of them securing its own estate would absorb part of what Noma sells.
• Scale claims stay vendor-reported. Calcalist records that Noma discloses no revenue, and its Gartner Peer Insights listing carries no reviews, so a buyer has no outside check on growth or customer count.
• Two of the five customer voices on Noma’s homepage also sit on its advisor roster, so the arm’s-length reference base is smaller than the page suggests.
• Enterprise agent adoption slower than the UBS Research forecast Calcalist relays would shrink the urgency Noma sells against.
• Breadth across discovery, access control, red teaming and runtime detection could outpace depth, letting specialists win individual technical evaluations.

Noma Security sells into the governance gap that opens when staff, business teams and engineers all start running AI agents at once. The platform page splits that surface three ways: employees running coding agents such as Claude Code, Cursor and Codex on their own machines, business teams building agents on Microsoft Copilot Studio, Salesforce AgentForce and ServiceNow, and engineering teams building on AWS Bedrock, Azure AI Foundry, Databricks, LangChain and CrewAI. One security team owns all three, and that team is the buyer.

Independent measurement of the pain is thin and ageing. TechCrunch’s 2024 launch coverage cited a poll of more than 350 IT leaders in which over half said the complexity of AI applications weakened their security posture. Calcalist relays a UBS Research forecast that 53% of surveyed organizations plan to adopt agentic AI by 2026 and 83% by 2028, which measures adoption rather than the security gap.

Noma’s own framing has moved with the market. SecurityWeek’s Series A coverage quoted Braun describing one platform covering the new data and AI lifecycle, and the About page now calls the company an enterprise Agent Security and Governance Platform. The June 2026 access-control release, which Help Net Security covered, is where that repositioning shows up in shipped product. [s2, s5, s4, s7, s3, s13]

Four products share one set of findings. AI-SPM discovers every agent, MCP server, skill and model and maps each agent’s connections, permissions and data access. Access control decides which MCP servers, skills and tools an agent may use, keyed to identity-provider groups or applied by tool sensitivity. AI-DR detects prompt injection, data exfiltration, scope violations and agents drifting from their intent at runtime. AI red teaming runs multi-turn attack campaigns whose findings feed the runtime policies.

The June 2026 access-control release added enforcement. Help Net Security ran Noma’s launch announcement as industry news. That writeup describes a live registry of agents and MCP servers, a distinct attributable identity for each agent, three states covering approved, requires-review and blocked, and control at the level of an individual tool rather than a whole server.

Noma’s stated design keeps that enforcement out of one chokepoint. The homepage describes Open Enforcement as decoupling policy from infrastructure and enforcing at agent hooks, MCP gateways, AI gateways, agent SDKs and direct APIs, which spreads enforcement across several control points.

The documentation subdomain at docs.noma.security returns a login page, so the reviewed record carries no product documentation an outside reader can check. A reader without an account works from marketing pages, press coverage and Noma Labs writeups instead. [s2, s13, s1, s20]

Noma sells one platform against tools that each cover a slice of the problem. TechCrunch’s launch coverage named HiddenLayer and Protect AI as focused on defending AI systems from adversarial attacks and Cranium as providing visibility at the application level, then quoted Braun claiming Noma does all of that and more.

Noma’s distribution runs through AWS. AWS’s own announcement names Noma among the curated partner solutions in Security Hub Extended, a roster spanning endpoint, identity, email, network, data, browser, cloud, AI and security operations. Security Boulevard reported the same roster in May 2026, quoting an AWS director of security services. The narrower claim that AWS chose Noma specifically for AI security appears on Noma’s blog rather than in AWS’s announcement.

The platforms Noma covers are also the bundling risk. Its coverage list names Microsoft Copilot Studio, Salesforce AgentForce, ServiceNow, AWS Bedrock and Databricks, and each of those vendors owns the environment it runs. A vendor adding native controls for the agents it hosts would cover part of what Noma sells, without matching the span across all three environments. [s5, s11, s18, s12, s2]

Named customer evidence sits on Noma’s own homepage. Under a heading reading “What customers are saying” the page carries five voices: Jari Koister, a technology chief at Kantar, who says Noma helped his team detect issues and make them actionable, Scott Roberts, CISO of UiPath, who describes the platform deployed across the company’s AI stack, Matthew Hurewitz of Best Buy, Varun Badhwar of Endor Labs and Chris Hatter, a former CISO of Nielsen.

Two of those five are Noma’s own advisors. The About page groups Varun Badhwar and Chris Hatter under a strategic advisors heading, so their endorsements are not arm’s-length customer references and the named-reference base is three rather than five.

Scale claims remain the company’s own account. Calcalist reports that Noma discloses no revenue while reporting significant year-over-year growth after adoption by Fortune 500 companies in financial services, life sciences, retail and high tech, and no source in the reviewed record confirms the growth or a customer count.

Records Noma does not control carry the rest of the traction. AWS curated Noma into the Security Hub Extended roster in February 2026, the AWS Marketplace listing prices a 12-month contract at $200,000 with private offers available, and Noma appears on Rising in Cyber 2026, a list of 30 private cybersecurity companies selected by 150 CISOs and operating security executives. [s1, s3, s4, s11, s15, s19]

Niv Braun and Alon Tron founded Noma Security in 2023 after meeting in the IDF’s 8200 intelligence unit, as both Calcalist and SecurityWeek report. Neither founder has a prior company build or exit in the reviewed record.

Noma publishes a named executive team. The About page lists Ralph Pisani as chief revenue officer and Diana Kelley as chief information security officer. Calcalist recorded 40 people at the Series B, and Gartner Peer Insights now lists a band of 51 to 200 employees.

Noma Labs supplies the public research record. Its index lists seven dated vulnerability disclosures between September 2025 and July 2026, among them ForcedLeak in Salesforce Agentforce, an indirect prompt injection in Google Gemini Enterprise, a Context7 MCP server flaw, a GitHub AI agent flaw and RufRoot in an MCP bridge. The CVE record for RufRoot rates that flaw 10.0 and lists it fixed upstream. The same index carries three general security research posts dated between July and August 2026. In the reviewed record, independent coverage names Noma as the discloser of one of the seven: The Hacker News and Infosecurity Magazine both covered the Salesforce finding.

The security executives Noma publishes are advisors rather than investors. Its About page groups Vijay Bolina of Google DeepMind, Caleb Sima of the CSA AI Security Alliance and Varun Badhwar of Endor Labs under a strategic advisors heading, while the investors Calcalist names are firms: Evolution Equity Partners, Ballistic Ventures and Glilot Capital Partners. [s4, s7, s3, s8, s16, s9, s10, s17]

The Trust Center publishes six active certifications. It lists SOC 2 Type II audited by EY, ISO 27001, HIPAA and ISO/IEC 42001, alongside 104 security controls.

The underlying documents stay gated. The portal records zero public documents and 31 available on request, so an evaluator can see which reports exist and has to ask Noma for the reports themselves.

Noma’s Gartner Peer Insights listing carries no reviews. Its company details block there records an April 2026 update, while the product information and company description on the same page record November 2025. [s14, s8]

Add analyzed competitors to compare them side by side with Noma Security.

Noma Security sells to the security team at large enterprises that already run agents in more than one place. Calcalist reports adoption by Fortune 500 companies in financial services, life sciences, retail and high tech, on the company’s own account, and the named public references are UiPath, Kantar and Best Buy.

The segmentation splits by who builds the agent. Employees run coding agents such as Claude Code, Cursor and Codex on their own machines, business teams build agents on Microsoft Copilot Studio, Salesforce AgentForce and ServiceNow, and engineering teams build on AWS Bedrock, Azure AI Foundry, Databricks and frameworks including LangChain and CrewAI. Noma describes each of the three as carrying different builders and different risks.

Urgency rests on adoption forecasts rather than on incident history in the reviewed sources. Calcalist relays UBS Research forecasting that 53% of surveyed organizations plan to adopt agentic AI by 2026 and 83% by 2028, so the segmentation pays out as enterprise agent estates grow.

Four products share intelligence and feed into each other, by Noma’s own description. SecurityWeek describes continuous discovery across AI assets, infrastructure, agents and cloud environments, plus runtime protection that blocks malicious prompts, rogue outputs and unauthorized agents. Noma adds that red-teaming findings become enforced runtime patterns, so testing and protection work from one policy set.

Runtime detection works on sequences rather than on single actions. The homepage describes tracking the full behavioral chain of an agent session covering prompts, tool calls, data access and actions, and the platform page names prompt injection, data exfiltration, scope violations and intent drift as what the detection product catches.

Noma Labs is the public evidence of research depth. Its index lists seven dated vulnerability disclosures since September 2025, aimed at enterprise agent platforms and MCP tooling, including Salesforce Agentforce, Google Gemini Enterprise, a Context7 MCP server and a GitHub AI agent. The Hacker News and Infosecurity Magazine covered the Salesforce finding at a 9.4 severity score, and the Labs index carries an MCP bridge finding whose CVE record rates that flaw 10.0 and lists it fixed upstream.

In the reviewed sources, capability detail comes primarily from marketing pages and research writeups. The documentation subdomain at docs.noma.security returns a login page, so a reader without an account cannot check the depth those pages claim.

Noma pairs a founder-fronted story with a hired go-to-market organization. The About page lists Ralph Pisani as chief revenue officer, while Niv Braun remains the voice in company announcements such as the AWS partnership post.

Named validation leans on the homepage. Five voices appear under a customers heading, of which UiPath’s CISO and Kantar’s insights technology chief describe using the platform, while Varun Badhwar and Chris Hatter also appear on Noma’s strategic advisors roster and so are not arm’s-length references.

AWS is the differentiated motion. AWS’s own February 2026 announcement names Noma among the curated Security Hub Extended partner solutions, Security Boulevard reported the same roster quoting an AWS director of security services, and AWS states the plan carries pre-negotiated pricing, a single bill and no long-term commitments.

Independent confirmation of scale is absent from the reviewed record. Calcalist records that Noma discloses no revenue while reporting significant year-over-year growth, and the Gartner Peer Insights listing carries no reviews.

The reviewed Noma pages publish no prices, and AWS Marketplace carries a public benchmark. The listing prices a 12-month Noma Platform contract at $200,000, sets cost by the duration and terms of the contract, and takes private offers for custom quotes.

The metered unit stays undefined even on that listing. Its one 12-month dimension is named Noma Platform, with no metric such as protected AI assets, agents or users attached. The listing’s AI Insights block says the mapping of a unit to those metrics is not defined in the available data. A comparing buyer gets a price anchor without a unit behind it.

Entitlements end when a contract ends. The listing states that access expires if a customer does not renew or replace the contract before it ends, which sets what a departing buyer gives up.

Noma enforces at control points the customer already runs. The homepage describes Open Enforcement as decoupling policy from infrastructure and enforcing at agent hooks, MCP gateways, AI gateways, agent SDKs and direct APIs, instead of routing agent traffic through one gateway.

Coverage spans the three environments from one platform. The platform page describes discovery, posture management, access control, adversarial testing and runtime detection across all three, and SecurityWeek describes discovery reaching data platforms, infrastructure, agents and cloud environments.

AWS shortens the path for cloud-centric buyers. AWS states that its Extended plan gives customers pre-negotiated pay-as-you-go pricing, a single bill and no long-term commitments across the curated roster Noma sits in.

The Trust Center publishes six active certifications and gates the documents behind them. It lists SOC 2 Type II audited by EY, ISO 27001, HIPAA and ISO/IEC 42001, alongside 104 security controls.

The reports themselves stay behind a request. The portal records zero public documents and 31 available on request, so an evaluator sees which reports exist and asks Noma for the evidence.

Noma also gives security buyers a named counterpart. Its About page lists Diana Kelley as the company’s own chief information security officer.

Noma built its ecosystem story around AWS. AWS’s February 2026 announcement names Noma among the curated partner solutions in Security Hub Extended, a roster spanning endpoint, identity, email, network, data, browser, cloud, AI and security operations, and Noma’s blog states that it was named the AI Security partner for that plan.

Integrations reach beyond AWS. Noma says it is now available as a native guardrail at two points in the TrueFoundry stack, the AI Gateway that governs every request in and out of a model and the open-sourced Agent Harness that governs what an agent does once it acts.

The same ecosystem is the exposure. Microsoft Copilot Studio, Salesforce AgentForce, ServiceNow, AWS Bedrock and Databricks are environments Noma covers and each is run by the vendor that owns it, and Noma Labs has published a flaw in one of them, Salesforce Agentforce.

Niv Braun and Alon Tron founded Noma Security in 2023 after meeting in the IDF’s 8200 intelligence unit. Calcalist recorded 40 people at the Series B, and Gartner Peer Insights now lists a band of 51 to 200 employees.

Noma publishes a named executive team. The About page lists Ralph Pisani as chief revenue officer and Diana Kelley as chief information security officer.

Research is where the team’s public record is thickest. The Noma Labs index lists seven dated vulnerability disclosures between September 2025 and July 2026, credited to named researchers including Sasi Levi and Eli Ainhorn, and The Hacker News quotes Levi as Noma’s security research lead. The same index carries three general security research posts dated between July and August 2026, credited to Omer Holtzman, Ori Abargil and Gal Pnini.

The security executives Noma publishes are advisors rather than investors. Its About page groups Vijay Bolina of Google DeepMind, Caleb Sima of the CSA AI Security Alliance and Varun Badhwar of Endor Labs under a strategic advisors heading, while Calcalist names Evolution Equity Partners, Ballistic Ventures and Glilot Capital Partners as the investors in the round.