Pluto Security

• Netskope, Zscaler, or Palo Alto Networks could add agentless AI-builder discovery and guardrails to their secure-access platforms, collapsing the case for a standalone tool.
• Microsoft could extend its workspace governance tools to the AI coding assistants and no-code builders Pluto discovers.
• Pluto names no paying customers publicly, leaving a CISO-voted award and accelerator backing as its only public evidence of traction.
• Pluto discloses no funding amount, so a longer enterprise sales cycle could outrun a seed-stage balance sheet before named references accumulate.
• The AI workspace security category overlaps data-security posture, SaaS security, and AI governance, so buyers may fold the need into an existing budget line rather than buy a new tool.
• The Claude Enterprise integration is in private preview, so part of the platform's AI-assistant coverage is not yet generally available.

Pluto Security frames the problem as employees who are not engineers now building and shipping software with AI tools. Sales, marketing, HR, and finance staff use no-code builders, AI coding assistants, and agents to create apps and automations, often without security review. In a Forbes Israel interview, co-founder Shahar Bahat described AI-generated apps that reach production systems and sensitive data while secrets management, access control, and logging get skipped.

The buyer is the enterprise CISO caught between blocking AI adoption and losing control of it. Pluto positions itself as a third path that lets people build while security keeps oversight. The urgency is real to that buyer, since 160 CISOs and security executives voted Pluto the winner of an emerging-technology award at a 2026 industry summit, though the pain stays qualitative rather than independently quantified. [s6, s5, s3]

Pluto connects agentlessly to a customer's existing security and infrastructure systems to discover which AI builders are in use. The award writeup lists Claude Code, Cursor, v0, Lovable, Cowork, and n8n among them, together with the plugins, skills, IDEs, and MCP servers around them. Pluto then scores the risk of what it finds and enforces real-time guardrails on AI building activity.

The platform also reaches specific AI assistants through direct integrations. Pluto built a connector to Claude Enterprise using Anthropic's Compliance API so security teams can monitor that activity inside the workflows they already use. That integration is in private preview, so it is early rather than proven at scale.

The public detail is concrete but vendor-described. Pluto's product and blog pages explain the discovery, scoring, and guardrail functions, and its research team publishes findings such as a live malicious extension campaign on Open VSX. No independent technical evaluation or public documentation portal corroborates how well the platform performs. [s4, s9, s8]

Pluto competes in an emerging cluster of AI-usage and shadow-AI governance startups. Aurascape, WitnessAI, and Harmonic Security sell overlapping discovery, risk scoring, and control over how employees use and build with AI. Knostic works an adjacent slice, limiting what enterprise AI assistants reveal to each user.

Platform incumbents pose the structural threat, an analyst inference no cited source documents. Netskope, Zscaler, Palo Alto Networks, or Microsoft could add agentless AI-tool discovery and guardrails to their established platforms, contesting the control point Pluto wants.

Pluto's edge is being early and precise about what employees build with AI, plus the CISO recognition it has earned. That focus is a head start rather than a barrier a funded rival could not clear. Pluto holds the lead only while it stays ahead of incumbent release cycles. [s4, s3, s1]

Pluto's public proof is recognition rather than revenue. It won the inaugural Best Emerging Technology award at the 2026 Innovate Cybersecurity Summit, first place in a vote by 160 CISOs and security executives across a field of roughly ten startups. Pluto names no paying customers publicly.

Accelerator backing is the main indirect signal of momentum. Pluto belongs to the AWS, CrowdStrike, and NVIDIA accelerator programs, which vet and support early companies. It discloses no funding amount, so its scale and runway stay unverified. [s3, s2]

Co-founder and CEO Shahar Bahat gives Pluto a verifiable security background. She is a former Unit 8200 operator and was a product leader at Microsoft, where she saw teams told to move faster with generative AI. That experience is senior and in-domain, though the public record shows no prior exit or sustained recognition.

Pluto says its founders come from Unit 8200, Microsoft, and Palo Alto Networks. Yotam Perkal authors Pluto threat research such as the Open VSX extension campaign, a signal of active security research. No named exit or independent recognition lifts the team above competent and credible. [s5, s2, s8]

Pluto displays SOC 2 Type 2 and ISO 27001 badges on its site. The homepage footer carries an image badge labeled for both, and a trust center resolves at trust.pluto.security. Such self-displayed badges are procurement table stakes for an enterprise security buyer rather than a differentiator.

A careful buyer will still ask for more than the badges. The trust center hosts compliance materials behind a portal, so a buyer confirms the report scope through it. Because the platform reads AI activity across the workspace, it concentrates sensitive data, and buyers will press on retention and handling terms. [s10, s11, s1]

Add analyzed competitors to compare them side by side with Pluto Security.

Pluto sells to the security or compliance leader at an enterprise where staff build with AI. The pain is that non-engineers ship apps, agents, and automations to production using AI tools, outside the visibility and controls security relies on. Co-founder Shahar Bahat told Forbes Israel that these AI-generated apps reach production systems and sensitive data while secrets management, access control, and logging get skipped.

The segment is the enterprise whose CISO already feels the exposure. Pluto frames its pitch as letting people build while security keeps oversight, aimed at the buyer who cannot simply block AI adoption. The 160 CISOs and security executives behind its emerging-technology award are that audience, though Pluto discloses no named customer segments.

Pluto's claimed advantage is discovering AI building without agents. It connects to a customer's existing security and infrastructure systems to find which AI builders are in use, from Claude Code and Cursor to Lovable and n8n, along with the plugins, skills, IDEs, and MCP servers around them. It then scores the risk of what it finds and enforces guardrails on the building activity.

Pluto also reaches named AI assistants through direct integrations. It built a connector to Claude Enterprise through Anthropic's Compliance API, so security teams can monitor that use inside their existing workflows. The connector is in private preview, so it is a direction rather than a capability shipped at scale.

The depth on public pages is real but unverified from outside. Pluto documents the discovery, scoring, and guardrail functions and publishes threat research such as the Open VSX campaign its team tracked. No independent benchmark or documentation portal is public, so the performance claims stay unconfirmed.

Pluto's go-to-market proof is recognition ahead of disclosed revenue. It won an emerging-technology award at the 2026 Innovate Cybersecurity Summit, first in a vote by 160 CISOs and security executives across a field of roughly ten startups, on its first appearance at the event. Pluto names no paying customers publicly.

Pluto leans on ecosystem backing to reach buyers. It is part of the AWS, CrowdStrike, and NVIDIA accelerator programs, an ecosystem-credibility signal, though the reviewed sources do not document what introductions or pipeline those programs produce. It also publishes educational content on AI workspace and supply-chain security that reaches the audience it sells to.

Funding and scale stay undisclosed. Pluto publishes no round size and no revenue, so its runway and efficiency cannot be assessed from the reviewed sources. The award and accelerator ties are the strongest public signals of buyer interest.

Pluto publishes no pricing in the public record. There is no rate card and no stated unit of charge, which points toward sales-led contracting, though an undisclosed self-serve path cannot be ruled out. It also withholds the budget-anchoring signal some peers publish.

What Pluto charges by is not stated. The platform spans discovery, risk scoring, and guardrails across many AI tools, so seats, monitored tools, or covered environments are all plausible meters. The public pages leave the pricing model open.

Pluto describes an agentless platform that connects to a customer's existing security and infrastructure systems to see AI building activity. The reviewed sources do not document its hosting architecture or an endpoint-free footprint. Pluto pitches the agentless connection as lowering adoption cost, though the sources publish no implementation-effort evidence.

The operational surface is broad and fast-moving. Pluto tracks AI builders, coding assistants, agents, and their plugins and MCP servers, a set that changes as new tools appear. Keeping discovery current across that surface is continuous work rather than a one-time integration.

Watching AI building across the workspace hands the platform sensitive AI-activity context. Its Claude Enterprise integration ingests attachments and datasets connected to projects, so data-retention, uptime, and support terms matter to a careful buyer, who will look to Pluto's trust center for them.

Pluto shows SOC 2 Type 2 and ISO 27001 badges on its own site. The homepage footer carries an image badge labeled for both, and a trust center resolves at trust.pluto.security. For an enterprise buyer weighing a tool that reads AI activity, those self-displayed badges are expected procurement assurance rather than a differentiator.

The trust center hosts compliance materials behind a portal at trust.pluto.security. A buyer will still confirm the report scope, the data-retention terms, and how the platform handles the AI activity it reads.

Pluto positions itself as a control point for AI building across the workspace rather than a single-tool scanner. It discovers the AI builders, agents, and MCP servers in use, scores their risk, and enforces guardrails, so its pitch is coverage of the whole building surface rather than one tool.

The position is a sharp read of where risk is moving. As non-developers build and ship with AI, the workspace becomes the place to govern it, and Pluto aims to sit across that activity agentlessly. It extends that reach one connector at a time, as with Claude Enterprise.

The reviewed sources document no direct competitor, so the competitive read is an analyst inference rather than a sourced finding: the workspace control point Pluto wants is one a larger platform could also claim, and AI building can move to surfaces a central view does not cover.

CEO Shahar Bahat gives Pluto a verifiable security record. She is a former Unit 8200 operator and was a product leader at Microsoft, where she watched teams pushed to move faster with generative AI. That background is senior and in-domain, but the public record shows no prior exit or sustained recognition.

Pluto says its founders come from Unit 8200, Microsoft, and Palo Alto Networks. Yotam Perkal authors Pluto threat research such as the malicious Open VSX campaign it tracked, which signals active security research. That research is a general team signal rather than proof of depth in the company's own product category.

Diligence should probe technical depth beyond the CEO. Pluto publicly names its CEO and its research author, but the public record does not detail a broader engineering bench. A buyer betting on execution will want to see who builds the platform.