Willow

Security for AI also known as Webrix

Market readinessHow well the company can compete in its security market, scored across eight dimensions against public evidence. Emerging: Market readiness of 24 or below. Below the typical band, where few analyzed companies sit.
DefensibilityHow well the company holds its position if competitors catch up on features, scored across seven dimensions against public evidence. Contested: Defensibility of 13 to 14, the typical band, where a moat exists but is under pressure.
Founded 2024
Funding $7M
Last updated 2026-09-16

All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.

Executive Summary

Willow sells identity and access software for AI agents to security, IT and engineering teams in enterprises. It raised $7 million in seed funding led by Hetz Ventures. Its customers include Wix, Riskified, Innovid and Agora. Willow reports more than 300,000 weekly tool calls at Wix across roughly 5,000 weekly active users. Willow becomes harder to replace as customers configure agent credentials, action permissions and connections to their identity providers. It faces potential competition from identity vendors Okta and CyberArk, which have signaled interest in agent access.

Sourced Details

Description Identity and access platform for enterprise AI agents. Willow runs as a governed gateway that discovers the agents, tools, and MCP servers in use, issues each agent a scoped credential tied to a real user, and enforces runtime least-privilege with audit and containment. [f1]
Founded 2024 [f2]
HQ New York, New York, United States [f3]
Funding $7M total [f1]
Latest funding Seed, $7M (June 2026), led by Hetz Ventures [f4]

Products

Product What it does
Willow Governed access gateway for enterprise AI agents that discovers agents, tools, and MCP servers, issues each a scoped credential tied to a real user, and enforces runtime policy with audit.

Matrix Coverage

AI Defense Matrix

GovernIdentifyProtectDetectRespondRecover
AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain.
AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients.
AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD.
AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services.
AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes.
Training Data Datasets used for training, fine-tuning, and continued learning.
Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history.
AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools.

Willow discovers every AI agent, tool, and MCP server including unapproved ones, issues each agent a scoped credential tied to a real user with least-privilege, and logs and can contain agent activity. These capabilities are mapped to the AI Defense Matrix. [f5]

Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

Emerging 24 /40 Emerging: Market readiness of 24 or below. Below the typical band, where few analyzed companies sit.
Dimension Score Rationale
Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. 3/5 Willow targets security, IT and engineering teams that need agent governance and an audit trail, and identity vendors moving into agent access corroborate that the gap is real. The adoption and incident percentages that travel with the launch coverage are Willow's own data by Crypto Briefing's attribution, so the pain is quantified by the vendor rather than independently. [s1, s2, s10]
Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. 3/5 Willow documents the mechanics in detail: credentials scoped and time-bound per agent, permissions set at the level of the action inside each tool, discovery of unapproved tools, an organization-wide kill switch, and an integration that pulls Claude Platform activity into the same console. SecurityWeek describes the runtime enforcement independently. No third-party technical evaluation of these mechanisms appears in the captured record, and the G2 review page did not serve its text to a fetch. [s2, s3, s5, s8, s9]
Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. 3/5 Willow describes growing enterprise use of AI agents that reach internal systems. It published this account a year after launching as Webrix. Willow describes deployments at Wix, Innovid and Riskified. The adoption and incident percentages in the launch coverage are Willow's own data, and Okta and CyberArk signaling interest is a supplier move rather than a buyer one. No dated budget, procurement, or analyst-category signal from buyers appears in the captured record, so dated timing evidence absent from the reviewed sources is what the row rests on. [s10, s11, s5]
Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. 3/5 The three founders came from Wix. According to Willow, Shalev Shalit built the Wix AI Gateway and led Wix OS. Idan Chetrit worked at NSO and Kodem. Eyal Ben Ezra bootstrapped an ecommerce conversion platform to an eight-figure exit. Those specifics come from Willow itself. The captured press records only that the founders came from Wix, and carries no publication record or outside recognition for the team. [s7, s10, s11]
GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. 3/5 Willow names four customers on its own pages: Wix and Riskified in the Trusted-by strip, Innovid and Agora in testimonials, with Innovid and Riskified also described as running it. Willow publishes deployment numbers for Wix and for no other account: roughly 5,000 weekly active users, about 600 tools and MCP servers, and more than 300,000 governed tool calls a week. Those figures are Willow's own measurements, and Crypto Briefing relays the user count as reported rather than verified. [s1, s5, s10]
Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. 3/5 The 7 million dollar seed announced in June 2026 is modest for the stage and proportional to the motion, and the company ships a product running in production at a named customer with a free tier and an enterprise plan behind it. No revenue, margin, or growth-per-dollar figure appears in the captured record, so the efficiency itself stays unconfirmed. [s9, s5, s6]
Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. 3/5 SecurityWeek describes Willow as an identity and access platform for enterprise AI agents, and the MCP gateway category now holds an acquisition and incumbent entrants. No analyst note appears in the captured record. Willow distinguishes its offering from Cloudflare's MCP Portals as a different layer of the same problem. [s9, s3, s17]
Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. 3/5 Willow's gateway accumulates real absorption friction: per-agent credentials, action-level policies, identity-provider wiring, and a connector catalog, embedded at Wix across roughly 600 tools. The same layer is what platform owners are taking. Snowflake acquired the comparable MCP platform Natoma in June 2026, Cloudflare ships a competing portal, and Okta and CyberArk have signaled interest, so an incumbent could offer similar controls despite the customer work needed to replace Willow. [s5, s14, s17, s10]
Business Risks Willow publishes deployment numbers for Wix and for no other account, so the scale figures it leads with rest on a single customer…
  • Willow publishes deployment numbers for Wix and for no other account, so the scale figures it leads with rest on a single customer.
  • Okta, CyberArk, and Microsoft could ship agent identity and action-level tool permissions as part of a broader offering, which could reduce demand for a separate purchase.
  • Snowflake acquired Natoma, a comparable enterprise MCP platform, in June 2026, so a platform vendor can buy this layer rather than leave it to an independent supplier.
  • Willow publishes its connector catalog on a public marketplace page listing Model Context Protocol servers.
  • Willow raised 7 million dollars, so a better-funded rival could outspend it on go-to-market before Willow adds more accounts at the depth Wix reached.
  • Willow's gateway is the path agents use to reach tools, so an outage or added latency at Willow could stop agents from working.
Problem & Market Willow sells to security, IT and engineering teams in an organization where employees already point AI agents at internal systems. The company frames the problem as agents running without governance or an audit trail. Press coverage puts the same problem on the incumbents' roadmaps. Crypto Briefing reports that Okta and CyberArk have signaled interest in agent-related use cases and that their platforms were built for human identity first. The scale figures that travel with the launch coverage come from the company. Crypto Briefing attributes the 79 percent adoption figure and the 65 percent incident figure to Willow's data, while Calcalist prints the adoption numbers without naming who ran the survey…

Willow sells to security, IT and engineering teams in an organization where employees already point AI agents at internal systems. The company frames the problem as agents running without governance or an audit trail.

Press coverage puts the same problem on the incumbents' roadmaps. Crypto Briefing reports that Okta and CyberArk have signaled interest in agent-related use cases and that their platforms were built for human identity first. The scale figures that travel with the launch coverage come from the company. Crypto Briefing attributes the 79 percent adoption figure and the 65 percent incident figure to Willow's data, while Calcalist prints the adoption numbers without naming who ran the survey. [s1, s2, s10, s11]

Product Capabilities Willow describes issuing each agent a governed credential that is scoped, time-bound, and tied to a real user, then brokering that agent's access to enterprise tools. Agents inherit identity from the customer's existing provider, with native Okta, Entra ID, and JumpCloud support, and the identity page states that an agent gets only what its operator is entitled to. SecurityWeek describes the platform controlling which internal endpoints an agent can reach and enforcing least-privilege rules at runtime. Permissions apply to the action rather than the connection. The governance page uses GitHub as the worked example: not whether an agent can connect, but whether it can read code, write code, create branches, merge pull requests, or delete repositories. Willow verifies identity, serves approved tools and skills, enforces action-level policy and logs activity. It discovers approved and unapproved tools and flags shadow MCP deployments. An organization-wide switch revokes any agent or tool. Coverage widened after the launch. Willow published an integration with Claude's Compliance API that pulls Claude Platform usage, and conversation content on Claude Enterprise, into the same control plane. Buyers can run the platform as software as a service, on an EU-managed cluster, self-hosted, or air-gapped. The captured sources carry no third-party technical evaluation of any of this…

Willow describes issuing each agent a governed credential that is scoped, time-bound, and tied to a real user, then brokering that agent's access to enterprise tools. Agents inherit identity from the customer's existing provider, with native Okta, Entra ID, and JumpCloud support, and the identity page states that an agent gets only what its operator is entitled to. SecurityWeek describes the platform controlling which internal endpoints an agent can reach and enforcing least-privilege rules at runtime.

Permissions apply to the action rather than the connection. The governance page uses GitHub as the worked example: not whether an agent can connect, but whether it can read code, write code, create branches, merge pull requests, or delete repositories. Willow verifies identity, serves approved tools and skills, enforces action-level policy and logs activity. It discovers approved and unapproved tools and flags shadow MCP deployments. An organization-wide switch revokes any agent or tool.

Coverage widened after the launch. Willow published an integration with Claude's Compliance API that pulls Claude Platform usage, and conversation content on Claude Enterprise, into the same control plane. Buyers can run the platform as software as a service, on an EU-managed cluster, self-hosted, or air-gapped. The captured sources carry no third-party technical evaluation of any of this. [s2, s3, s5, s6, s8, s9]

Competitive Positioning Willow competes with other MCP gateway products and with the identity vendors moving into agent access. It publishes head-to-head comparison pages, and the one captured here argues Willow against Cloudflare's MCP Portals as different layers of the same problem. Its own rebrand post names the condition it sells into, that enterprises run Claude, GPT, Cursor, Codex, Gemini, and internal tools at once rather than one agent platform. That comparison page concedes ground on certification. Willow states there that Cloudflare has held ISO 27001 since 2019 and that Cloudflare for Government has held FedRAMP Moderate authorization since 2022, and that Willow holds SOC 2 Type II and GDPR with EU data residency and does not hold ISO 27001 today. A buyer whose procurement requires ISO 27001 reads that as a gap. The structural pressure is platform absorption, and it is now documented rather than predicted. The cited quarterly filing records the acquisition of Natoma, an enterprise Model Context Protocol platform for AI agents, on June 3, 2026. Crypto Briefing reports Okta and CyberArk signaling interest in agent-related access, and those vendors already serve the enterprise's human identity. Willow's answer is depth of embedding at a customer rather than a barrier those vendors cannot cross…

Willow competes with other MCP gateway products and with the identity vendors moving into agent access. It publishes head-to-head comparison pages, and the one captured here argues Willow against Cloudflare's MCP Portals as different layers of the same problem. Its own rebrand post names the condition it sells into, that enterprises run Claude, GPT, Cursor, Codex, Gemini, and internal tools at once rather than one agent platform.

That comparison page concedes ground on certification. Willow states there that Cloudflare has held ISO 27001 since 2019 and that Cloudflare for Government has held FedRAMP Moderate authorization since 2022, and that Willow holds SOC 2 Type II and GDPR with EU data residency and does not hold ISO 27001 today. A buyer whose procurement requires ISO 27001 reads that as a gap.

The structural pressure is platform absorption, and it is now documented rather than predicted. The cited quarterly filing records the acquisition of Natoma, an enterprise Model Context Protocol platform for AI agents, on June 3, 2026. Crypto Briefing reports Okta and CyberArk signaling interest in agent-related access, and those vendors already serve the enterprise's human identity. Willow's answer is depth of embedding at a customer rather than a barrier those vendors cannot cross. [s17, s4, s14, s10]

Go-to-Market & Traction Willow pairs a free entry point with an enterprise motion…

Willow pairs a free entry point with an enterprise motion. Willow lists a free allowance of up to 15 users and 15 integrations. Tool calls are unlimited. Willow lists identity-provider integration, action-level permissions, runtime guardrails, shadow AI discovery and SIEM log streaming. A team plan is available in the product for organizations under 250 seats.

Four customers are named on Willow's own pages. The homepage Trusted-by strip carries Wix and Riskified, testimonials name Innovid's SVP of software engineering and Agora's head of operations and compliance, and the blog states that Innovid governs developer machines around MCP and external-skill exposure and that Riskified runs Willow in production. Wix is the one deployment with published numbers: roughly 5,000 weekly active users, about 600 tools and MCP servers, and more than 300,000 governed tool calls a week. Willow says deployments are expanding into cyber security, real estate, fintech, and adtech.

Every one of those numbers is Willow's own measurement. Crypto Briefing repeats the Wix user count as reported rather than verified, and Wix chief executive Avishai Abrahami told Calcalist that thousands of Wix employees use AI agents every day. Willow's homepage displays a 4.9 out of 5 rating over 97 reviews, and the G2 page itself returned a bot challenge to a fetch.

Hetz Ventures led the 7 million dollar seed announced on June 4, 2026. Abrahami and Wix president Nir Zohar had made angel contributions before that round, and SecurityWeek records the funding as coming from Hetz Ventures and executives at Wix. [s6, s19, s1, s5, s10, s11, s9]

Team & Credibility According to Crypto Briefing, Eyal Ben Ezra is chief executive and Shalev Shalit is chief technology officer…

According to Crypto Briefing, Eyal Ben Ezra is chief executive and Shalev Shalit is chief technology officer. Idan Chetrit is VP Platform, and all three came from Wix, according to the same article. Calcalist describes two founders as former Wix executives. Willow's about page adds the specifics. Shalit built the Wix AI Gateway and led Wix OS. Chetrit worked as a developer at NSO and Kodem. Ben Ezra bootstrapped Conversion Bear, an ecommerce conversion platform. Willow describes an eight-figure exit within two years.

The strongest of those claims come from the company. The exit and the named prior builds appear on Willow's own about page, and the captured press coverage records only that the founders came from Wix. The captured sources carry no publication record, conference program, or industry recognition for the team. [s7, s10, s11]

Trust Readiness Willow states SOC 2 Type II and GDPR readiness…

Willow states SOC 2 Type II and GDPR readiness. It offers SaaS, an EU-managed cluster, self-hosted, on-premises and air-gapped deployments. SOC 2 Type II documentation is available on request. Its own Cloudflare comparison page states that Willow does not hold ISO 27001 today. The enterprise plan lists runtime guardrails and log streaming to the buyer's SIEM among the controls a security review asks for.

A trust-surface probe found trust.withwillow.ai, security.withwillow.ai, and the /trust and /security paths each returning HTTP 404 on 2026-09-16. That matters more here than for most products, because the platform holds the credentials agents use and the log of what they did. An enterprise reviewer has to ask Willow for the report. [s6, s17, s15, s1]

Competitors Aembit, Natoma, Astrix Security, Token Security, Keycard, Cloudflare, Okta, CyberArk…
Company Relationship Note Compare
Aembit competes with Competes for the same enterprise buyer Willow sells to, and is tracked in this catalog.
Natoma competes with Snowflake's quarterly filing describes Natoma, which Snowflake acquired in June 2026, as an enterprise Model Context Protocol platform for AI agents, the same layer Willow sells.
Astrix Security competes with Contests the same budget line Willow sells into, and is tracked in this catalog. N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable.
Token Security competes with Competes for the budget line Willow targets, and is tracked in this catalog. N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable.
Keycard competes with Competes for the same buyer, and is tracked in this catalog.
Cloudflare competes with Willow publishes a head-to-head comparison page against Cloudflare's MCP Portals, framing the two as different layers of the same problem.
Okta adjacent Crypto Briefing reports that Okta has signaled interest in agent-related use cases, which would put it alongside Willow at the same control point.
CyberArk adjacent Crypto Briefing reports that CyberArk has signaled interest in agent-related use cases, adjacent to the access layer Willow sells. N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable.

Add analyzed competitors to compare them side by side with Willow.

Strategy Deep Dive

A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.

Defensibility

Contested 13 /21 Contested: Defensibility of 13 to 14, the typical band, where a moat exists but is under pressure. reinforce or reposition

Willow sells identity and access software for AI agents to enterprise security, IT and engineering teams. The company describes its gateway as checking identity and permissions before allowing agent actions. Its software assigns agents credentials tied to people and enforces permissions for individual actions. Willow becomes harder to replace as customers configure these credentials, permissions and connections to their identity providers. Willow reports more than 300,000 weekly tool calls at customer Wix. It faces potential competition from identity vendors Okta and CyberArk, which have signaled interest in agent access.

Dimension Score Rationale
Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. 1/3 Willow sells software with SaaS and self-hosted deployment options. Its free plan requires no card. Willow sells agent access controls. The captured record describes no staffed service responsible for agent decisions.
Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. 2/3 Willow authenticates and authorizes agent actions through its gateway. It describes every agent action passing through one gateway, with per-agent credentials, action-level policies, and identity-provider wiring accumulated behind it, so leaving means re-pointing every agent and rewriting the policies elsewhere. The cited record does not size that migration. It reports deployment scope at Wix rather than any duration, party count, or complexity of leaving, and a conversion effort of unstated size is integration work.
Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. 1/3 Willow states SOC 2 Type II and GDPR readiness with EU data residency, and its own comparison page states it does not hold ISO 27001 today. A funded competitor can obtain that set through ordinary enterprise preparation. No cited source describes a mandate requiring a governed agent gateway.
Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. 3/3 The product authenticates and authorizes agent actions in line, at the level of individual operations inside each tool, across software as a service, EU-cluster, self-hosted, and air-gapped installs, with a polling integration into Claude's compliance logs. That is real-time distributed-systems work where a failure stops production agent access.
Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. 2/3 Willow names Wix, Riskified, Innovid and Agora as customers, and the captured record names no regulated buyer of this product. Enterprise features such as EU residency and air-gapped deployment point at that class, while the free self-serve plan and a team plan for organizations with fewer than 250 seats pull the other way, so the buyer mix sits between mid-market and enterprise.
Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. 3/3 Willow describes its run service as what every agent actually talks to, serving the approved tools and enforcing policy before an action executes rather than reporting on it afterwards. Agents in the Wix deployment reach roughly 600 tools and MCP servers through it, so the applications depend on it to function rather than treating it as an adjacent control.
Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. 1/3 No cited source names a retained asset. The connector catalog is the one candidate the record offers, and Willow publishes it as a marketplace listing of Model Context Protocol servers without describing anything it accumulates from operating them. The captured record names no dataset, no content licence, and no granted patent held by the company.
Strategic Market Segmentation Willow targets the organization standing up AI agents across whole departments rather than the developer wiring up one agent. Willow addresses security, IT and engineering teams. The buying trigger it describes is agents already running without governance or an audit trail. The named accounts fit that shape. Wix runs it across roughly 5,000 weekly active users in engineering, product, design, HR, finance, and legal. Riskified and Innovid are named as running it, Innovid on developer machines. Willow says deployments are expanding into cyber security, real estate, fintech, and adtech, which names sectors rather than accounts. The free plan widens the top of the funnel without changing the target. The free plan covers up to 15 users. Willow lists both a 15-integration allowance and an unlimited-integration entry on its pricing page. A team plan is available in the product for organizations with fewer than 250 seats. Willow lists identity-provider integration with SCIM, action-level permissions, runtime guardrails, shadow AI discovery and SIEM log streaming…

Willow targets the organization standing up AI agents across whole departments rather than the developer wiring up one agent. Willow addresses security, IT and engineering teams. The buying trigger it describes is agents already running without governance or an audit trail.

The named accounts fit that shape. Wix runs it across roughly 5,000 weekly active users in engineering, product, design, HR, finance, and legal. Riskified and Innovid are named as running it, Innovid on developer machines. Willow says deployments are expanding into cyber security, real estate, fintech, and adtech, which names sectors rather than accounts.

The free plan widens the top of the funnel without changing the target. The free plan covers up to 15 users. Willow lists both a 15-integration allowance and an unlimited-integration entry on its pricing page. A team plan is available in the product for organizations with fewer than 250 seats. Willow lists identity-provider integration with SCIM, action-level permissions, runtime guardrails, shadow AI discovery and SIEM log streaming.

Product Capabilities & AI Advantages Willow's claimed advantage is position…

Willow's claimed advantage is position. It describes every agent action passing through one gateway that checks who is asking, what that agent may touch, and whether to allow, block, or redact the call. Willow issues governed credentials that are scoped, time-bound and tied to a real user. Agents inherit their operator's permissions through integrations with Okta, Entra ID or JumpCloud. SecurityWeek describes runtime enforcement of least-privilege access.

The finer-grained claim is action-level permission. Willow's governance page distinguishes connecting to GitHub from reading code, writing code, creating branches, merging pull requests, and deleting repositories, with each action permitted or denied. Willow discovers approved and unapproved tools and flag shadow MCP deployments. An integration with Claude's Compliance API brings Claude Platform usage, and conversation content on Claude Enterprise, into the same console.

What holds up is the engineering and the position rather than a model or a dataset. Willow publishes its connector catalog on a public marketplace page listing Model Context Protocol servers, and the captured record names no proprietary model, no content licence, and no non-public corpus. Willow reports production use at Wix and Riskified, with more than 300,000 weekly tool calls at Wix.

Sales Engagement & Go-to-Market Willow runs a free-to-enterprise motion behind a short list of named accounts. The free plan is self-serve with no card, and a team plan appears in the product for organizations under 250 seats. Four customers appear on Willow's own pages. Willow names Wix and Riskified as customers. It publishes testimonials from Innovid's SVP of software engineering and Agora's head of operations and compliance. Willow describes Innovid governing developer machines around MCP and external-skill exposure, and Riskified using Willow in production. Wix carries the published numbers: roughly 5,000 weekly active users, about 600 tools and MCP servers, and more than 300,000 governed tool calls a week. All of them are Willow's own measurements, and Crypto Briefing relays the Wix user count as reported rather than verified. Wix chief executive Avishai Abrahami told Calcalist that thousands of Wix employees use AI agents every day. Abrahami and Wix president Nir Zohar made angel contributions to Willow before Hetz Ventures led the 7 million dollar seed…

Willow runs a free-to-enterprise motion behind a short list of named accounts. The free plan is self-serve with no card, and a team plan appears in the product for organizations under 250 seats.

Four customers appear on Willow's own pages. Willow names Wix and Riskified as customers. It publishes testimonials from Innovid's SVP of software engineering and Agora's head of operations and compliance. Willow describes Innovid governing developer machines around MCP and external-skill exposure, and Riskified using Willow in production. Wix carries the published numbers: roughly 5,000 weekly active users, about 600 tools and MCP servers, and more than 300,000 governed tool calls a week.

All of them are Willow's own measurements, and Crypto Briefing relays the Wix user count as reported rather than verified. Wix chief executive Avishai Abrahami told Calcalist that thousands of Wix employees use AI agents every day. Abrahami and Wix president Nir Zohar made angel contributions to Willow before Hetz Ventures led the 7 million dollar seed.

Pricing Model Willow publishes a price floor and quotes the rest…

Willow publishes a price floor and quotes the rest. Willow lists a free allowance of up to 15 users and 15 integrations. Tool calls are unlimited. Customers can start without a card or call. Willow also lists unlimited connected integrations in the pricing comparison. A team plan appears inside the product for organizations under 250 seats, and its price is not published.

The enterprise plan is where the security controls live, and it carries no published price. Willow lists identity-provider integration with SCIM, action-level permissions and runtime guardrails. Other listed features include shadow AI discovery and SIEM log streaming. It offers SaaS, EU-managed, self-hosted and air-gapped deployments. A buyer therefore sees the entry cost, then negotiates for the tier that carries the identity, permission, and audit controls a security review examines.

Product Delivery & Operations Willow sells software in several delivery modes rather than an analyst-staffed service. Buyers can run it as software as a service, on an EU-managed cluster, self-hosted in their own cloud, or on-premises and air-gapped. SecurityWeek describes SaaS, dedicated-cloud and self-hosted deployments, including air-gapped environments. The customer writes the policy in every mode, and no staffed layer takes accountability for what the agents do. The inline position raises the operational stakes. Willow describes every agent action passing through one gateway, and its run service as what every agent actually talks to, so its availability and latency decide whether agents can work. That is the exposure any network gateway carries, and it makes reliability a first-order question for a buyer putting agents into production. The captured pages do not specify uptime or incident-response commitments. Willow describes audit trails, and the captured pages state no uptime target and no incident-response terms…

Willow sells software in several delivery modes rather than an analyst-staffed service. Buyers can run it as software as a service, on an EU-managed cluster, self-hosted in their own cloud, or on-premises and air-gapped. SecurityWeek describes SaaS, dedicated-cloud and self-hosted deployments, including air-gapped environments. The customer writes the policy in every mode, and no staffed layer takes accountability for what the agents do.

The inline position raises the operational stakes. Willow describes every agent action passing through one gateway, and its run service as what every agent actually talks to, so its availability and latency decide whether agents can work. That is the exposure any network gateway carries, and it makes reliability a first-order question for a buyer putting agents into production.

The captured pages do not specify uptime or incident-response commitments. Willow describes audit trails, and the captured pages state no uptime target and no incident-response terms.

Earning Customers' Trust Willow states SOC 2 Type II and GDPR readiness…

Willow states SOC 2 Type II and GDPR readiness. Its pricing FAQ answers the deployment question with software as a service, an EU-managed cluster, self-hosted, and on-premises or air-gapped, and adds that SOC 2 Type II documentation is available on request. Its own Cloudflare comparison page states that Willow does not hold ISO 27001 today, which is a plain statement of where its certification stops.

A trust-surface probe found trust.withwillow.ai, security.withwillow.ai, and the /trust and /security paths each returning HTTP 404 on 2026-09-16. Willow offers SOC 2 Type II documentation on request.

That posture carries more weight here than for a product outside the access path. Willow issues governed credentials, enforces action-level permissions and logs agent actions. Customers can stream the logs to their SIEM. A security buyer reads the audit trail and the identity controls alongside the attestation.

Platform Strategy & Ecosystem Positioning Willow positions itself as the control plane underneath every agent platform rather than a control for one. Its rebrand post argues that enterprises run Claude, GPT, Cursor, Codex, Gemini, n8n, open-source models and internal tools at once. SecurityWeek describes an internal catalog of over 1,000 pre-built connectors, skills, and plugins. That position is the one platform owners are taking. Crypto Briefing reports Okta and CyberArk signaling interest in agent-related use cases, and those vendors already serve the enterprise's human identity. Willow publishes comparison pages against rival gateway products, and the one captured here argues Willow and Cloudflare's MCP Portals as different layers of the same problem while conceding that Cloudflare's certifications run deeper. A completed deal points the same way. The cited quarterly filing records the acquisition of Natoma, an enterprise Model Context Protocol platform for AI agents, on June 3, 2026. A data platform now owns a comparable layer outright. Replacing Willow could require customers to migrate agent credentials, permissions and identity-provider connections…

Willow positions itself as the control plane underneath every agent platform rather than a control for one. Its rebrand post argues that enterprises run Claude, GPT, Cursor, Codex, Gemini, n8n, open-source models and internal tools at once. SecurityWeek describes an internal catalog of over 1,000 pre-built connectors, skills, and plugins.

That position is the one platform owners are taking. Crypto Briefing reports Okta and CyberArk signaling interest in agent-related use cases, and those vendors already serve the enterprise's human identity. Willow publishes comparison pages against rival gateway products, and the one captured here argues Willow and Cloudflare's MCP Portals as different layers of the same problem while conceding that Cloudflare's certifications run deeper.

A completed deal points the same way. The cited quarterly filing records the acquisition of Natoma, an enterprise Model Context Protocol platform for AI agents, on June 3, 2026. A data platform now owns a comparable layer outright. Replacing Willow could require customers to migrate agent credentials, permissions and identity-provider connections.

Team & Execution Capability Willow's founders come from Wix…

Willow's founders come from Wix. Crypto Briefing names Eyal Ben Ezra as chief executive, Shalev Shalit as chief technology officer, and Idan Chetrit as VP Platform, and Calcalist describes the company as founded by two former Wix executives. After founding Willow the team deployed it at that former employer, where Willow reports roughly 5,000 weekly active users.

The about page adds specifics the press does not carry. Shalit built the Wix AI Gateway and led Wix OS. Chetrit worked as a developer at NSO and Kodem. Ben Ezra bootstrapped Conversion Bear, an ecommerce conversion platform. Willow describes an eight-figure exit within two years. Those claims come from Willow itself, and Calcalist describes two founders as former Wix executives.

Outside validation of the team runs through its backers. Wix co-founder Avishai Abrahami and Wix president Nir Zohar made angel contributions before Hetz Ventures led the seed, and SecurityWeek records the round as funded by Hetz Ventures and executives at Wix. The captured sources carry no publication record and no industry recognition for the founders.

Sources

Company Detail Sources (5)
Id Source Tier Accessed
f1 SecurityWeek on Willow identity and access platform for AI agents press 2026-09-16
f2 webrix.ai domain registration record (RDAP), registered 2024-05-04, earliest verifiable Willow (formerly Webrix) footprint regulatory 2026-07-06
f3 Willow company page on LinkedIn, Headquarters field official 2026-09-16
f4 Crypto Briefing on Willow seed round and investors press 2026-09-16
f5 AI Defense Matrix Catalog mapping other 2026-09-16
Profile Analysis Sources (19)
Id Source Tier Accessed
s1 Willow homepage: product overview, Trusted-by customer strip, and customer testimonials official 2026-09-16
s2 Willow Identity and Access product page official 2026-09-16
s3 Willow platform overview page official 2026-09-16
s4 Willow blog: Meet Willow (formerly Webrix) rebrand announcement official 2026-09-16
s5 Willow blog index carrying the launch announcement, the Wix case study, and the Claude Compliance API post official 2026-09-16
s6 Willow pricing page and pricing FAQ official 2026-09-16
s7 Willow about page with founder biographies official 2026-09-16
s8 Willow Governance and Compliance product page official 2026-09-16
s9 SecurityWeek: article on Willow raising 7 million dollars press 2026-09-16
s10 Crypto Briefing: article on Willow seed round, founders, and investors press 2026-09-16
s11 Calcalist: article on Willow seed round with a quote from Wix CEO Avishai Abrahami press 2026-09-16
s12 AI Defense Matrix Catalog: Willow product listing other 2026-09-16
s13 Willow marketplace connectors listing official 2026-09-16
s14 SEC EDGAR: Snowflake Inc. Form 10-Q for the quarterly period ended July 31, 2026 regulatory 2026-09-16
s17 Willow comparison page: Willow versus Cloudflare MCP Portals official 2026-09-16
s18 RDAP registration record for webrix.ai regulatory 2026-09-16
s19 Willow pricing page: free-plan seat threshold and the side-by-side plan comparison table official 2026-09-16
s15 Trust-surface probe: trust.withwillow.ai, security.withwillow.ai, and the /trust and /security paths each returned HTTP 404 (curl, 2026-09-16) other 2026-09-16
s16 Probe: three G2 page paths for Willow each returned an HTTP 403 bot-challenge interstitial and no review text (capture-extract, curl, proxy retry, 2026-09-16) other 2026-09-16
Deep-Dive Sources (19)
Id Source Tier Accessed
s1 Willow homepage: product overview, Trusted-by customer strip, and customer testimonials official 2026-09-16
s2 Willow Identity and Access product page official 2026-09-16
s3 Willow platform overview page official 2026-09-16
s4 Willow blog: Meet Willow (formerly Webrix) rebrand announcement official 2026-09-16
s5 Willow blog index carrying the launch announcement, the Wix case study, and the Claude Compliance API post official 2026-09-16
s6 Willow pricing page and pricing FAQ official 2026-09-16
s7 Willow about page with founder biographies official 2026-09-16
s8 Willow Governance and Compliance product page official 2026-09-16
s9 SecurityWeek: article on Willow raising 7 million dollars press 2026-09-16
s10 Crypto Briefing: article on Willow seed round, founders, and investors press 2026-09-16
s11 Calcalist: article on Willow seed round with a quote from Wix CEO Avishai Abrahami press 2026-09-16
s12 AI Defense Matrix Catalog: Willow product listing other 2026-09-16
s13 Willow marketplace connectors listing official 2026-09-16
s14 SEC EDGAR: Snowflake Inc. Form 10-Q for the quarterly period ended July 31, 2026 regulatory 2026-09-16
s17 Willow comparison page: Willow versus Cloudflare MCP Portals official 2026-09-16
s18 RDAP registration record for webrix.ai regulatory 2026-09-16
s19 Willow pricing page: free-plan seat threshold and the side-by-side plan comparison table official 2026-09-16
s15 Trust-surface probe: trust.withwillow.ai, security.withwillow.ai, and the /trust and /security paths each returned HTTP 404 (curl, 2026-09-16) other 2026-09-16
s16 Probe: three G2 page paths for Willow each returned an HTTP 403 bot-challenge interstitial and no review text (capture-extract, curl, proxy retry, 2026-09-16) other 2026-09-16

Disclaimer

This content is provided "as is" with no warranties.

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.