Zenity

• Microsoft could ship native posture and runtime protection for Copilot Studio and Power Platform agents, absorbing a major share of what Zenity protects today. The M12 investment gives Microsoft visibility without obligating restraint.
• Platform vendors collectively shipping first-party agent security within three to five years would narrow the cross-platform opening and leave Zenity competing on breadth alone.
• Named-customer proof could stall. If anonymized Fortune-tier testimonials do not convert into public references within a year, rivals with named customers gain the trust argument.
• Category label churn among AI agent governance, agentic AI security, and AI TRiSM could let larger security suites redefine the budget line around their own platforms.
• Heavily funded rivals could outspend Zenity's roughly $55 million of total funding on enterprise sales after analyst attention drew buyers to the category.

Enterprises are accumulating AI agents that employees build and adopt outside engineering review, and security teams cannot see them. Zenity frames the buyer as the security team that owns the risk of agents business users create, and its own Series B research put the scale at nearly 80,000 agents, apps, and automations in an average large enterprise, with over 62 percent carrying some security vulnerability. Those figures are the vendor's own research rather than an independent count.

Independent reporting establishes that the underlying problem is real. Zenity Labs research carried by The Register and CSO Online demonstrated attackers taking over enterprise AI agents on ChatGPT, Microsoft Copilot, Salesforce, and Google Gemini without a user click, which shows the exposure the product addresses exists across the major platforms rather than only in vendor marketing.

The problem predates the agent wave. Zenity started in 2021 on citizen development, where business users assemble Power Platform apps and automations without dedicated security review, and autonomous agents sharpen that exposure because they hold credentials, invoke tools, and act without a person approving each step. [s19, s3, s4, s12]

The Zenity platform ships three modules across buildtime and runtime. AI Observability discovers and inventories agents with ownership, permissions, and dependency context. AI Security Posture Management enforces guardrails on agent configuration, permissions, and integrations before agents run. AI Detection and Response monitors agent intent and execution paths at runtime, mapping decision paths, tool invocations, and memory updates to stop risky behavior.

The platform covers the services where enterprises build and run agents, including Microsoft Copilot Studio, Power Platform, Salesforce, AWS Bedrock, ChatGPT Enterprise, and ServiceNow. The original low-code line remains on sale, governing the Power Platform apps, automations, and flows that citizen developers build.

External validation comes from partners and analysts rather than a public documentation portal. ServiceNow embeds Zenity signals natively in its security operations product, AWS lists Zenity among the curated AI partner solutions in its Security Hub, and a 2026 Gartner report credits Zenity's agent-centric architecture and intent-aware detection. The reviewed public pages provide product descriptions rather than an independent benchmark, so buyers verify depth through these descriptions and the research record. [s7, s8, s9, s10, s15, s16, s17]

A 2026 Gartner report names Zenity the company to beat in AI agent governance, crediting its agent-centric architecture and intent-aware detection, and argues that its security research and contributions to OWASP risk lists and MITRE ATLAS create demand the company can then serve. That recognition reaches buyers through Zenity's own announcement of the report rather than independent analyst distribution.

Zenity faces two kinds of competition, cross-platform specialists and platform-native controls. Among specialists, Noma Security, Prompt Security, Lasso Security, and Lakera compete for the same enterprise AI-security budget, while WitnessAI and Knostic work adjacent ground in employee AI governance and access control. Platform owners press from the other side, since each could ship security controls for its own agent surfaces, and Zenity's answer is breadth, because a platform owner protects its own agents and has little reason to protect a rival's.

Zenity's citizen-development history extends its coverage to the Power Platform apps and flows that predate agents, which matters to buyers whose agent sprawl grew out of that earlier low-code wave. [s17, s12, s7]

Platform owners now distribute Zenity's controls. ServiceNow includes Zenity security signals natively in its security operations product under a partnership announced at the RSA Conference in 2026. AWS lists Zenity among the curated AI partner solutions in its Security Hub. Microsoft's venture arm M12 made a strategic investment ahead of the Series B.

Zenity presents its customer evidence in anonymized testimonials, and the reviewed sources name no customer.

Zenity raised $38 million in Series B funding in October 2024, co-led by Third Point Ventures and DTCP, which brought total funding to $55 million. No later raise appears in the reviewed sources, across a period in which its analyst standing and partner roster grew. [s18, s16, s17, s19, s1, s6]

Co-founders Ben Kliger, the CEO, and Michael Bargury, the CTO, started Zenity in Tel Aviv in 2021 and still run it. Michael's research record is the team's defining signal. He presented enterprise-copilot attack research at Black Hat 2024, which Dark Reading covered, and Zenity Labs returned to Black Hat USA 2025 with AgentFlayer, a set of zero-click exploit chains against ChatGPT, Microsoft Copilot Studio, Salesforce Einstein, and other platforms that CSO Online reported.

The research continued into 2026. At the RSA Conference, Michael demonstrated zero-click takeovers of Cursor, Salesforce, ChatGPT, Gemini, and Copilot agents, which The Register covered, and a 2026 Gartner report credits the company's contributions to OWASP risk lists and MITRE ATLAS. The sustained, independently covered research stream supports the capability story as well as the team's reputation, though public evidence of prior founder exits is absent. [s11, s2, s3, s4, s17, s1]

Zenity publishes a trust center that lists SOC 2 Type II, ISO 27001, and ISO 27701 compliance and GDPR adherence, with full reports available on request. OpenCorporates records the operating entity, ZENITY LTD, as an active private company registered in Israel.

The public posture is lighter than the product's sensitivity suggests. The platform holds inventories of customers' agents, their permissions, and their runtime behavior, so a regulated procurement team will likely ask for the underlying reports that the trust center provides only on request. [s13, s5, s6]

Add analyzed competitors to compare them side by side with Zenity.

Zenity sells to the security team accountable for AI agents that business users build and run outside engineering review, a buyer that emerged from the earlier low-code wave and sharpened as autonomous agents arrived. The platform frames the asset as the agent layer, where risk shifts from what a model produces to how an agent is configured and how its actions propagate at runtime.

The evidenced segment skews to the large enterprise. The customer proof on Zenity's own pages is anonymized large-enterprise references, and Zenity's own Series B research release frames the buyer as the enterprise holding nearly 80,000 agents, apps, and automations, with over 62 percent carrying a vulnerability. No named customer speaks publicly in the reviewed record.

The segmentation is deliberately cross-platform. Because Zenity secures agents at the agent layer across the surfaces where enterprises build them rather than one vendor's, it addresses enterprises across the platforms where they build agents, which widens the market but places it against both specialist rivals and each platform owner's native controls.

Zenity pairs three functions across the agent lifecycle. Observability discovers and inventories agents with ownership, permissions, and dependency context. Posture management enforces guardrails on configuration, permissions, and integrations before agents run. Detection and response monitors agents at runtime, and the company positions all three at the agent layer across buildtime configuration and runtime execution rather than at the model alone.

The runtime layer is the differentiated capability. Zenity describes its detection analyzing agent intent, execution paths, and behavior rather than individual events, mapping decision paths, tool invocations, and memory updates over time, the layer that prompt filtering and event-based detection miss.

Independent outlets have covered the lab's own demonstrations in the threat domain. Zenity Labs work reported by CSO Online and The Register demonstrated zero-click takeovers of enterprise agents on ChatGPT, Microsoft Copilot, Salesforce, and Google Gemini, press documentation of the team's demonstrated attacks, though not an independent test of the product's detection. The reviewed public pages provide product descriptions rather than an independent benchmark, so buyers verify depth through those descriptions and the research record.

Go-to-market runs on research credibility and platform partnerships rather than self-serve. Zenity's own lab generates demand by exposing zero-click exploit chains that take over enterprise AI agents, work independent outlets carry and that establishes the problem the product then sells against.

Platform owners now distribute the controls. ServiceNow's security operations product natively includes Zenity security signals and controls, AWS lists Zenity among the curated AI partner solutions in its Security Hub, and Zenity's own announcement quotes a 2026 Gartner report calling it the front-runner in AI agent governance, a partner and analyst profile unusual for the company's size and funding.

The gap is named-customer proof. Every traction figure in the record is an anonymized large-enterprise reference, and the reviewed record names no enterprise, so the visible demand depends on analyst standing and partner embeds rather than logos a buyer can call.

Zenity publishes no public price, and every product page routes to a demo request rather than a rate card, so cost is negotiated rather than self-serve, consistent with a vendor selling into large regulated enterprises through direct conversations.

The reviewed pages do not state a metering unit, so the basis of the bill is not publicly answerable from the fetched record. Because the platform inventories and governs an enterprise estate of agents, cost would plausibly track the number of agents or the size of the environment covered, but that is inference rather than a published unit.

The absence of a public price suits the named buyer and raises a barrier for smaller teams. A large enterprise folds the cost into a negotiated security agreement, while a smaller buyer has no transparent entry point.

Zenity governs agents through configuration and runtime monitoring. Posture management enforces guardrails on agent configuration, permissions, and integrations before agents run, and detection and response reads agent intent and execution paths once they act, spanning buildtime configuration and runtime execution.

Operations target prevention and continuous coverage. Posture management evaluates permissions, integrations, and constraints early to apply guardrails consistently, while the runtime layer watches execution paths to stop risky behavior before it reaches systems or data.

Partner integration extends the operational reach. ServiceNow's security operations product natively includes Zenity signals and controls so customers govern agents inside existing security operations processes, which embeds the platform in tooling enterprises already run rather than asking them to operate a standalone console.

Zenity's trust posture comes from named attestations, analyst standing, and a research record. Its trust center publishes SOC 2 Type II, ISO 27001, and ISO 27701 compliance and GDPR adherence, and states that full reports are available on request, the posture a buyer expects from a product that inventories agents, their permissions, and their runtime behavior. OpenCorporates records the operating entity, ZENITY LTD, as an active private company in Israel.

Partner and analyst signals reinforce it. Zenity's announcement quotes a 2026 Gartner report calling it the front-runner in agent governance, ServiceNow embedded its controls natively, and independent outlets covered the lab's exploit chains against major enterprise agents, evidence a buyer can weigh beyond vendor marketing alone.

The open trust gap is the depth of public attestation against the platform's sensitivity. The trust center lists the certifications but gates the full reports behind a request, so a regulated procurement team holding the platform to its data access will still ask for the underlying attestations the page provides only on request.

Zenity is built to be the cross-platform control plane for enterprise agents, and that neutrality is the strategic point. It secures agents at the agent layer across the surfaces where enterprises build them, so a buyer governs agents on many platforms from one place rather than relying on each owner's native controls.

Outward, the platform extends into partner environments, and the reviewed record documents no inward third-party ecosystem of its own. ServiceNow's security operations product natively includes Zenity signals and controls, turning an adjacent security platform into a distribution channel and placing Zenity's coverage inside workflows enterprises already operate.

Because the runtime layer observes agent behavior, execution paths, and tool calls across many customer environments, a cross-customer telemetry asset is a latent path the record does not yet evidence as built. Inward, the cross-platform stance is also the exposure, since each platform owner can ship native agent security for its own surface, and the most adjacent owner is Microsoft, whose Copilot surface Zenity protects.

Zenity is led by co-founder and chief executive Ben Kliger, who runs the company alongside Michael Bargury, the CTO and co-founder. The founding thesis grew from enterprise copilots and low-code development, where business users build powerful apps and agents faster than security can keep up.

Michael's research record is the team's defining signal. The lab disclosed zero-click exploit chains that take over enterprise AI agents, in-domain adversarial work covered by Dark Reading, CSO Online, and The Register across 2024 to 2026 rather than asserted on a page.

The research feeds both reputation and product. The same lineage that exposes how enterprise agents break supplies the credibility behind the platform that secures them, and the company's announcement quotes a 2026 Gartner report placing it at the front of agent governance, though public evidence of prior founder exits is absent.