AIR's $50 Million Bet That AI Agents Need Their Own Background Check
AIR just left stealth with $50 million to vet what enterprise AI agents are actually doing once they're live — and two Unit 8200 veterans think most companies have no idea.
In this article 5 sections
Quick answer: AIR, founded by two veterans of Israeli military intelligence, has raised $50 million in seed funding — $10 million from Sequoia Capital, then $40 million led by Greenoaks — to build software that continuously checks the skills and add-ons enterprise AI agents install for themselves. It already serves 20+ corporate clients, mostly in financial services and pharma.
Yair Saban keeps a specific number in his back pocket when he talks about why AIR exists: 27. That's roughly the percentage of AI agent skills — the plugins, connectors, and third-party add-ons agents pull in to do their jobs — that AIR's platform flags and blocks the first time a client turns it on. Not because the skill is malware. Usually it's something more mundane: an agent that quietly requests write access to a finance system when it only needed to read from it, or a connector nobody on the security team remembered approving.
Saban and his co-founder Niv Hoffman spent years inside Unit 8200, the Israeli intelligence corps that has produced a disproportionate share of the country's cybersecurity founders, before building AIR. Protocol Wire's take: the pitch is straightforward once you hear it. Companies spent the last decade building identity and access management around human logins: who can see what, who can touch what. Now they're handing that same level of system access to autonomous agents with almost none of the same scrutiny. AIR wants to be the layer that closes that gap, and investors just backed that bet with real money. The company left stealth on September 1 with $50 million raised across two seed rounds, split between a $10 million check from Sequoia Capital and a $40 million follow-on led by Greenoaks Capital.
What Does AIR Actually Check?
Strip away the funding numbers and AIR's product is a fairly literal answer to a question most security teams haven't had to ask before: what is this agent actually allowed to do, and does what it's doing right now match that? The platform starts by discovering every agent running inside a company's environment — not just the ones IT approved, but the ones a product team spun up in a weekend using an internal framework nobody logged. From there, it continuously vets the skills and add-ons each agent pulls in, the way a mobile app store screens plugins before they ship, except AIR is doing it after the fact, in production, against agents that keep updating their own behavior.
That last part is what makes this different from a one-time security review. An agent's permissions aren't fixed the way a human employee's role usually is. It can request a new connector, chain a new skill into a workflow, or start pulling data from a system nobody scoped it for — all without a ticket, a manager sign-off, or a change-management meeting. AIR's pitch is that this is exactly the kind of drift a static audit will always miss, the same quiet drift that keeps most enterprise agent pilots from ever reaching production in the first place.
Saban is blunt that this isn't theoretical. In AIR's own numbers, the platform filters out roughly a quarter of the skills and add-ons it first evaluates at a new client — not because they're malicious, but because they ask for more access than the job requires. That's the boring, unglamorous version of an AI security story: not a dramatic hack, just permission creep at machine speed.
Two Founders, One Unit 8200 Instinct
Saban and Hoffman built their working relationship inside Unit 8200 long before AIR existed, and it shows in how deliberately they moved before going public. The company didn't launch with a product announcement and a waitlist — it launched with a customer base, two closed funding rounds, and a specific list of industries willing to talk on the record about why they signed on early.
That sequencing matters more than it sounds like it should. A lot of AI security startups over the past two years have shipped a demo, raised a headline round off the demo, and then spent the following year building the product the demo implied. AIR did the opposite: the $10 million from Sequoia funded the early build, and the $40 million behind it — led by Greenoaks, with participation from enterprise security founders and angel investors — came after the company had something regulated customers were already paying to use. For two founders whose entire professional background is assessing whether a system's claims match its actual behavior, that order isn't an accident.
It's also, frankly, a good story to tell limited partners. A security founder who spent a career vetting real threats has a different credibility bar than one who spent it building demos, and Saban and Hoffman have leaned into that distinction rather than downplaying their intelligence-corps background the way some founders do.
Why Financial Services and Pharma Called First
Protocol Wire asked why AIR's early adoption skews so heavily toward banks and drugmakers, and the answer isn't complicated: those are the two industries where an AI agent overstepping its access isn't just an IT headache, it's a call to legal. A bank's agent quietly reading a customer record it wasn't scoped for is a compliance incident. A pharma company's agent pulling from a clinical dataset outside its approved use is potentially a regulatory one. Both sectors already run structured vendor and access reviews for human employees; AIR is essentially selling them the same discipline, applied to software that increasingly acts like one.
More than 20 corporate clients have signed on so far, according to the company. Saban has said the earliest and most demanding customers came from exactly these two sectors. Their compliance teams ask AIR's own engineers pointed questions about how the detection actually works, not just what the dashboard looks like. That's a different sales motion than most consumer-facing AI tools go through, and it's part of why AIR chose to build in relative quiet for as long as it did.
It's also a useful signal for anyone reading this outside financial services. If the industries with the most mature risk functions are the first ones willing to pay for agent oversight, that's a reasonable indicator. It shows where the rest of the enterprise market is headed over the next 18 months, not just where the early-adopter budget happens to sit today.
The Bigger Bet: Betting Against the Hype
Here's the part of AIR's pitch worth being skeptical about, and to their credit, Saban doesn't dodge it: the company is betting that a large share of the agentic AI market currently being sold to enterprises is going to disappoint. Gartner's own research puts a number on that — more than 40% of agentic AI projects canceled by the end of 2027, driven by unclear ROI, escalating costs, and risk controls that were never built for autonomous software in the first place. Gartner has also estimated that only a few hundred of the thousands of vendors currently calling themselves agentic AI companies are doing anything that actually earns the label.
That's the market AIR is selling into, and it cuts both ways. A wave of failed agent pilots is bad news for the vendors selling the agents themselves, including the coding agents increasingly exposed to a widening attack surface. But it's arguably good news for a company selling the oversight layer that catches problems before they turn into a canceled contract. If AIR's bet is right, it isn't really competing with the agent vendors at all; it's closer to the insurance policy that makes the whole category survivable for the enterprises buying it.
The harder question is whether "vet the agents other people are selling you" is a durable business on its own. It could instead become a feature absorbed into whatever platform wins the enterprise agent market outright, the same way plenty of point-solution security categories eventually get folded into a bigger suite. Saban's answer, unsurprisingly, is that vetting has to stay independent of the vendors being vetted, the same logic that's kept identity and access management a standalone category even as other parts of security consolidated. Whether enterprise buyers agree with that over the next few funding cycles, as agent ecosystems keep opening up through moves like OpenAI's own public Agents API, is the real test of whether $50 million was a smart entry price or just an early one.
Conclusion
AIR's raise is a small number by 2026's AI funding standards — a rounding error next to the nine- and ten-figure rounds going to frontier labs this year — but it's a useful data point regardless, and one Protocol Wire will keep tracking as the agent-security category matures. It says two things about where enterprise AI spending is actually going: buyers are willing to pay for oversight before a bad incident forces their hand, and the founders best positioned to sell that oversight are the ones who spent their careers finding gaps other people missed. Whether AIR stays independent or gets folded into a bigger platform in three years, the underlying problem it's solving — agents nobody's fully watching — isn't going away on its own.
