AI Agent Security Is Drawing a New M&A Map Around Enterprise Control Points

AI agents are moving into enterprise workflows where they can browse the web, write code, access files, trigger APIs and interact with internal systems. That shift creates productivity potential, but it also expands the security surface beyond users, devices and applications. The key takeaway: companies need to treat agents as software actors that can take actions and therefore require clear permissions, monitoring and governance.

The article argues that the market may not develop as one broad “AI security” category. Instead, opportunity is likely to form around specific control points such as agent identity, data access, prompts, MCP servers, plug-ins, traffic and auditability. For operators and investors, the practical question is not simply whether a company is in AI security, but what it directly controls.

Crunchbase News points to Kiteworks’ acquisition of Bonfy.AI, which focuses on real-time data classification and policy enforcement, as one example of activity around these areas. It also notes that Huskeys raised a $27 million Series A led by Blackstone and focuses on understanding and securing complex internet traffic, including traffic generated by autonomous systems. These examples suggest that agent security may split into specialized layers rather than consolidate immediately into a single category.

Identity providers may expand governance to autonomous agents, while data-security vendors may focus on what information agents can access. Cybersecurity platforms, cloud companies and enterprise software vendors may also need agent-security capabilities embedded into their products. For startups, the sharper positioning is likely to be around the exact security function they own, not the broader AI security label.