Finance Teams Drive Most AI Security Risks as Pluto Exits Stealth with $42M

Finance Desks Are the New Attack Surface

A finance employee at a Fortune 500 company built an application to track customer churn. The tool worked, handled sensitive data, and sat exposed to the public internet for an unknown period. No developer wrote it; no security review approved it. It emerged from what Pluto Security calls "vibe-coded" environments, where non-technical staff assemble AI-powered tools faster than IT teams can catalogue them.

That incident exemplifies a pattern Shahar Bahat has watched unfold since her startup began monitoring enterprise AI environments earlier this year. Finance departments generate the highest volume of AI-related security risks across Pluto's customer base, she said, outpacing marketing, legal, and even engineering teams. Roughly 60 per cent of the vulnerabilities the company detects originate outside traditional development organisations.

The velocity compounds the problem. Newly released AI tools appear inside corporate networks within two hours of public launch, Bahat noted. Security teams accustomed to vetting software through procurement cycles now face employees who can spin up agents, extensions, and connectors before IT knows they exist.

From Stealth to $2M ARR in Six Months

Pluto Security emerged from stealth on 13 October with $42 million in funding and a thesis that existing security software cannot adequately monitor AI agent behaviour. The company raised an $8.5 million seed round led by TLV Partners, with participation from the founders of cybersecurity firm Armis. A $34 million Series A followed, led by Jump Capital, with Skinos (the venture firm of Check Point co-founder Shlomo Kramer), Ansa Capital, and angel investors joining.

Bahat said Pluto began selling in April 2026 and has since surpassed $2 million in annual recurring revenue. The customer base includes more than 30 enterprises: Oscar Health, Workato, Sixt, and AlphaSense among them. The company operates with 40 employees across the United States and Israel.

That traction reflects a market where the attack surface has shifted. At Opentechwire, we've tracked how enterprises adopted large language models faster than any enterprise software category in the past decade. The security perimeter that once relied on network boundaries and application whitelists now contends with employees who create custom agents, install third-party skills, and link AI systems to internal databases without formal approval.

Real-Time Intervention in Agent Sessions

Pluto's architecture centres on monitoring what AI agents do during execution, not merely what tools employees install. The platform connects to endpoint security and device management systems, deploying sensors that collect data on prompts, commands, running processes, permissions, and user activity. Lightweight models run on endpoints to assess agent intent in real time.

The intervention capability distinguishes Pluto's approach. If an agent attempts to escalate permissions beyond a user's stated intent, the system can halt the action or inject instructions into the session that force the agent to request explicit confirmation. "We can inject context back to the session, and this way I can change how the agent is working," Bahat explained.

Traditional security software scans for known malware signatures, monitors network traffic, and enforces access controls. Those methods struggle when the threat vector is an employee-built agent that uses legitimate credentials to query a customer database, then inadvertently exposes that data through an unsecured API endpoint. The agent behaves as designed; the risk lies in what the designer didn't anticipate.

Bahat said Pluto has not conducted a single proof-of-concept evaluation that failed to uncover malicious activity. Some customers had active attacks in progress during initial scans. Extension packages and skills, often sourced from public repositories, frequently contain vulnerabilities or outright hostile code.

Plutonium as Lead Generation

Pluto's go-to-market strategy includes an unusual component. In April 2026, the company launched Plutonium, a free platform where security professionals can check risks associated with publicly available AI skills, connectors, and add-ons. The service includes an MCP (Model Context Protocol) scanner and a catalogue of verified components.

Thousands of security professionals now use Plutonium, according to Bahat, and the community has become both a feedback channel and a prospective customer pool. She said 70 per cent of Pluto's sales pipeline originates from inbound enquiries, though she did not specify how much flows directly from Plutonium users.

The freemium model serves a dual purpose. It builds brand recognition in a crowded AI security market while collecting telemetry on which components and extensions carry the most risk. That data, in aggregate, informs Pluto's detection logic and risk scoring.

A Market Built on CISO Anxiety

Pluto joins a cohort of AI-focused security startups that have raised significant capital over the past 18 months, all betting that enterprises will pay to close gaps their existing tools cannot address. The conviction rests on two premises: first, that AI adoption has outpaced security infrastructure; second, that agent behaviour requires a distinct monitoring approach from user behaviour.

Bahat framed the shift as a transition from tracking what employees do to tracking what autonomous or semi-autonomous agents do on their behalf. An employee might authorise an agent to "summarise this quarter's sales data," but the agent interprets that instruction, queries multiple systems, and synthesises results. If the agent has access to more data than the employee realised, or if a malicious extension intercepts the output, the employee may never know.

The risk profile varies by organisation, Bahat said, depending on how aggressively the company adopts AI and how proactive the chief information security officer is. But the vulnerabilities appear across industries and company sizes. Finance departments lead exposure not because they are less security-conscious, but because they move fastest to automate repetitive tasks: reconciliations, churn analysis, expense categorisation. Marketing and legal teams follow for similar reasons, building content generators, contract analysers, and research tools.

Developers rank fourth in Pluto's risk data, which inverts the traditional assumption that engineering teams introduce the most security incidents. The difference may lie in familiarity. Engineers understand code review, version control, and test environments. A finance analyst assembling an agent from pre-built components may not recognise that granting the agent write access to a shared drive creates a lateral movement path for an attacker.

Capital Allocation and Product Roadmap

Pluto plans to direct the new funding toward product development, security research, and US market expansion. The company has not disclosed revenue growth targets or a timeline for additional hiring, though Bahat indicated that expanding the US team is a priority.

The product roadmap will likely emphasise detection accuracy and reducing false positives, a perennial challenge in security software. If Pluto's system flags too many benign agent actions as risky, enterprises will tune down alerts or bypass controls, eroding the platform's effectiveness. The balance between intervention and usability will determine whether customers renew contracts after initial deployments.

The funding environment for AI security remains robust, even as venture capital has contracted in other categories. Investors appear willing to underwrite startups in this domain on the premise that every enterprise with an AI strategy will eventually need dedicated security tooling. Whether that translates to sustainable revenue depends on how quickly enterprises recognise the risks Bahat describes and whether they view those risks as urgent enough to justify new budget line items.

At Opentechwire, we've observed that security spending often lags incident response. Companies invest after a breach, not before. Pluto's challenge is to convince enterprises that the breach is already happening, even if it hasn't yet resulted in a headline.