Pluto Security
by Pluto Security
AI workspace security: find, score and control the AI tools, skills and MCP servers employees use
Pluto Security is an AI workspace security platform that finds the AI tools, agents, skills, extensions and MCP servers employees use or build, scores their risk and enforces policy on the endpoint in real time. It is for CISOs whose staff are adopting Claude Code, Cursor, Lovable and similar tools faster than security can review them.
Pluto Security is an Israeli-American startup founded in 2025 by CEO Shahar Bahat (previously in cybersecurity leadership at Microsoft), Tal Ofer Regev (former VP of R&D at Palo Alto Networks) and Gil Maman (technical leadership in Israeli military intelligence). It came out of stealth in October 2026 with $42M raised: an $8.5M seed led by TLV Partners and a $34M Series A led by Jump Capital with Skinos, Shlomo Kramer's fund, and Ansa Capital. The product covers what Pluto calls the AI workspace: the AI tools employees use, the supply chain components plugged into them (skills, extensions, packages, MCP servers and models) and the apps, agents and automations employees build with them. Sensors are deployed through existing endpoint security and device management systems or directly on devices; they collect prompts, commands, running processes and permissions, and lightweight models running on the endpoint judge what an agent is trying to do. The platform has four modules: Explorer for discovery, Risk Radar for scoring findings against Pluto's own risk database, Space Shield for intent-based policy enforcement, and Marketspace, a catalog of vetted add-ons. Enforcement can stop an action mid-task, for example an agent requesting more permissions than the user intended, or inject context into the session so the agent asks for confirmation. Pluto also runs Plutonium, a free catalog launched in April 2026 that scores public skills, connectors and MCP servers. TechCrunch reported that sales began in April 2026, ARR passed $2M, and customers include Oscar Health, Workato, Sixt and AlphaSense; Pluto said 60% of the risks it detects sit in tools vibe-coded by non-developers, with finance teams the largest source.
A CISO or head of security operations at a company where employees outside engineering are building apps and agents with tools like Claude Code, Cursor, Lovable or n8n.
An inventory of every AI tool, skill and MCP server on company endpoints, with policies that block risky agent actions while the work is happening.
At a Glance
- Category
- Governance & Security
- Pricing
- Contact for pricing
- Target Market
- CISOs, Security Operations, IT Leaders, CIOs
- Deployment
- Cloud-first
- Founded
- 2025
- Team Size
- 11-50
- Customers
- 30+ (TechCrunch, October 2026); the company says 40+
Key Features
- ✓Explorer discovery
Finds AI tools, agents, skills, extensions and MCP servers on endpoints, including apps employees built themselves, so security has an inventory.
- ✓Risk Radar scoring
Scores each finding against Pluto's own risk database using publisher, configuration and data-access context, so teams triage the dangerous items first.
- ✓Space Shield enforcement
Applies intent-based policies in real time, blocking malicious skills or unsafe agent actions while letting ordinary work continue.
- ✓Session context injection
Injects instructions into a running agent session so the agent asks the user for confirmation before a risky step, instead of failing outright.
- ✓On-endpoint models
Lightweight models running on the device assess what an agent is attempting from prompts, commands, processes and permissions.
- ✓Plutonium catalog
A free public catalog with an MCP scanner that rates skills, connectors and MCP servers for risks like command execution and persistent tokens.
Use Cases
- •Shadow AI inventory
A security team deploys sensors through its existing device management and gets a list of every AI tool and MCP server employees run.
- •Catching malicious add-ons
Pluto says every proof of concept it ran found malicious skills or extension packages, some during live attacks, which policies can then block.
- •Exposed citizen-built apps
Pluto found an internet-exposed churn app holding customer data that a Fortune 500 finance employee had built with an AI tool.
- •Approval gates for agents
Security requires human approval before an agent calls a payments API, and quarantines MCP servers that are not on the trusted list.
Ideal For
Best For
- ✓Security teams that need to discover shadow AI tools and MCP servers across employee endpoints
- ✓Companies where finance, marketing or legal staff build their own apps with vibe-coding tools
- ✓Vetting third-party skills, extensions and MCP servers before employees install them
- ✓Enforcing approval steps on agent actions that touch payment APIs, credentials or sensitive data
- ✓Organizations rolling out Claude Code, Cursor or GitHub Copilot broadly and wanting runtime controls
Not Ideal For
- ✗Buyers who want a long customer track record, since Pluto began selling in April 2026 and has about 30 to 40 customers
- ✗Teams whose AI use is limited to sanctioned chat apps and who mainly need prompt or browser data loss prevention rather than endpoint agent control
- ✗Organizations that cannot deploy new endpoint sensors, since the product depends on them
- ✗Buyers who need published pricing, since Pluto sells only through demos
Deployment
Market & Ratings
30+ (TechCrunch, October 2026); the company says 40+
Market Analysis
Pros
- ✓Named customers including Oscar Health, Workato, Sixt and AlphaSense within months of starting sales
- ✓Can block or redirect an agent action during the session, not only report it
- ✓Lists SOC 2 Type 2 and ISO 27001
- ✓Free Plutonium catalog lets teams assess MCP servers and skills before buying anything
Cons
- ✗Very young: founded in 2025 and selling only since April 2026, with no G2, Capterra or Hacker News reviews
- ✗Customer, ARR and endpoint figures are company-reported, and they differ between TechCrunch (30+ customers, 40 staff) and the later press release (40+ customers, 50+ staff)
- ✗No independent data on detection coverage, false positives or enforcement latency
- ✗Requires deploying sensors on every endpoint, and pricing is not published
Pricing
Plutonium
$0
- ✓Public risk catalog for skills, connectors and MCP servers
- ✓MCP scanner
- ✓Safe-use guidance
Platform
Contact for pricing
- ✓Explorer, Risk Radar, Space Shield and Marketspace modules
- ✓Endpoint sensors
- ✓Real-time policy enforcement
The Plutonium catalog is free to use, but the platform itself has no public price list; the site offers only a demo booking. Expect enterprise contracts, likely scaled by endpoints, though Pluto has not published its metering.
Security & Compliance
Connect
Sources
This page was written from 7 sources, 5 on domains other than pluto.security.
- 1.pluto.security — pluto.securityvendor
- 2.pluto.security — gartner report for ai endpoint securityvendor
- 3.techcrunch.com — techcrunch.com
- 4.israeldefense.co.il — 71734
- 5.thenextweb.com — pluto security 42m ai workspace security stealth
- 6.unite.ai — pluto security 42m total funding ai workspace
- 7.theaiinsider.tech — pluto security emerges from stealth with 42m to secure enter
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
C1.ai (formerly ConductorOne)
Identity governance and MCP gateway that controls what people and AI agents can access
Apate.ai
AI voice and text agents that pose as scam victims to pull fraud intelligence out of live scam operations
Baselayer
Business identity, risk and fraud infrastructure that now verifies AI agents before they transact
SAS AI Navigator
SaaS AI governance inventory for models, agents and use cases, sold through Microsoft Marketplace