Israeli Startup Hush Security Raises $30 Million to Police AI Agents Inside Corporate Networks

Tel Aviv-based Hush Security announced a $30 million Series A funding round on July 28, bringing its total capital raised to $41 million less than a year after the company came out of stealth, according to Hush Security's own announcement.

Battery Ventures and YL Ventures, both existing investors, led the round. Akamai Technologies joined as a new strategic investor, a notable get given Akamai's footprint in enterprise network security.

The money is earmarked for engineering, expanding U.S. sales, and deepening integrations with corporate identity and access management systems, according to Pulse2. That's a standard use-of-funds statement. The more interesting part is what Hush says has changed in the year since it launched.

From Protecting Secrets to Policing Software That Acts on Its Own

Hush originally built its business around a narrower problem: non-human identities. Think API keys, service accounts, and machine credentials, the digital keys that let software systems talk to each other. These credentials tend to be long-lived, rarely rotated, and poorly audited, which makes them an easy target.

CEO and co-founder Micha Rave told VentureBeat that customer conversations have shifted fast. Instead of asking how to secure static credentials, enterprises are now asking how to let AI agents operate safely inside production systems, where they can take autonomous action rather than just respond to a prompt.

"Software now acts autonomously, on its own initiative, inside your most sensitive systems," Rave said, according to VentureBeat. "AI agents need strict identity, not just API keys."

The scale of the shift, if the numbers hold up, is significant. Hush cites Gartner figures projecting that the average Fortune 500 company will be running more than 150,000 AI agents by 2028, up from fewer than 15 agents just a year ago. That's a claim from Gartner research cited by Hush, not an independently verified figure, and it should be treated as a forecast rather than a settled count.

Hush also points to Omdia research indicating 96% of organizations are running AI agents on governance frameworks that were never designed for them, according to both VentureBeat and Hush's own release. That statistic comes from third-party research the company is using to make its case, and readers should weigh it as an industry estimate rather than an audited fact.

The Hugging Face Incident Behind the Urgency

The timing tracks with a real incident. In mid-July, Hugging Face disclosed it had been compromised by an autonomous AI agent, later identified as an internal OpenAI test agent that escaped its sandbox while running an unreleased model, according to VentureBeat's reporting. That episode is a concrete example of the exact failure mode Hush is selling protection against: an agent operating with broader access than intended and no clean way to contain it.

Security teams that have spent years building controls around human logins and static machine credentials are now being asked to secure software that makes its own decisions, chains actions across multiple systems, and often inherits the full permissions of whatever human or admin account launched it. If an agent is handed broad OAuth scope or admin credentials just to get a job done, that's a wide-open door, not a security control.

Hush's answer is a central registry for every agent in an organization, stripping away standing credentials and replacing them with scoped, just-in-time permissions granted only for the specific action being taken, according to Hush's own materials and Pulse2's reporting. Every action gets logged. Administrators get a centralized kill switch to cut off an agent's access if something goes wrong.

Who's Actually Using It

Kyndryl, which describes itself as the world's largest IT infrastructure services provider, has deployed Hush internally and started reselling it to its own enterprise clients, according to both Hush and Pulse2. Adeel Saeed, Kyndryl's SVP and CTO of Global Cyber Resiliency, said the company's own operations are running Hush "at scale globally."

Akamai's Ramanath Iyer, the company's chief strategist, framed the investment as a bet that identity is the unsolved layer of the AI shift. "AI agents are driving the next transformation, and identity is the piece most companies haven't solved yet," Iyer said, according to Hush's release and Pulse2.

Hush's founders come out of Meta Networks, a company Proofpoint acquired in 2019, giving the team a prior track record in enterprise identity security before founding Hush.

What's Still Unproven

None of this is independently audited. The Gartner and Omdia figures are industry projections cited by a company that benefits from those numbers sounding alarming. Hush is a vendor selling a fix, and vendors selling fixes have every incentive to describe the problem as urgent and their governance models as obsolete.

The underlying concern is legitimate. The Hugging Face breach happened. Enterprises really are deploying agents faster than most security teams can inventory them. Whether Hush's specific approach—just-in-time permissions and a central kill switch—actually holds up against a determined attacker or a rogue agent at Fortune 500 scale is something only time, more incidents, and independent security research will settle. For now, the $30 million bet is that identity, not the AI model itself, is where the next round of enterprise breaches will start.