Summary

• Atlantic led the €2.66m pre-seed investment, with participation from D11Z Ventures and individual technology investors.
• Cygrid maps employees, service accounts and AI agents, applying policies to their access and subsequent actions.
• The company reports 20 design partners and more than 2,000 blocked risky actions, without publishing independent effectiveness measurements.

Berlin cybersecurity company Cygrid has secured €2.66 million to develop software that controls what artificial intelligence agents can do after receiving legitimate access to business systems, addressing the risk that an authorised application might disclose confidential information or perform actions outside its intended purpose.

The pre-seed financing was led by Atlantic, with participation from D11Z Ventures and investors including Boris Gorin, Andreas Bermig and Vlad Tropko. Cygrid emerged from stealth on 22 October, announcing plans to expand its enforcement technology, recruit additional employees and develop its commercial presence in Europe and other markets.

Founded in January 2026 by Dmitry Kharchenko and Dekel Paz, Cygrid is developing a platform that maps human users, service accounts, software integrations and AI agents into a consolidated identity model. It examines the permissions available to each identity and monitors the operations undertaken using those permissions.

The company’s approach reflects a problem arising as organisations connect AI assistants to email, document repositories, development environments and business applications. An automated system may possess valid credentials but still attempt an operation that is inappropriate for the task it was authorised to perform.

Conventional identity management remains essential for establishing who or what can connect to a service. Cygrid intends to add controls governing subsequent activity, rather than assuming that successful authentication establishes permission for every possible action.

Access rights extend beyond employees

Enterprise systems contain numerous identities that do not correspond directly to individual staff members. Applications exchange information through service accounts, automated workflows use stored credentials, and external software may receive delegated access to corporate information.

These arrangements allow organisations to integrate systems and automate routine work, but they can also leave permissions in place after the original purpose has changed. A token issued for one integration may remain active even when the application is no longer routinely used.

AI agents introduce further complexity because their actions may be selected dynamically in response to a task. An employee could authorise an assistant to examine documents or update customer records without anticipating every operation the software might subsequently attempt.

If an agent receives misleading instructions, encounters malicious material or is configured with unnecessarily broad permissions, it may attempt to retrieve or disclose information that the employee never intended to share.

Cygrid’s platform is designed to identify these relationships by combining information about identities, applications, credentials and observed behaviour. The resulting map is intended to show which resources can be reached and what activity occurs through each connection.

Its policy enforcement capabilities can then assess operations against defined restrictions. According to the company, the system can interrupt commands that exceed an agent’s authorised scope and revoke problematic credentials when they are identified.

Those controls differ from simply detecting an unusual login. A system might legitimately connect to a document repository but be prohibited from transferring particular files to an external application, making the requested operation relevant even when authentication succeeds.

Enforcement depends on integration

Cygrid describes controls operating before access is granted and during subsequent application activity. Its platform is intended to examine the context of requests and intervene when an operation falls outside an established policy.

For AI agents using external tools, this can involve evaluating the operation being requested rather than relying solely on permissions assigned when the agent was created. The approach is relevant to systems using the Model Context Protocol, which provides a standardised way for AI applications to interact with external resources and functions.

However, the technical ability to stop an action depends on where the security software operates and what information the connected application exposes. Monitoring an integration does not automatically provide control over every internal operation performed by a third-party service.

Customers would therefore need to establish which connections support direct enforcement, which provide monitoring only and what happens when a security decision cannot be completed.

The company claims it can block risky commands within milliseconds and revoke exposed credentials within seconds. These are supplier-reported performance characteristics, with no published independent benchmark establishing latency, reliability or coverage across different enterprise environments.

Speed also needs to be evaluated alongside accuracy. Blocking a legitimate operation may interrupt a business process, while permitting a prohibited action could expose sensitive information. Organisations need ways to investigate incorrect decisions, adjust policies and preserve records of automated interventions.

Where AI agents can modify financial records, change production information or communicate with customers, security restrictions should reflect the consequences of those activities. Different actions may require different approval procedures, including human authorisation before particularly sensitive operations proceed.

Early deployments provide limited evidence

Cygrid says it established 20 design partnerships during its initial months and prevented more than 2,000 risky identity actions. Named participants include Barfer’s and Horizn Studios, while its broader customer engagement spans financial technology, ecommerce and software businesses.

Design partnerships can provide access to operational environments and help a supplier improve its product, although they should not be equated automatically with recurring commercial contracts or successful large-scale deployments.

The reported prevention figure also lacks important context. A blocked event might involve an excessive permission, an unauthorised request or behaviour that a customer has chosen to restrict. Without information about the underlying severity, transaction volume and false positive rate, the figure cannot demonstrate how many actual attacks were prevented.

Investors have described the company’s approach as an answer to increasingly complex identity relationships, but the market already contains established providers of identity governance, privileged access management and cloud security.

Techopia previously examined RSA’s plans for AI agent identity and tool-level controls. Cygrid is pursuing related requirements through its own platform and a newly financed business, with its commercial differentiation still subject to customer evaluation.

Organisations adopting the software would need to compare its capabilities with existing access controls, including the cost of integrating additional monitoring and enforcement into their applications.

Cygrid’s financing gives it resources to develop those integrations and expand beyond its initial customers. Evidence of sustained effectiveness will depend on independently assessable performance, the ability to restrict harmful actions without interrupting legitimate work and reliable coverage across the services businesses actually use.