Reco's latest financing backs an ambitious proposition: enterprise agent security should follow relationships across applications, rather than stop at the model's input and output. A tool that can find an assistant, identify whose credentials it uses and trace what it can reach could expose authority that conventional inventories miss. Whether that map reliably leads to safer access is still the important unanswered question.
The company announced $55 million in additional funding on September 29, 2026, taking total capital raised to $140 million. That follows a $30 million Series B announced in February. The expansion arrives in a market where WitnessAI, Noma Security, identity and endpoint vendors, and software platforms are already competing to control overlapping parts of the same workflow.
Capital for distribution—and a wider product
The September funding announcement includes strategic investment from AT&T Ventures and backing from new investors Forestay and Quadrille Capital. Reco says the money supports sales, partnerships, channel development and customer support across North America and Europe. February's investors included Zeev Ventures, Insight Partners, Boldstart Ventures, Workday Ventures, TIAA Ventures, S Ventures and Quadrille Capital.
CEO and co-founder Ofer Klein told TechCrunch that valuation had more than doubled since February, describing it only as being in the high hundreds of millions of dollars. He said annual recurring revenue was in the double-digit millions and expected it to triple in 2026. That is an executive's forecast, not an independently verified result. He also reported more than 100 customers and financial services accounting for about 40% of the business.
AT&T is both a customer and an investor. That gives the financing a connection to enterprise use and potential distribution, but a customer's investment is not independent proof of broad demand or superior protection. Reco's work with ServiceNow similarly points toward enterprise workflow integration; partnerships alone do not measure security outcomes.
The product has expanded from SaaS visibility into agent security. At its June platform launch, Reco reported more than 230 application integrations and 1,000 detection controls. The October account describes the company advertising more than 280 integrations. These are dated company-reported coverage figures, not a comparison showing how deeply each connector observes or controls an agent.
Why relationships change the risk
An agent can read records, call tools, update an application or send messages under delegated authority. Permission to read email, search cloud files, edit customer records and send information may look reasonable when assessed separately. Combined in one workflow, those permissions can form a much more consequential access path.
Agents can arrive as standalone purchases, internal builds, browser extensions or features activated inside Salesforce, Microsoft 365 and Slack without a separate procurement decision. That weakens the assumption that a list of purchased applications tells security teams which systems can act. Ownership can become ambiguous, and service accounts or tokens may outlast the employee or project that created them.
Klein says Reco found 21,000 previously unknown agents at one Fortune 100 customer. The figure has not been independently technically validated. Its interpretation depends on the definition of an agent: embedded assistants, automations, workflows, integrations, production deployments, tests and abandoned configurations do not all carry the same risk.
He also described a financial-services customer where an agent created by a former employee could reportedly access Salesforce and share information with a domain outside the company's visibility. That example illustrates an ownership and decommissioning failure; it is not evidence that every customer has the same exposure. Revoking or transferring delegated access when owners leave is as important as finding the original deployment.
Reco's context graph is a continuously updated relationship map connecting people, accounts, agents, applications, permissions, data and observed activity. The company says direct application integrations, browser signals and network activity support discovery, while prompt and tool-call inspection can help administrators remove unnecessary access. The intended advantage is seeing not just that an agent exists, but how direct or indirect authority lets it reach another system.
Prompt attacks expose a control problem, not a promise of immunity
Prompt injection places hostile instructions in material an AI system reads. When the receiving agent can send email, change files or invoke APIs, a misleading instruction can become an operational action. Continuous agents can inspect thousands of records or repeat actions within minutes, leaving less response time than a human-paced process.
A large-scale research study analyzed 1.8 million prompt-injection attempts from a public competition and reported more than 60,000 successful attacks inducing policy violations, including unauthorized access, prohibited financial actions and compliance failures. These are research outcomes, not a Reco effectiveness benchmark or a production incident count.
A security layer cannot eliminate every failure in an underlying model. Restricting accessible resources and monitoring subsequent actions can nevertheless limit consequences. Least privilege means granting only what a task requires; applying it to adaptive software is difficult because the actions and context can change. Several individually acceptable tool calls can also combine into a harmful sequence, requiring correlation across time, tools, accounts and applications.
Inspection has limits of its own. Encrypted content, residency obligations and prohibitions on retaining sensitive prompts or document contents can constrain what a vendor sees. Financial-services customers may sharpen control requirements while also making implementation and sales review more complex. A relationship graph is not automatically a complete policy engine.
Competition makes connector depth more valuable than connector count
A gateway observes traffic through a control point. Embedded assistants, direct integrations and browser activity can operate outside that route, which supports Reco's cross-application argument. But the graph only works if integrations supply reliable information: missing applications, stale permissions, incomplete logs and unclear ownership can create a reassuring but misleading picture.
Reco says new integrations can be added within days. A connector that merely lists accounts is not equivalent to one exposing delegated authority, tool actions and unusual behavior. Breadth becomes useful when it supports detection and response across applications with different logs and permission models, including internally built agents with custom tools.
WitnessAI, which raised $58 million in strategic funding in January 2026, observes enterprise AI interactions and has expanded controls for agents, tools and Model Context Protocol servers. MCP connects AI systems with data and tools, adding permission and trust boundaries with each connection. Noma Security announced a $100 million Series B in July 2025 and positions controls across development, models, data, infrastructure, application use and runtime behavior.
CrowdStrike and other endpoint providers can observe device processes; identity vendors can extend non-human identity controls; cloud and SaaS platforms can enforce permissions around their own assistants. Microsoft, Salesforce, ServiceNow and Google already control important deployment surfaces. They bring distribution, telemetry and existing budgets, even if native controls lack complete cross-platform context.
This overlap can expand Reco's addressable budgets while complicating procurement ownership. Buyers may delay purchases or consolidate under an existing security provider. Reco needs to demonstrate a coordinating role or deeper coverage that remains valuable as native features improve, not simply use broader agent-security terminology.
The missing proof is safe, measurable remediation
False positives can bury security teams in ordinary workflows; false negatives can hide the most sensitive agent behind an incomplete connector or encrypted path. Useful evidence would define the discovery denominator, distinguish production from tests, disclose false-positive rates and show how many excessive permissions were actually removed. Revenue growth does not answer those questions.
Remediation must also avoid breaking work. A month-end reporting agent may legitimately need broad read access for a limited period. Blocking transmission of sensitive data to an unknown domain might be appropriate immediately, while a new internal request for more reading privileges may need human approval. Observation, recommendation, approval and enforcement should not be conflated.
Concrete evaluations could test: an agent retaining a departed employee's credentials, a support agent reaching restricted records through a connected knowledge system, and a malicious document redirecting tool use. Traces should identify the identity, resource, permission, response and containment time, rather than supply only an opaque risk score. Controlled adversarial tests can examine prompt injection, credential abuse, tool misuse and cross-application movement without claiming total protection.
Earlier development checks can flag excessive tool scopes, insecure credentials and missing approval gates; runtime monitoring covers behavior design-time tests miss. Auditable decommissioning must revoke or transfer tokens, service accounts, scripts and application connections. A platform can connect technical objects, but security, engineering, governance, legal and application owners must still agree who approves, monitors and responds.
Three developments will test the investment: deeper integration controls, independently verifiable customer outcomes such as faster investigation and containment, and a defensible place beside competing platforms. Reco is better financed to pursue that work. The unresolved distinction remains between a graph that visualizes agent sprawl and one that consistently enables safe action.
Related reading: engineering-document knowledge bases and access boundaries. Original coverage aggregation entry.