Agentic AI Security Funding Hits $3.6B While M&A Reaches $96B

The money is moving toward AI agents

Securing autonomous AI agents has become one of the best-funded corners of cybersecurity. Venture-backed startups focused on agent security raised about $3.6 billion in 2026 12. Over the same period, consolidation across the broader security industry reached roughly $96 billion in M&A, and just three acquirers accounted for $72 billion of it 1.

Those figures show two trends running in parallel. Large incumbents are buying scale, and a newer group of specialists is raising large rounds on the bet that AI agents need their own security category. Meanwhile, free open-source tools are appearing that cover some of the same ground 2.

Who is raising, and how much

The capital is heavily concentrated. Cyera has raised more than $1.7 billion, close to half of the sector's total by itself 2. In a single week in September, Island and Cyera together raised over $800 million 2. Other companies in the commercial field include Reco, AIR Security, Zenity and Obsidian 2.

The two accounts describe the field's size differently. One frames the $3.6 billion as going to 10 startups building agentic AI defenses 1. The other describes Reco, AIR Security, Zenity and Obsidian as part of "dozens more" competing for the same budgets 2. The difference probably comes down to definitions. A narrow count includes only companies whose main product is agent security. A broader one includes data-security, identity and SaaS-security vendors that have repositioned around agents. Either way, the total is the same, and a small number of companies hold most of it.

The MCP gap

One figure is far smaller than the rest. Funding for security around the Model Context Protocol (MCP) totals about $40 million 1. MCP is the interface many agents use to connect to external tools and data. That amount is a small fraction of the $3.6 billion raised for agent security overall.

The gap suggests where investors think the money is right now. Most capital is going to identity, access and data governance, which enterprises already have budgets and buying processes for. The protocol layer, where an agent actually calls a tool, has attracted much less. That could mean investors see protocol-level security as early or likely to be commoditized. It could also mean an exposed area is underfunded.

Open source enters the picture

While the commercial vendors raise large rounds, open-source projects such as AgentGG and Beacon are offering agent-security capabilities for free 2. Even so, enterprises still appear willing to pay premium prices for tools that govern agent identity and access 2. Product and security teams planning budgets for agent tooling will need to watch that tension 2.

This follows a familiar pattern in security. Open-source tools usually spread quickly among practitioners. Commercial products win larger enterprise deals by offering support, compliance reporting and integration with existing identity systems. Open-source agent tools probably won't erase the venture-backed category. They may, however, push vendors to justify their pricing with more than basic detection.

A shared rulebook: OWASP's agentic Top 10

Both camps are increasingly working from the same framework. OWASP's Top 10 for Agentic Applications, numbered ASI01 through ASI10 and finalized in late 2025, is becoming the common reference for open-source and commercial tools alike 2. It defines risks such as goal hijacking, tool misuse and memory poisoning 2. These failure modes don't map neatly onto traditional application security, because the system under attack makes its own decisions and keeps state between tasks.

A common vocabulary matters for buyers. It lets organizations compare a free tool and a well-funded platform against the same list of threats. It also gives auditors and boards a benchmark that doesn't depend on any one vendor.

What it adds up to

The main point is not the $3.6 billion itself. It is that the money is concentrated in a few companies and a few layers of the stack. Incumbents are consolidating with deals worth tens of billions 1. A small set of startups, led by Cyera, has captured most venture funding 2. Protocol-level security remains comparatively thin 1.

For enterprises, this means a market with plenty of options but uneven coverage. Identity and data governance for agents is well funded and crowded. The tool-calling layer gets far less attention. The OWASP framework 2 is a reasonable way to check which risks each product actually addresses.

The gap between commercial and open-source tools may narrow as projects like AgentGG and Beacon mature. With this much capital already committed, though, the vendors are likely to keep expanding into neighboring categories, whether by building or acquiring, in the same way the larger acquirers have.