AI Agent Security Now Dominates Cybersecurity Seed Funding—Here’s Why That Should Worry You

Venture capital just confirmed what security leaders have been arguing internally for the better part of a year: agentic AI is now the single largest new attack surface enterprises have to defend, and the market is pricing it accordingly. According to DataTribe’s “Q2 2026 Insights” report, AI and agent security was the largest single category of cybersecurity seed-stage investment last quarter, accounting for roughly a quarter of all deals. Nearly every dollar in that category went toward securing agentic AI systems specifically, not the broader software stacks those agents run on top of.

That funding pattern is not a bet on hype. It is a direct response to a specific, measurable gap: autonomous AI agents that spin up their own sub-agents and hand off live credentials with no identity verification, no scoping, and no audit trail. DataTribe’s researchers found that roughly a quarter of deployed AI agents can do exactly this. An agent built to summarize a document or triage a ticket can, without a human in the loop, spawn a second agent and pass it working credentials—credentials that were never issued, scoped, or logged for that purpose.

The report also quantifies which control actually moves the needle. Scoping agent privileges down to least-privilege access cut security incident rates from more than two-thirds of deployments down to below 20%—the single largest risk reduction of any control DataTribe measured. That is not a marginal improvement; it is the difference between agentic AI being a controlled risk and an open door.

None of this happens in isolation. DataTribe’s report also cites CrowdStrike data putting the fastest 2026 breakout time—the gap between initial compromise and lateral movement—at 27 seconds, and Verizon’s 2025 Data Breach Investigations Report showing edge and VPN device exploitation rising sevenfold. Read together, the numbers describe an environment where attackers move faster than ever, through more entry points than ever, at the exact moment enterprises are handing new, under-governed identities—AI agents and their sub-agents—the keys to sensitive content. For any organization building an AI governance program on Kiteworks secure data exchange or evaluating how to close this gap, this report is worth reading closely.

Key Takeaways

1. Investors are chasing a real, quantified problem. AI and agent security captured roughly 25% of cybersecurity seed-stage deals in Q2 2026, the largest single category, because the underlying risk is now measurable rather than theoretical.
2. Sub-agents are the blind spot. Around a quarter of deployed AI agents can spawn sub-agents and hand them live credentials with no identity verification, scoping, or audit trail, creating identities no security team provisioned or is watching.
3. Least-privilege access is the highest-leverage control available. Scoping agent privileges cut incident rates from more than two-thirds down to below 20%, the largest risk reduction of any control measured in the report.
4. Attackers are faster than most detection stacks. CrowdStrike data cited in the report puts the fastest 2026 breakout time at 27 seconds from initial compromise to lateral movement.
5. Old vulnerabilities compound the new ones. Verizon’s 2025 DBIR data shows edge and VPN device exploitation rising sevenfold, widening the entry points attackers can use to reach ungoverned agent identities.

Why Investors Are Betting Big on AI Agent Security

Seed-stage investment is a leading indicator. Founders and the investors who back them are closest to the problems enterprises are about to face, and right now they are converging on one thesis: agentic AI has created an identity and access problem that existing security tooling was not built to handle. A quarter of all cybersecurity seed deals in a single quarter going toward one category is a significant concentration of capital, and it tells you where the smart money believes the next several years of enterprise security spend will go.

This is not the first AI security funding wave, but it is a more mature one. Earlier cycles funded AI-powered detection and AI-assisted SOC tooling—using AI to defend infrastructure. This cycle is funding something more specific: securing the AI agents themselves, and the non-human identities they create, as first-class assets that need governance in their own right. That distinction matters for how enterprises should be thinking about their own AI data governance programs. If venture capital is treating agent identity as a discrete risk category deserving dedicated tooling, internal security and compliance teams should be doing the same rather than folding it into a general “AI risk” line item.

The practical implication for CISOs and compliance leaders is that agentic AI security is no longer an emerging concern to monitor from a distance. It is being treated by the market as an active, well-defined risk category with its own economics, its own vendors, and—per DataTribe’s findings—its own quantifiable controls. Waiting for agentic AI governance tooling to mature before acting means absorbing incident risk in the meantime, at a moment when the report shows exactly how much that risk can be reduced.

The Sub-Agent Problem: Credentials Without Verification

The most striking finding in DataTribe’s report is not that AI agents pose risk in general—that has been well understood for some time—but the specific mechanism by which roughly a quarter of deployed agents introduce risk: unsupervised sub-agent creation paired with credential handoff.

Here is a representative, hypothetical example of what that looks like in practice. An enterprise deploys an AI agent to handle a defined task—drafting a contract summary, triaging a support queue, reconciling a spreadsheet. That agent, in the course of completing its task, determines it needs help and spins up a second, narrower agent to handle a sub-task. To let that sub-agent do its job, the parent agent passes along working credentials: an API key, a session token, a scoped or unscoped set of permissions to underlying systems and content. No human approves this handoff. No identity provider verifies who or what the sub-agent is. No audit log captures that the handoff happened at all.

The result is a non-human identity that did not exist an hour ago, was never provisioned through standard IAM processes, and now holds live access to sensitive content—invisible to the security team until something goes wrong. This is the practical, operational form of “shadow AI”: not employees quietly using unsanctioned chatbots, but sanctioned agents quietly creating unsanctioned sub-agents with real access.

Traditional access controls were built around the assumption that identities are provisioned deliberately, by a human, through a defined workflow. Sub-agent spawning breaks that assumption entirely. The identity that needs governing is created dynamically, at machine speed, often nested several layers deep, and it inherits whatever access the parent agent happened to hold at that moment—which is frequently broader than the sub-agent’s actual task requires.

Least-Privilege Access Cuts Incident Rates by Two-Thirds

If the sub-agent finding is the report’s most alarming data point, the least-privilege finding is its most actionable one. DataTribe found that scoping agent privileges to least-privilege access reduced security incident rates from more than two-thirds of deployments down to below 20%—the largest single risk reduction of any control the report measured.

That is a striking result because least-privilege access is not a novel concept. It is one of the oldest principles in security architecture, applied here to a genuinely new kind of identity. The finding validates something practitioners have long assumed but rarely had quantified at this scale: the control that matters most for agentic AI risk is not better detection or faster response, it is constraining what an agent—and any sub-agent it creates—is authorized to touch in the first place.

Applying least-privilege to agent identities in practice requires the ability to enforce RBAC and ABAC at the point where an agent actually requests content, not just at the perimeter of a system. Perimeter controls do not help when the agent is already inside the environment and the risk is what it does—and what it delegates—once it is there. Governance has to move to the request level: every time an agent or sub-agent asks for a specific file, record, or dataset, that request needs to be evaluated against defined policy, scoped appropriately, and logged.

This is precisely the boundary Kiteworks’ Secure MCP Server and Kiteworks Compliant AI are built to govern: per-request access decisions for both the humans and the agents interacting with sensitive content, under a single Kiteworks Control Plane rather than a patchwork of ad hoc permissions. Governance here is not something newly bolted onto agents that were previously ungoverned—it is the same content-access policy enforcement Kiteworks applies to human users, extended consistently to agent and sub-agent requests as well.

27 Seconds: How Fast Breakouts Have Become

DataTribe’s report situates the agent-identity findings inside a broader speed problem. CrowdStrike data cited in the report puts the fastest 2026 breakout time—the interval between initial compromise and lateral movement—at 27 seconds. That number should reframe how security teams think about response time as a control at all.

Twenty-seven seconds is not enough time for a human analyst to review an alert, confirm it is not a false positive, and initiate containment. It is barely enough time for automated response tooling to act, if that tooling is watching the right signal in the first place. When breakout speed compresses this far, the practical effect is that prevention and access scoping do the work that detection and response used to be relied on to do. If an over-privileged agent identity is compromised, a 27-second breakout window means the blast radius is set the instant that identity is granted access—not the instant someone notices something is wrong.

That reframes the sub-agent credential problem in starker terms. In an environment where breakout happens in under 30 seconds, an unscoped, unverified sub-agent credential is effectively a pre-positioned lateral movement path waiting for a trigger. The audit trail gap compounds this: if a compromised agent identity was never logged when it was created, security teams may not even know it exists until well after the damage from a fast breakout is done.

Edge and VPN Exploitation Sevenfold: The Old Risks Haven’t Gone Away

It would be a mistake to read DataTribe’s report as evidence that agentic AI has replaced traditional attack vectors. The report also cites Verizon’s 2025 Data Breach Investigations Report data showing edge and VPN device exploitation rising sevenfold—a reminder that the entry points attackers have relied on for years remain very much in play, and are getting worse.

The combination is the concerning part, not either trend in isolation. Edge devices and VPN concentrators are frequently the first foothold an attacker gains into a network; agent identities with broad, unscoped, unaudited access are increasingly what that attacker finds once inside. A sevenfold increase in edge and VPN exploitation means more attackers are getting past the perimeter. A quarter of deployed agents spawning ungoverned sub-agent credentials means more of what those attackers find, once past the perimeter, is unsecured. Combined with a 27-second breakout time, the picture is one where the old vulnerabilities get attackers in the door faster, and the new ones let them move through the building without anyone noticing.

Organizations that have invested heavily in zero trust architecture at the network layer but have not extended the same “never trust, always verify” discipline to agent and sub-agent identities are, in effect, only half done. Zero trust principles were designed to apply to every identity requesting access to a resource, human or otherwise. Agentic AI does not get a pass on that principle simply because it moves faster than the governance processes built around it.

How Kiteworks Governs Agent-to-Content Access

The findings in DataTribe’s report map closely onto the exact non-human-identity risk that Kiteworks secure data exchange is built to address: agents and sub-agents accessing, moving, and acting on sensitive content without verification, scoping, or a durable record of what happened.

Kiteworks’ Secure MCP Server and Kiteworks Compliant AI apply per-request RBAC and ABAC policy at the point where an agent—or a sub-agent it spawns—actually requests content, rather than relying on perimeter controls or static, one-time provisioning. Every request is evaluated against defined policy before access is granted, which directly addresses the scoping gap DataTribe identifies as the highest-leverage control available. Every request is also captured in a unified audit trail, so security and compliance teams have a single record of exactly which identity—human or agent—touched which content, when, and under what authorization, rather than a fragmented set of logs across disconnected systems.

This governance operates through the Kiteworks Control Plane as one consistent layer covering both human users and AI agents, not as separate policies bolted on after the fact. That consistency matters because the sub-agent problem DataTribe describes is fundamentally a governance-continuity problem: an agent’s access needs to be scoped correctly the moment it is created, and any sub-agent it spawns needs to inherit that same discipline automatically rather than defaulting to broad access because no one built a policy for it yet.

One scope limitation matters here. Kiteworks’ controls apply to agent identity and content-access governance specifically—the credential-handoff and scoping risk this report quantifies. They do not address the edge device or VPN exploitation findings the report cites from CrowdStrike and Verizon, which sit at the network perimeter rather than the content layer. Closing the full risk picture DataTribe describes requires both: perimeter controls to keep attackers from getting past the edge, and content-layer governance like Kiteworks secure content access to make sure that if an attacker does get in, ungoverned agent identities are not what they find waiting.

What This Means for Your AI Governance Roadmap

DataTribe’s Q2 2026 data gives security and compliance leaders a rare thing: a quantified prioritization signal for where to spend limited AI governance budget first. Least-privilege scoping of agent and sub-agent identities produced the largest measured incident reduction of any control in the report. That should move to the top of the list for any organization that has deployed, or is planning to deploy, AI agents against sensitive content—ahead of more general “AI policy” initiatives that do not touch the specific mechanism causing incidents.

Practically, that means a few things for teams building out their roadmap. First, inventory which deployed agents are capable of spawning sub-agents, and treat that capability as a distinct risk category requiring its own controls rather than assuming existing agent governance covers it. Second, require that any sub-agent creation event triggers identity verification and scoped credential issuance—not inherited, unscoped access from the parent agent—and that the event is logged. Third, evaluate whether your current data governance framework enforces policy at the point of content access for agent identities specifically, or only for human users, since DataTribe’s findings suggest that gap is exactly where incidents concentrate.

Finally, do not let the network-layer findings get lost in the agent-identity headlines. A sevenfold rise in edge and VPN exploitation combined with a 27-second breakout time means perimeter hardening and content-layer governance need to move together, on the same timeline, funded from the same budget conversation. Treating agentic AI security as purely a perimeter problem, or purely a content-governance problem, misses the compounding risk DataTribe’s report actually describes.

To learn more about governing AI agent and sub-agent access to sensitive content with per-request policy enforcement and unified audit logging, schedule a custom demo today.

Additional Resources

• Blog Post
  Zero‑Trust Strategies for Affordable AI Privacy Protection
• Blog Post
  How 77% of Organizations Are Failing at AI Data Security
• eBook
  AI Governance Gap: Why 91% of Small Companies Are Playing Russian Roulette with Data Security in 2025
• Blog Post
  There’s No “–dangerously-skip-permissions” for Your Data
• Blog Post
  Regulators Are Done Asking Whether You Have an AI Policy. They Want Proof It Works.