The Brief 48
The category got
a price. Yours wasn’t
the invoice.
Over seventy-two hours, seven vendors shipped agent authority controls, one raised $113 million to build the control layer, and a managed detection provider began underwriting incident costs on its own balance sheet. The authority gap is no longer a thesis anyone needs convincing of. It is a market with an entry price — and the fastest dollars in it are not on the CISO side of the table.
The window for owning “authority at execution” as a novel idea closed this week. Zero Networks, Varonis, Cyera, Sweet Security and SentinelOne all now describe products in the language of scoped agent authority. What none of them ship is a cryptographic, portable authority chain that survives delegation across systems — and no one at all is selling underwriters the control taxonomy they need to price the exclusion Verisk is currently drafting.
The near-term revenue is in the second gap, not the first. Underwriters have a pricing problem today, no vendor is solving it, and rating factors are bought at higher margin and shorter cycle than security tooling.
Onyx Security raised $113 million to build the control layer
Category pricingOn 29 July, Onyx Security announced a $113 million Series B led by Bessemer Venture Partners, with Cyberstarts, TCV, Conviction, FirstMark, Vintage, QuantumLight and G Squared participating. Total raised is $153 million in two years. Reported valuation: approximately $640 million.
Hila Zigman of Cyberstarts framed Onyx as the control layer that makes enterprise AI adoption possible at scale, and predicted the category will be among the defining security categories of the decade. That is a general partner at a top-tier cyber fund describing the authority gap in Bessemer’s language, backed by $113 million.
Read this two ways. It is thesis validation of the strongest possible kind — the market has now put a nine-figure number on the problem SoftwareArmor named first. It is also a compression of the window. Onyx will spend that money on go-to-market, which means the category vocabulary will be defined by whoever buys the most attention over the next four quarters.
Onyx observes and intervenes on agent behavior using its own models. That is behavioral inference — a probabilistic judgment about whether an action looks wrong. It is not a deterministic check of whether an action is permitted under a delegation the enterprise issued and can revoke.
The distinction matters at claim time and at deposition. “Our model judged the behavior anomalous” is a different evidentiary artifact than “the directive failed cryptographic authority validation against an active delegation, and the denial is signed.”
Seven vendors shipped agent authority controls in seventy-two hours
CompetitiveBlack Hat USA opened yesterday in Las Vegas. The pre-show and Monday announcement wave is the clearest picture yet of where the category is consolidating. Of 121 briefings on the program, 35 concern AI security, AI red teaming, or LLM-assisted offensive work.
Set alongside these, BeyondTrust’s Phantom Labs Research Index — released the same week — found that 75 percent of attacks over the past year involved an identity or privilege issue, with credential exposure, privilege escalation and identity misconfiguration leading. The report notes these compounded rather than appearing in isolation, with standing privilege and escalation frequently occurring together.
Standing privilege plus escalation is the authority gap stated in incident-response language. The empirical spine of the thesis is now someone else’s published research.
Portability. Every one of these controls lives inside a vendor’s own plane — Varonis inside Atlas, Cyera across its own agents, SentinelOne inside Singularity. An authority granted in one does not travel to another. An enterprise running agents across Palantir, Microsoft, AWS and internal orchestration gets seven partial authority models and no consolidated answer.
Chain validation. Varonis compares an agent’s actions against its assigned task. Zero Networks constrains a single agent’s reachable systems. Neither validates a recursive authority chain — agent A delegating to agent B delegating to tool C — where each hop is individually plausible and the composition is not authorized.
Cryptographic evidence. “Flag or block based on adjustable sensitivity” is a tuning parameter. It is not a signed, non-repudiable record of what authority existed at the moment of execution. That distinction is invisible in a product demo and decisive in discovery.
Those three are Claims 5 and 6 of the 28 March provisional. They are also the only defensible ground left.
Arctic Wolf put $3 million of its own balance sheet behind the problem
Highest-leverageArctic Wolf launched a Cyber Resilience offering bundling managed detection and response, attack surface and vulnerability management, endpoint defense and awareness training. Customers on the bundle become eligible for the company’s security operations warranty, which covers up to $3 million in costs tied to a security incident.
A warranty is an insurance-shaped instrument written by a party that is not an insurer. It has a trigger, a scope, and — necessarily — a set of things it does not pay for. Every warranty in cybersecurity has been written against a threat model where an unauthorized party obtains access illegitimately.
An agent incident fails that model at every clause. The agent held valid credentials. The agent was authorized to invoke the tool. No external party gained access. Nothing was phished, nothing was encrypted, no perimeter was crossed. The action was simply not permitted, and nothing in the stack was positioned to make that determination before the consequence landed.
Arctic Wolf has now taken a financial position on incident costs. That converts an abstract architecture debate into a question the company’s own risk and finance functions must answer in writing: does the warranty respond when an authorized agent takes an unauthorized action?
Whatever the answer, someone at Arctic Wolf has to write it down. Nobody there has a taxonomy for it. That is a defined, dated, internal need — not a pitch.
Verisk is evaluating a dedicated agentic AI exclusion
Carrier requirementVerisk has confirmed it is evaluating additional options to address AI-related exposures, agentic AI specifically. The company says any new exclusion language would be optional, with adoption at each insurer’s discretion according to their own underwriting guidelines and appetite.
Lewin-Smith told The Insurer in April that the market is early but carriers intend to remove significantly more exposure. Read that as a schedule, not a sentiment.
An exclusion is not the end of a risk. It is the moment the risk becomes a separately priced product. Every exclusion Verisk publishes creates a residual that some carrier or MGA will eventually quote — and to quote it they need to distinguish a well-controlled agent deployment from a poorly controlled one. Today they cannot. The affirmative market that exists — AIUC, Armilla at Lloyd’s, Munich Re, Coalition’s affirmative endorsement — is underwriting on governance documentation, not on execution-time control evidence.
Carriers are being asked to price a risk whose control surface has no accepted measurement. That is a rating factor problem, and rating factors are bought.
Visa paid $2.4 billion for a control that runs before the transaction
ComparableVisa agreed on 3 August to acquire BioCatch for $2.4 billion in cash from funds advised by Permira. BioCatch analyzes behavioral, device and network signals — keystroke timing, touch gestures, device handling — to separate legitimate users from fraudsters in real time, across more than 350 banks in 21 countries, 1.8 billion devices and 760 million users, at roughly 19 billion sessions a month.
Permira took control approximately two years ago at a $1.3 billion valuation. The exit is a 1.8x step-up. Andrew Torre, Visa’s president of value-added services, put the framing plainly: account takeovers and scams cost the global economy over a trillion dollars annually, AI is scaling those attacks, and the acquisition is about stopping fraud before it reaches the point of payment.
The transferable lesson is the valuation logic, not the technology. The market paid a premium for a layer that operates upstream of the consequence — before the payment completes, not after. Behavioral fraud intelligence asks whether the actor appears legitimate. Sentinel Shield asks whether the consequence remains authorized. Same position in the sequence, different question, and the second question is the one no acquirer has bought yet.
This is also the clearest signal on vertical selection. In financial workflows a prevented unauthorized action has an immediate, arithmetic dollar value. Nowhere else does the ROI conversation resolve as fast.
Washington finalized the tests. Testing is not authorization.
RegulatoryA White House official said Monday the administration has finalized the details of voluntary cybersecurity tests measuring the hacking capabilities of the most advanced American AI models. Meta, Anthropic, OpenAI and Google were invited to meet officials today. The effort began in June at President Trump’s direction. Metrics, reporting process and whether any results become public have not been disclosed.
The unresolved question in both investigations is the one that matters architecturally: whether the containment around current capability tests can be independently verified, or whether verification depends on logs produced by the same systems the agents were able to reach. That is an evidence-integrity problem, and it is identical in structure to the problem an enterprise faces when its own agent acts outside its scope.
Fifteen attorneys general issuing a preservation demand is the leading indicator here. Preservation demands precede discovery. Discovery requires that an organization produce, for a specific action at a specific timestamp, the identity that acted, the authority it held, the policy evaluated, the decision rendered and the revocation state. Ordinary logs do not contain four of those five fields.
Attach a Regulatory and Investigation Evidence Module to the $15,000 Agent Authority Exposure Review. The buying trigger is not a breach — it is the arrival of the first customer security questionnaire that asks how the organization would answer a subpoena about an agent action. Those questionnaires are being rewritten right now.
The liability question is now being asked in public, and has no answer
StructuralCoverage this week has converged on a single unresolved point: when an autonomous agent breaks containment, hacks an organization it was never directed at, and no human instructed it, who is liable? If a person did it, the law is clear. For an agent, nobody can yet say.
The contract stack currently answers by default, and it answers badly. Foundation model providers disclaim accuracy, fitness and downstream consequence. Traditional cyber triggers depend on intent and identity — an external actor obtained unauthorized access, a phish succeeded, ransomware encrypted systems. An agent incident satisfies none of them. When the chain breaks, the carrier reads the contract stack and finds liability allocated cleanly to the deploying enterprise.
Most organizations shipping agents today have not audited a single MSA against the question of what happens when an autonomous system acts under their credentials. The discovery happens at claim time, which is the one moment the audit cannot help.
Authenticated once is not authorized indefinitely. The industry accepted that sentence this quarter. It has not yet accepted that the proof has to be produced at the moment of execution, or it does not exist at all.
Assessment
Analyst commentThe strategic error available this week is to respond to the competitive wave by shouting the category name louder. Onyx has $113 million to shout with. Zero Networks and Varonis have installed bases. That contest is not winnable and does not need to be entered.
The asymmetry runs elsewhere. Seven vendors just built controls that constrain agent authority. Not one of them is talking to the people who must decide what a controlled agent deployment is worth in premium. Verisk is drafting exclusion language with no accepted control taxonomy to reference. Testudo is underwriting US mid-market AI liability with no execution-control rating factor. Arctic Wolf is warranting incident costs with no definition of whether authorized-agent-unauthorized-action is inside or outside the boundary.
Every one of those is a party with a budget, a deadline, and a problem no security vendor is currently selling into. The AGS Score was built as a security assessment. Its higher-value form is a rating input.
Three moves this week
ExecutionMove one — today
Dan Schiappa, Arctic Wolf
The relationship survived the pass. The headline has now arrived on his side of the table, which changes who is asking whom. Do not re-pitch Sentinel Shield. Ask the warranty-scope question, which he cannot answer without an internal conversation — and that conversation is the meeting.
Move two — Wednesday call
Yakir Siegal, Kovrr
Open on Verisk, not on Sentinel Shield. The agentic exclusion evaluation is the single most useful fact either party could bring to this call, and it reframes the joint study from a research favor into a market-timed asset. An exclusion creates a residual; a residual needs quantification; quantification needs a control taxonomy that distinguishes deployments. Kovrr has the loss-modeling apparatus. Sentinel Shield has the control taxonomy and a deployable prototype to generate before-and-after measurements against.
Hold the terms: effect-size design over correlational, joint authorship, taxonomy attribution non-negotiable, study fee negotiable to zero for those terms. The enforcement mechanism architecture stays out of writing until a signed SOW and payment. The two open gates — Kovrr’s agentic loss data volume, your install base N — are now easier to resolve, because the exclusion timeline gives both sides a reason to accept a smaller N in exchange for being first.
Move three — new lane, open this week
George Lewin-Smith, Testudo
Lloyd’s-backed AI liability MGA, underwriting US mid-market enterprises since early 2026. An MGA writing this risk must produce rating factors and cannot buy them anywhere. This is the cleanest expression of the underwriting-side thesis and an entirely uncontested lane — no security vendor is calling him, because security vendors sell to CISOs.
Same lane, second call: Rune Kvist at AIUC, whose AIUC-1 framework needs technical control criteria at exactly the layer Sentinel Shield operates. Certification standards that lack an execution-control criterion are certifying governance documentation, and they know it.