# The Agent Governance Gap Just Got a $100 Million Startup Pointed at It
When your AI agent books a meeting, queries a database, and fires off an API call to your Salesforce instance — all in the span of seconds — who exactly authorized that? And more to the point: could you prove it in a breach investigation?
That's the gap Neo is betting $100 million it can fill.
The American-Israeli startup emerged from stealth Monday with funding across seed and Series A rounds from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures, and Merlin Ventures. The platform it's bringing to market isn't another AI security tool in the narrow sense. It's something closer to a visibility and enforcement layer for the entire agentic software stack — a category that, until very recently, barely existed as a concept worth defending.
## The Problem Nobody Solved While Everyone Was Deploying
Enterprises didn't wait for governance frameworks before rolling out AI agents. They rarely do.
Over the past eighteen months, developer tools, SaaS platforms, and internal workflows have been quietly colonized by agentic software — systems that don't just answer questions but take actions, chain tool calls, invoke external APIs, and move data between systems using permissions that were originally granted to a human. The employee who installed an AI coding assistant probably didn't think twice about what OAuth scopes it inherited. The ops team that stood up an internal agent probably didn't add it to their identity catalog.
Neo CEO Nick Warner put it directly: AI agents are operating "with valid user permissions" inside environments that were never designed to track or constrain what they can do once deployed.
Warner knows what that failure mode looks like. Before founding Neo, he served as president and COO of SentinelOne, and before that held leadership roles at Cylance, McAfee, and Forcepoint. His co-founders bring similar depth: CPO Shlomi Salem led detection engineering at SentinelOne; CTO Eran Shirazi co-founded EasySend. This is not a founding team chasing an AI trend — it's a team that spent years watching enterprises discover what was living on their networks only after something went wrong.
## What a Control Layer Actually Means
Neo's pitch centers on four capabilities that, taken together, address the audit vacuum left by the current agent deployment free-for-all.
Discovery and inventory. The platform maintains a continuous catalog of what's active in an enterprise environment — not just traditional software and APIs, but AI agents, models, extensions, and MCP servers. That last item deserves attention. Model Context Protocol, Anthropic's standard for connecting AI systems to external tools and data sources, has proliferated faster than most security teams have been able to track. Neo explicitly catalogs MCP servers, which means someone is finally treating them as the attack surface they represent.
Privilege and configuration analysis. Once Neo knows what's running, it evaluates each asset for excessive access rights and misconfiguration. The parallel to identity security tooling is obvious — least privilege for software agents is the same problem as least privilege for human users, and it's been just as widely ignored.
Attribution. This is the technically hard part. Neo claims real-time attribution that traces individual software actions back to the originating human user, automated agent, or specific application identity. In multi-hop agentic chains — where one agent calls another, which calls an API, which triggers a workflow — maintaining a clean audit trail is genuinely difficult. If Neo has solved this well, it addresses one of the biggest gaps in current agentic deployments.
Policy enforcement. Security teams can set and enforce granular rules across tool calls, data movement, and API access, with the ability to block unauthorized activity or flag suspicious operations for human review.
## A Familiar Playbook
This arc should feel familiar to anyone who watched cloud security mature.
When enterprises started moving workloads to AWS and Azure at scale, the question of "what's running and who authorized it?" created an entire product category: CASB, CSPM, CIEM. The pattern is consistent: a new deployment paradigm outpaces governance tooling by three to five years, something bad happens, and then capital flows into the gap. SentinelOne itself benefited from a similar moment — endpoint detection lagged the threat landscape, and the company became a multi-billion-dollar business filling the space.
Neo is making a direct bet that agentic AI is that next inflection point, and that the enterprise security function hasn't caught up. A $100 million vote of confidence from a16z and Bessemer suggests the market agrees.
## HackWire Analysis
The funding number is notable, but the architectural detail that deserves more scrutiny is MCP server cataloging.
Most current security tooling doesn't know MCP servers exist. They're not tracked in CMDBs, they don't show up in traditional network inventories, and the permissions they expose to AI models are often broader than the original implementers understood. An MCP server that exposes read/write access to a file system or database, connected to an agent running under a privileged identity, is a lateral movement vector waiting to be exploited. The fact that Neo explicitly calls this out in its feature set — not as a footnote but as a primary catalog category — tells you something about what the company's detection engineering team has been observing in real enterprise environments.
There's also an underappreciated timing risk here. The window between "agents are deployed" and "governance tooling is in place" is exactly when attackers move. We've seen this pattern with cloud misconfiguration: the vulnerabilities that enabled major cloud breaches weren't novel zero-days, they were legacy permissions that nobody audited because nobody had a tool for it yet. Agentic environments today look like S3 buckets in 2018 — broadly accessible, inconsistently configured, and mostly un-inventoried.
The attribution piece also matters for regulatory exposure, not just incident response. As AI agents perform actions that carry compliance implications — moving financial data, accessing health records, initiating communications — enterprises need to demonstrate that a human authorized the chain, not just that a human authorized the agent to exist. That's a harder evidentiary bar, and most current deployments can't clear it.
The real test for Neo will be whether its catalog actually stays current in fast-moving environments where new agents, plugins, and MCP connections spin up daily. Static discovery is useful; continuous drift detection is what enterprises actually need. If the founding team's experience at SentinelOne taught them anything, it's that "we saw it once" is not the same as "we see it always."
— HackWire Editorial
---
## Related Coverage