The Agentic Governance Gap Becomes a Market: Onyx, Act, and the Shadow-AI Buildout
In tens of live enterprise environments spanning millions of endpoints, Clutch Security counted the AI agents and found they outnumber the engineers they assist 3.6 to 1.
The median agent holds tens of credentials. In most enterprises, the approval guardrails are switched off. And the security teams that are supposed to watch all of this mostly cannot see the agents at all.
This is shadow IT, with one upgrade: the shadow now writes and deploys its own code, at machine speed, holding legitimate credentials to systems it was never audited against.
This is shadow IT, with one upgrade: the shadow now writes and deploys its own code, at machine speed, holding legitimate credentials to systems it was never audited against.
That is the risk. The market has decided it is worth a generational franchise. The tell is that nobody can yet agree on what the franchise is.
Start with the loudest bet. Bessemer led Onyx Security's Series B and framed it in the plainest possible terms: this is "a category poised to produce the largest cybersecurity company yet."
The lineage is explicit. The internet created Palo Alto Networks. The endpoint created CrowdStrike. The cloud created Wiz. "AI agents are the next revolution," Bessemer wrote, "and we believe the company that owns it will be bigger than any that came before."
Onyx's pitch is runtime steering. A mesh of small, purpose-trained models sits inline on production traffic, and only genuinely high-risk actions escalate to larger "Guardian Agents" that reason over intent and either approve, block, or redirect an agent toward a safe way to finish the job.
The logic behind the steering is that blocking breaks the business. Agents are useful precisely because they reach across systems; lock down their permissions and you defeat the purpose, so the enforcement has to stop the dangerous action in flight while letting the work continue.
Now hold that next to Act Security, which emerged from stealth the same stretch with $60 million across a $20 million seed and a $40 million Series A, and a founding team that built Medigate and sold it to Claroty.
Act's answer is the opposite of steering. It doesn't watch agents act; it eliminates the access paths underneath them before anything runs.
CEO Jonathan Langer's number is the one that lands: roughly 97% of cloud access permissions sit dormant and unused. Fine for humans. Not so for AI agents "inheriting the same old human permissions, running around the clock at machine speed, with none of the judgment a person would apply."
So one funded thesis says the surface is unfixable and you must govern behavior in real time. Another says behavior is a distraction and you must strangle the access surface at the infrastructure layer. Both raised on the same problem in the same weeks.
Add a third posture entirely. Horizon3 more than tripled its valuation to $2 billion on a $250 million Series E, selling "AI Hackers" — fully autonomous penetration testing that has run 310,000 production security tests with zero disruptions.
Horizon3 doesn't govern agents at all. It weaponizes them to find the holes before someone else's agent does, and its CRO says the real competition isn't other vendors but the old model of annual human pentests sampling roughly 5% of a network.
Runtime steering, access elimination, autonomous pentesting. Three products, three architectures, one phrase — "agentic security" — stretched over all of them.
Then the incumbents moved, and moved bigger. In a single 72-hour window, Okta bought Permiso for $200 million and Cyera bought Oasis for $1 billion — the latter roughly $700 million in cash — while three VCs put $171 million into Onyx, Inforcer, and Cantina.
Read that ratio again. Exit consideration outran new funding by roughly four to one in the same week. The people paying nine figures to own the problem outspent the people funding startups to solve it.
That is not the normal sequence. Normally incumbents buy after a category is validated and VC rounds follow the exits. Here the buying and the funding happened simultaneously, which usually precedes a category becoming a line item on every enterprise security budget.
Cyera had raised $600 million at a $12 billion valuation weeks before spending a billion on Oasis, a non-human identity and agentic access governance play. Okta, the dominant enterprise identity vendor, bought Permiso for cloud identity analytics. Neither built the capability in-house. Both are well-resourced engineering shops that decided it was faster to buy.
That is the most legible signal in the whole week — and also the one that should worry anyone writing a nine-figure check into an independent startup.
Because here is where the category gets uncomfortable. It is so new that the funding facts themselves are contested.
AI CERTs flags that "March headlines incorrectly stated that Onyx closed a $113M Series B," when Onyx had actually emerged from stealth with $40 million across seed and Series A — and the $113 million reportedly belonged to OpenRouter, a multi-model routing company, in a separate round led by CapitalG, per AI CERTs.
SecurityWeek, TipRanks, Bessemer, and StartupHub all report the $113 million as Onyx's — SecurityWeek pegging total funding at $153 million and a reported $640 million valuation. AI CERTs says two companies with similar "control plane" language got merged into one story.
I can't resolve which is right from the evidence, and that is exactly the point. When credentialed trade press cannot agree whether a would-be generational franchise raised $40 million or $113 million, the taxonomy is not settled. The narrative is outrunning the bookkeeping.
Meanwhile the vocabulary is doing heavy lifting it hasn't earned. AI CERTs itself lists "OpenRouter positions routing as governance" — a token router reclassified as an agent-governance platform because the funding frenzy made the label valuable.
If routing counts, and steering counts, and access elimination counts, and autonomous pentesting counts, then "agent governance" describes at least four genuinely different products competing for one budget line.
Now the load-bearing worry for whoever holds that budget in 2026.
The threat is real. Agents outnumber engineers 3.6 to 1, hold tens of credentials each, run with guardrails off, and inherit dormant human permissions that were tolerable only when attackers moved at human speed. Nobody serious disputes the exposure.
What is unproven is that a standalone control plane wins it. Microsoft has already shipped Agent 365, bundling policy hooks into Entra and Purview — governance as a feature of the subscription you already pay for.
Okta and Cyera just demonstrated that identity incumbents will buy non-human-identity coverage rather than cede it. Palo Alto is integrating agent hooks into its existing portfolio. The pattern that produced Wiz — a category so distinct it had to be its own company — is not obviously the pattern here.
So the nine-figure bets landing on Onyx and its peers are not really bets on whether enterprise agents need governing. That question is answered.
They are bets on independence: that runtime steering, or access elimination, or autonomous pentesting is deep enough and distinct enough to resist being absorbed as a line item inside Okta, Cyera, Palo Alto, or Microsoft.
Bessemer is pricing Onyx as the next CrowdStrike. The 72-hour buying spree suggests the incumbents are pricing it as their next acquisition.
Both can't be right. And until the reporters can agree on how much the flagship even raised, the honest read is that capital is racing a risk it can see clearly toward a category it cannot yet define.