AIR
Security and governance platform for enterprise AI agents, focusing on the AI-agent software supply chain.
Website: https://www.air.security/
Cover Block
Public sources
| Field | Value |
|---|---|
| Name | AIR |
| Tagline | Security and governance platform for enterprise AI agents, focusing on the AI-agent software supply chain [AIR Security, retrieved 2026] |
| Headquarters | New York, USA [Fortune, retrieved 2026] |
| Founded | 2026 [BankInfoSecurity, September 2026] |
| Stage | Seed [Yahoo Finance, September 2026] |
| Business Model | B2B |
| Industry | Security |
| Technology | AI / Machine Learning |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2), Yair Saban and Niv Hoffman [SecurityWeek, retrieved 2026] [Niv Hoffman - Air |
| Funding Label | $50M+ [Yahoo Finance, September 2026] |
| Total Disclosed | Approximately $50,000,000 across two seed rounds in 2026 [Yahoo Finance, September 2026] |
Links
Public sources
- Website: https://www.air.security/
Executive Summary
PUBLIC AIR is building a security and governance platform for enterprise AI agents, and it merits attention now because it emerged from stealth in September 2026 with $50 million in seed financing behind a narrowly defined bet on the AI-agent software supply chain [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026]. The company was founded in 2026 by Yair Saban and Niv Hoffman, both veterans of Israel's Unit 8200, with Saban reported to have spent 11 years there, including 18 months leading its R&D section, and Hoffman described as having offensive cybersecurity experience [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026].
The product thesis is straightforward: as enterprises deploy agents that call external tools, plug-ins, MCP servers, and sub-agents, AIR aims to discover those agents, evaluate the components they rely on, and block interactions that fail security policy or touch prohibited systems and sources [AIR Security, retrieved 2026] [BankInfoSecurity, September 2026]. That framing is more specific than generic AI security positioning, and AIR has tried to support it with research-led credibility, including public disclosures around SkillJacking and Plugin4Shell, the latter described by external coverage as a high-severity zero-click remote code execution issue affecting major AI coding agents [AIR Security, retrieved 2026] [CybersecurityNews.com, retrieved 2026] [FM CyberSecurity, September 2026].
On the commercial side, AIR sells a B2B security product and reported more than 20 customers at launch, with roughly one-quarter described as large enterprises, though those customer figures remain company-sourced in the available public record [BankInfoSecurity, September 2026] [Dealroom.co, retrieved 2026]. Capital formation has been unusually strong for a company at this age: Yahoo Finance reported a $10 million seed led by Sequoia Capital and a separate $40 million seed led by Greenoaks, alongside angels including Anne Neuberger, Yinon Costica, Ofir Erlich, Varun Anand, Zach Frankel, Swish, and Netz [Yahoo Finance, September 2026].
The team has also added senior enterprise-security signal, with Ryan Knisley, previously CISO at The Walt Disney Company and Costco Wholesale, serving as chief strategy officer according to public coverage [The Globe and Mail, October 2026] [Ctech, retrieved 2026]. Over the next 12 to 18 months, the key question is less whether AIR can attract attention and more whether it can convert early category leadership into durable enterprise adoption, evidenced by named reference customers, repeatable deployment patterns, and proof that the agent-supply-chain problem is budgeted as a distinct security control layer [BankInfoSecurity, September 2026] [News-Press, October 2026].
Lightly corroborated -- Core company, founder, and funding facts are corroborated by BankInfoSecurity and Yahoo Finance; product and customer traction details rely partly on company statements and reprints.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Seed |
| Business Model | B2B |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding | $50M+ total disclosed |
How the Company Got Here
PUBLIC
AIR entered the market unusually quickly: by the time the company surfaced publicly in 2026, its website was already positioning it around a specific control point, the security and governance of enterprise AI agents and the software supply chain those agents depend on [AIR Security]. The company is headquartered in New York, and its public materials identify Yair Saban and Niv Hoffman as co-founders [AIR Security].
The limited public record supports a short chronology rather than a long origin story. AIR was founded in 2026, according to the structured company facts provided for this report, and its public website shows a product centered on discovering agents, evaluating the skills, plug-ins, MCP servers, sub-agents, and tools they use, and enforcing security policy around those components [AIR Security]. The same public materials also show commercial availability through Google Cloud Marketplace procurement, which indicates at least one formal distribution route at launch [AIR Security].
What is still missing from the public file is almost as notable as what is present. No legal entity name or state filing is confirmed in the cited company-source material supplied here, and the website evidence is stronger on product scope than on corporate history [AIR Security]. For now, the cleanest read is that AIR is a newly formed New York-based security startup built around enterprise agent governance, with its earliest visible milestone being public product emergence in 2026 [AIR Security].
Product and Technology
MIXED
The product thesis is straightforward: AIR is trying to secure the part of enterprise AI that sits above the model and closer to action. Public materials describe the company as a security and governance platform for enterprise AI agents, with emphasis on the agent software supply chain rather than on model safety in the abstract [AIR Security, retrieved 2026] [BankInfoSecurity, September 2026]. In practice, AIR says its software discovers agents operating inside an organization, continuously evaluates the skills, plug-ins, MCP servers, sub-agents, and tools those agents use, and can block components that fail security checks or attempt to interact with prohibited systems or external sources [AIR Security, retrieved 2026] [BankInfoSecurity, September 2026].
The most concrete technical evidence in the public record comes from AIR's security research rather than from a verified product demo. On its site, the company says its skills scanner detects supply chain attacks including "SkillJacking" and that the scanner is aligned to the OWASP Top 10 risks for Agentic Skills [AIR Security, retrieved 2026]. AIR also published research on "Plugin4Shell," which it describes as a zero-click remote code execution vulnerability affecting major AI coding agents; third-party coverage independently confirms the broad claim that the issue affected Claude Code, Codex, GitHub Copilot, and Gemini CLI, and that the attack path involved how these agents verified pinned commit hashes [CybersecurityNews.com, retrieved 2026] [FM CyberSecurity, September 2026]. That matters because it supports AIR's underlying argument that agent extensions and tool dependencies can become a distinct control point for enterprise security, although the available sources do not yet verify deployment depth, false-positive rates, or how broadly the blocking and governance controls are in production across customer environments [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026].
Lightly corroborated -- Core product scope is corroborated by AIR's website and launch coverage, but several capability details remain company-described and no independent demo or technical validation of the full platform was available in the cited public sources.
Where the Demand Sits
Public sources The market matters now because enterprises are moving from AI assistants that suggest work to AI agents that take actions, and the control layer around those actions is still early by the standards of enterprise security procurement [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026].
The available public record does not provide a cited third-party TAM, SAM, or SOM for AIR’s specific category, which it frames as security and governance for the AI-agent software supply chain [AIR Security, retrieved 2026]. That leaves the market definition ahead of formal sizing, a common pattern in security categories that form around a new control point rather than a new buyer. The practical read is narrower and more useful: AIR is targeting budgets tied to enterprise AI deployment, application security, cloud security, and governance programs where agents, plug-ins, MCP servers, and connected tools create a new review surface [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026].
Demand signals in the source set are early but directionally clear. AIR said it had more than 20 customers when it emerged from stealth, with roughly one-quarter described as large enterprises, suggesting that the problem is not confined to startups experimenting with agents [BankInfoSecurity, September 2026]. Product positioning also lines up with a real operational shift: the platform is described as discovering agents inside an enterprise, evaluating the skills, plug-ins, sub-agents, MCP servers, and tools they use, and blocking components that fail checks or interact with prohibited systems [AIR Security, retrieved 2026] [Yahoo Finance, September 2026]. That is a different control problem from model safety alone, and it tracks with how enterprise buyers usually respond when software gains the ability to access systems and trigger actions.
Adjacent markets matter because AIR is unlikely to sell into a budget vacuum. The closest substitutes in the public evidence are existing application security, software supply chain security, identity and access controls, cloud security posture management, and governance tooling that enterprises may try to extend to agents before they approve a new category purchase. AIR’s wedge, according to launch coverage and company materials, is that agent security sits at the intersection of those tools but is not fully covered by any of them, particularly once skills and external tools can modify data or execute workflows inside business systems [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026]. That framing is plausible, though the boundary between a distinct platform category and an added feature set from incumbent vendors remains unsettled on the current evidence.
Regulatory and macro forces are supportive in a broad sense, even if the sources here do not tie AIR directly to any one rule set. Enterprises adopting action-taking agents are likely to face the same internal controls that already govern vendor risk, access permissions, logging, change management, and data handling, now applied to software that can invoke plug-ins and external services. AIR’s own research-led marketing sharpens that case: it reported Plugin4Shell, which external coverage described as a high-severity zero-click remote code execution vulnerability affecting major AI coding agents including Claude Code, Codex, GitHub Copilot, and Gemini CLI [CybersecurityNews.com, retrieved 2026] [FM CyberSecurity, September 2026]. If buyers accept that agents introduce a software supply chain problem rather than only a model problem, spending can come from security modernization budgets faster than from net-new experimental line items.
| Market lens | Public evidence | Implication for AIR |
|---|---|---|
| Core category | Security and governance for enterprise AI agents and their software supply chain [AIR Security, retrieved 2026] | AIR is trying to define a control layer around agent actions and dependencies rather than around model hosting alone. |
| Buyer urgency signal | More than 20 customers reported at stealth exit, with roughly one-quarter large enterprises [BankInfoSecurity, September 2026] | Early demand appears to include enterprise buyers, though the figure remains company-reported. |
| Adjacent budget pools | Application security, software supply chain security, cloud security, and governance controls inferred from product scope [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026] | Near-term adoption may depend on whether AIR can attach to existing security budgets instead of requiring a new category approval. |
| Threat validation | Plugin4Shell described by external outlets as a high-severity zero-click RCE affecting major coding agents [CybersecurityNews.com, retrieved 2026] [FM CyberSecurity, September 2026] | Public vulnerability research strengthens the argument that agent ecosystems create new attack surfaces worth dedicated tooling. |
The evidence supports a market that is emerging quickly, but it does not yet support precise sizing. For now, the stronger claim is that AIR sits where enterprise agent adoption, software supply chain risk, and governance requirements are beginning to converge.
Lightly corroborated -- Section relies on independent reporting from BankInfoSecurity, Yahoo Finance, CybersecurityNews.com, and FM CyberSecurity, but market sizing itself is not established by a named third-party report in the source set.
Competitive Landscape
MIXED
AIR is entering a crowded security stack, but its pitch is narrower than general AI security: it is trying to own the control layer around the tools, plug-ins, MCP servers, and other components that let enterprise agents take action inside production systems [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026].
That positioning matters because the likely alternatives are not only direct startups, but also three broader buckets of substitute spend. First are incumbent cloud and security platforms that can fold agent controls into existing posture, identity, or workload-security products, especially where buyers prefer to extend a current vendor relationship rather than add a new console. Second are challenger AI-security startups that focus on model behavior, prompt risk, data leakage, or application monitoring rather than the agent software supply chain specifically. Third are adjacent internal controls, including enterprise architecture review, identity governance, and code-scanning workflows, that can partially absorb this problem if agent deployments remain limited. The public record here does not name direct competitors, but AIR's own product language, and launch coverage describing discovery, continuous evaluation, and blocking of unsafe components, places it closest to a new subcategory around agent governance and agent supply-chain security rather than classic endpoint or CSPM tooling [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026].
AIR's edge today appears to come from focus and timing, not yet from installed-base advantage. The company emerged from stealth with disclosed seed financing of roughly $50 million across a $10 million Sequoia-led seed and a $40 million Greenoaks-led seed, which gives it unusual balance-sheet room for a company founded in 2026 [Yahoo Finance, September 2026]. The founding team also brings security credibility tied to Unit 8200 backgrounds for Yair Saban and Niv Hoffman, and AIR added Ryan Knisley, previously CISO at Disney and Costco, as chief strategy officer, which should help in enterprise security conversations [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026] [The Globe and Mail, October 2026]. That edge is real, but probably perishable: capital and reputation can accelerate early design wins, while product control over a fast-moving agent ecosystem lasts only if AIR keeps pace with new frameworks, repositories, and attack patterns.
The strongest public evidence for differentiation is AIR's research-led posture. The company says it discovered Plugin4Shell, described in outside coverage as a high-severity zero-click remote code execution issue affecting major AI coding agents including Claude Code, Codex, GitHub Copilot, and Gemini CLI [CybersecurityNews.com, retrieved 2026] [FM CyberSecurity, September 2026]. AIR also publishes work on SkillJacking and positions its scanner against the OWASP Top 10 risks for Agentic Skills, which suggests a strategy of using disclosed vulnerabilities and taxonomy work to shape buyer perception of what the problem is [AIR Security, retrieved 2026]. If that research pipeline continues, AIR could become the reference brand for agent supply-chain risk. If not, larger vendors with stronger distribution can likely absorb the feature set faster than a startup can absorb an enterprise sales cycle.
The exposure is straightforward. AIR reported more than 20 customers at launch, with about one-quarter described as large enterprises, which is encouraging for a company only months old, but still leaves it early relative to the distribution power of established security vendors and cloud marketplaces [BankInfoSecurity, September 2026] [Dealroom.co, retrieved 2026]. Google Cloud procurement support may reduce some friction by letting customers buy through existing committed spend, yet that is a channel convenience rather than proof of category ownership [AIR Security, retrieved 2026]. The company is also exposed if the market settles on broader AI governance suites instead of specialist agent-supply-chain tools, because in that scenario AIR would need either superior detection data or unusually strong workflow integration to avoid being treated as a point product.
Over the next 18 months, the most plausible competitive scenario is a race between specialists that define the category and incumbents that package it. AIR is the likely winner if enterprise buyers decide that agent security is materially different from model security, and if AIR can keep translating research like Plugin4Shell into enforceable controls that auditors and CISOs recognize as distinct budget lines [CybersecurityNews.com, retrieved 2026] [AIR Security, retrieved 2026]. The likely loser if the opposite happens is not a named rival from the source set, but the standalone specialist segment itself: if large vendors turn agent governance into a feature inside broader AI-security or cloud-security platforms, independent products without clear data or workflow moats will have a harder time defending expansion. On public evidence, AIR has a credible chance to be one of the early standard-setters, but the durability of that position is still unproven.
Company-stated, unverified -- This section relies on public launch coverage and company materials, but the source set does not name direct competitors, and several operating claims remain company-reported or lightly corroborated.
Opportunity
PUBLIC
The prize here is not another point security tool, but a control layer that large companies may need each time an AI agent is allowed to discover tools, call external systems, and take action inside production environments [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026].
The headline opportunity is straightforward: AIR could become default security and governance infrastructure for enterprise AI agents if the category forms the way current product design suggests. The company is early, but the ingredients that usually matter are already visible in public reporting, a defined control point around agent discovery and component evaluation, a thesis tied to the software supply chain rather than only model behavior, and enough early distribution to show that buyers are at least willing to test the product in live environments [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026]. AIR reported more than 20 customers as it emerged from stealth, with roughly one-quarter described as large enterprises, and it raised $50 million across two seed rounds led by Sequoia Capital and Greenoaks in 2026, which gives it time to build before procurement standards fully settle [BankInfoSecurity, September 2026] [Yahoo Finance, September 2026].
The more interesting point is where the company sits in the stack. AIR is trying to secure the skills, plug-ins, MCP servers, sub-agents, and tools that agents use, which is closer to the operational surface where enterprises usually start caring about policy, access, and auditability [AIR Security, retrieved 2026] [BankInfoSecurity, September 2026]. If AI agents become a normal way to operate internal software, this position could resemble an enterprise control plane rather than a feature product.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| Enterprise control plane | AIR becomes the standard governance layer used before agents are approved to act inside large enterprises. | A visible increase in enterprise deployments of agentic systems, combined with security teams requiring discovery, evaluation, and blocking controls at the tool and plug-in layer [BankInfoSecurity, September 2026]. | The product is already positioned around discovery and continuous evaluation of agent components, and AIR reported more than 20 customers with some large enterprises at launch [AIR Security, retrieved 2026] [BankInfoSecurity, September 2026]. |
| Supply-chain security standard | AIR's research and scanning products become the reference point for agent skill and plug-in risk, similar to how software composition tools became embedded in modern AppSec workflows. | High-profile exploits or disclosure cycles around agent plug-ins and skills, including variants of Plugin4Shell or SkillJacking-style attacks [CybersecurityNews.com, retrieved 2026] [AIR Security, retrieved 2026]. | Public evidence already shows AIR building around this exact attack surface, with a skills scanner and published research on Plugin4Shell and SkillJacking [AIR Security, retrieved 2026] [FM CyberSecurity, September 2026]. |
| Cloud-channel distribution | AIR turns cloud procurement into a distribution advantage and reaches budget owners through existing infrastructure spend. | Expansion of its Google Cloud marketplace path or similar channel access with consolidated billing and committed spend drawdown [AIR Security, retrieved 2026]. | AIR already states that Google Cloud customers can procure the product through their existing account, which can shorten vendor onboarding if the control point proves necessary [AIR Security, retrieved 2026]. |
Compounding, if it happens, likely comes from policy depth and threat intelligence rather than from a consumer-style network effect. Every new enterprise deployment should expose more examples of which agent components are actually used in production, which integrations create policy conflicts, and which skills or plug-ins trigger risky behavior, giving AIR more material to improve detection and governance rules over time [AIR Security, retrieved 2026] [BankInfoSecurity, September 2026]. The public record does not prove that this flywheel is operating at scale yet, but it does show the first pieces, continuous evaluation of agent components, a scanner aligned to OWASP risks for agentic skills, and original vulnerability research that can feed product credibility and rule creation [AIR Security, retrieved 2026] [CybersecurityNews.com, retrieved 2026].
There is also a go-to-market compounding path that is easy to miss. If AIR enters through one narrow control need, such as approving which agent skills, plug-ins, or external systems can be used, it can widen into governance, incident response, procurement controls, and cloud marketplace distribution over the same estate of agents [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026]. That is the sort of expansion logic security investors usually want to see, because the same installation can become more valuable as agent usage spreads inside the customer rather than requiring AIR to invent a separate product line.
The size of the win is necessarily scenario-based because no public market-sizing source was provided in the research set. A reasonable public comparable frame is Wiz, which was named by Fortune as the No. 1 company on the 2026 Cyber 60 list that also included AIR, showing where investors have historically priced a security control platform that becomes broadly embedded in enterprise infrastructure [Fortune, retrieved 2026] [News-Press, October 2026]. AIR is much earlier and there is no basis here to infer a valuation path, but if the "enterprise control plane" scenario plays out and agent security becomes a required spend category, the company could plausibly grow into a multi-billion-dollar platform asset (scenario, not a forecast), because buyers tend to consolidate around security layers that sit directly in front of production access and policy enforcement [BankInfoSecurity, September 2026] [AIR Security, retrieved 2026].
Lightly corroborated -- Core product scope and funding are supported by multiple public sources, but customer count, enterprise mix, and several traction signals remain company-reported or based on coverage that repeats company claims.
Sources
Public sources
[AIR Security, retrieved 2026] AIR Security | Secure Your AI Agents | https://www.air.security/
[Fortune, retrieved 2026] Air Security (AIR) Company Profile, Stock Price, News, Rankings | https://fortune.com/company/air-security-air/
[BankInfoSecurity, September 2026] Air Launches With $50M to Keep Enterprise AI Agents Safe | https://www.bankinfosecurity.com/air-launches-50m-to-keep-enterprise-ai-agents-safe-a-32733
[Yahoo Finance, September 2026] AIR raises $50M to help companies vet the skills and add-ons AI agents use | https://finance.yahoo.com/technology/ai/articles/air-raises-50m-help-companies-154551250.html
[Niv Hoffman - Air | LinkedIn, retrieved 2026] Niv Hoffman - Air | LinkedIn | https://www.linkedin.com/in/gdor80/
[CybersecurityNews.com, retrieved 2026] Plugin4Shell is a high-severity, zero-click remote code execution vulnerability affecting major AI coding agents, including Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI | https://cybersecuritynews.com/plugin4shell/
[FM CyberSecurity, September 2026] Plugin4Shell allows an attacker with control of a plugin’s source repository to deliver malicious code through plugin updates without further user action | https://www.fmcybersecurity.com/plugin4shell/
[Dealroom.co, retrieved 2026] AIR company profile | https://app.dealroom.co/companies/air_security
[The Globe and Mail, October 2026] AIR Emerges from Stealth With $50M to Build a Firewall for Agents | https://www.theglobeandmail.com/investing/markets/markets-news/ACCESS%20Newswire/4380070/air-emerges-from-stealth-with-50m-to-build-a-firewall-for-agents/
[Ctech, retrieved 2026] Ryan Knisley, former CISO at The Walt Disney Company and Costco Wholesale, joined AIR as chief strategy officer | https://www.calcalistech.com/ctechnews/article/rjzq0x2xl
[News-Press, October 2026] AIR Named to Fortune’s Fourth Annual Cyber 60 List, Recognizing Innovation in Cybersecurity | https://www.news-press.com/press-release/story/140070/air-named-to-fortunes-fourth-annual-cyber-60-list-recognizing-innovation-in-cybersecurity/
Articles about AIR
- After 20 Enterprise Customers, AIR Builds a Firewall for AI Agents — The startup, founded by Israeli intelligence veterans, is betting that securing the tools agents use is the next critical security layer.