Kontext
Runtime security platform for AI agents, providing control and authorization for AI workforces.
Website: https://kontext.security/
Cover Block
Publicly reported
| Field | Value |
|---|---|
| Name | Kontext |
| Tagline | Runtime security platform for AI agents, providing control and authorization for AI workforces. |
| Headquarters | Munich, Germany |
| Founded | 2023 |
| Stage | Seed |
| Business Model | SaaS |
| Industry | Security |
| Technology | AI / Machine Learning |
| Geography | Western Europe |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding Label | Seed |
| Total Disclosed Funding | ~$4,000,000 |
Links
Publicly reported
- Website: https://kontext.security/
Summary and Signal
PUBLIC Kontext is building a runtime security and authorization layer for AI agents, and it merits investor attention now because the company is trying to solve a practical control problem that becomes more acute as enterprises let autonomous systems take actions inside production environments [Scalable, October 2026] [HTGF] [Tech Funding News, September 2026]. Founded in Munich in 2023 by Jens Ernstberger and Michel Osswald, the company frames its origin around a simple point: organizations need a decision point at runtime for what agents are allowed to do, not just model-level safeguards before deployment [Crunchbase] [LinkedIn] [Startbase, September 2026].
The product, according to public descriptions, runs locally in the agent environment as a daemon, evaluates each tool call against policy controls, and can apply authorization rules at multiple levels including organization, user, agent, repository, and branch, which suggests the differentiation rests on enforcement at the moment of action rather than on observability alone [Scalable, October 2026] [kontext.security] [HTGF]. Public materials also position the platform around agent discovery, risk monitoring, and decision evidence, though those broader workflow claims rely more heavily on company-authored sources and should be read with some caution [kontext.security] [Kontext, September 2026].
The founding team looks relevant to the problem set. Ernstberger is identified as CEO and is reported to have a PhD background in system security and applied cryptography, with prior time at a16z Crypto, while Osswald is reported to bring an electrical-engineering background and a move into cybersecurity [LinkedIn] [Tech Funding News, September 2026] [Startbase, September 2026]. That mix does not prove go-to-market strength, but it does fit a technically demanding security-control product aimed at AI-native enterprise workflows.
On funding, Kontext announced a $4 million seed round in September 2026 led by 42CAP, with participation from a16z CSX and High-Tech Gründerfonds, giving the company a clear initial backer set and placing it firmly in the venture-scale SaaS camp [Kontext, September 2026] [Startbase, September 2026] [Crunchbase]. Over the next 12 to 18 months, the key items to watch are whether the company can convert its early reported focus on banks and fintechs into named enterprise adoption, whether runtime authorization becomes a budgeted control category rather than a feature inside broader AI governance stacks, and whether Kontext can show repeatable deployment value beyond coding-agent use cases [Tech Funding News, September 2026] [VentureBeat].
One source, partially checked -- Uses multiple public sources for company identity, founders, and financing, but several product-scope claims rely partly on company-authored materials.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Seed |
| Business Model | SaaS |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Geography | Western Europe |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding | Seed, total disclosed approximately $4,000,000 |
Company Overview
Publicly reported Kontext appears to have taken shape quickly around a narrow problem: how to control what AI agents are allowed to do once they are running inside an organization. The company describes itself as a runtime control and runtime authorization platform for AI agents, and its public materials frame the product around policy enforcement between agents and enterprise tools [kontext.security, retrieved 2026]. Crunchbase lists Kontext as a Munich, Germany-based company founded in 2023 [Crunchbase].
The public record is still thin, which is typical at seed stage, but the chronology is straightforward. Crunchbase identifies Jens Ernstberger and Michel Osswald as the founding team and places the business in security software [Crunchbase]. The clearest public milestone to date is the September 2026 seed financing: Kontext announced a $4 million round led by 42CAP with participation from a16z CSX and High-Tech Gründerfonds, which the company said would support team expansion and continued product development [kontext.security, September 2026].
There is one naming wrinkle worth noting because it can affect diligence hygiene. The company website and funding announcement clearly refer to the Munich security startup at kontext.security, while unrelated search results can surface a separate company using the same name in a different category [kontext.security, retrieved 2026] [Crunchbase]. For investors, that does not change the underlying asset, but it does mean cap table, legal entity, and commercial references should be checked against the Munich cybersecurity business specifically.
One source, partially checked -- Based primarily on Crunchbase and company website materials; headquarters, founding year, founders, and seed financing are corroborated, but legal entity details are not established in the cited public record.
The Product and the Stack
MIXED
The product is pitched as a runtime control layer for AI agents, which is a narrower and more concrete claim than many adjacent "AI security" offerings make [Scalable, October 2026] [VentureBeat]. Public descriptions consistently point to the same operating model: Kontext runs locally as a daemon, sits in the agent's environment, and evaluates each tool call against predefined policies before the action executes [Scalable, October 2026] [kontext.security] [HTGF]. In plain terms, the company is trying to move authorization from static user permissions to runtime decisions about what an autonomous system is attempting to do, with controls tied to identity, task context, and target system [LinkedIn, retrieved 2026] [HTGF].
The policy surface described in public materials is reasonably specific for a company at seed. Scalable reports that controls can be defined at the organization, group, user, agent, repository, and branch levels, and that the initial use case includes preventing coding agents such as Claude Code and Codex from taking unauthorized actions [Scalable, October 2026]. Company materials add adjacent functions including agent discovery, risk monitoring, spend management, decision records, and evidence on why a policy allowed or denied an action, while third-party descriptions also frame the product as real-time enforcement between AI agents and enterprise tools [kontext.security] [LinkedIn, retrieved 2026]. One caution on interpretation: several of those broader capabilities come from company-controlled channels rather than independent testing, so the best-supported public view is an authorization and policy-enforcement layer first, with observability and governance features surrounding it [kontext.security] [Scalable, October 2026].
A few technical implications follow from that design, although the public record is still thin. Running locally should reduce the gap between an agent's proposed action and the control decision, and it may matter in regulated environments where teams want policy enforcement close to the execution point rather than routed through a distant service [Scalable, October 2026]. What remains unproven in public is integration depth, administrative overhead, and how well the system generalizes beyond code agents into broader enterprise workflows; those are central product questions, but the available evidence does at least show a coherent architecture rather than a generic monitoring layer [Scalable, October 2026] [kontext.security] [aVenture News, September 2026].
One source, partially checked -- Built primarily from one independent product description in Scalable, with supporting but partly company-controlled corroboration from Kontext's website and investor materials.
The Market They Are Entering
PUBLIC
The market matters now because enterprises are moving from passive AI assistants toward agents that can take actions inside production systems, and that shift creates a new control problem before the buyer has a settled budget line for it [VentureBeat] [HTGF].
Public evidence on market size is thin for Kontext’s exact category, so the cleaner approach is to anchor on adjacent markets rather than present a false precision. The company is described as building runtime security and authorization for AI agents, a layer that decides whether an agent should be allowed to act before the action executes [Scalable, October 2026] [HTGF]. VentureBeat frames this as part of an emerging defense-in-depth stack for agentic systems, which suggests Kontext is selling into a newly forming segment at the intersection of AI governance, identity, authorization, and application security rather than a mature standalone market with widely accepted TAM benchmarks [VentureBeat].
That framing has two consequences for demand. First, buyers do not need to believe in a large, separate "AI agent security" budget on day one, because the pain can be funded out of existing security, platform, or developer-tooling budgets if agents are already being piloted inside enterprise workflows [Tech Funding News, September 2026] [Scalable, October 2026]. Second, category formation risk is real: the same budget can also be claimed by broader cloud security, identity and access management, governance, or model-gateway products that add agent controls as a feature set [VentureBeat] [VentureBeat].
| Market lens | What the source supports | Relevance to Kontext |
|---|---|---|
| AI agent security and governance | Agentic systems require layered controls, including runtime governance and authorization [VentureBeat] | Closest conceptual fit, but no confirmed public TAM in the sourced material |
| Enterprise identity and authorization | Kontext ties identity, task context, and policy to decide what an agent may do before execution [HTGF] | Suggests budget adjacency to IAM, privileged access, and policy engines |
| Developer and application security | Produkt focus includes coding agents such as Claude Code and Codex, with controls at repository and branch levels [Scalable, October 2026] | Opens a path into AppSec and secure software delivery budgets |
| Financial-services compliance tooling | Early customer focus is reported in mid-sized and large banks and fintechs [Tech Funding News, September 2026] | Indicates a wedge market where control, auditability, and policy evidence matter early |
The table points to a practical read on the market: Kontext appears less dependent on proving a brand-new budget category than on showing that agent runtime control solves a concrete security and compliance gap inside budgets that already exist. That can speed early adoption, but it also means competitors from adjacent categories may arrive with more distribution.
Demand drivers in the public record are clearer than market size. Scalable reports that Kontext evaluates each agent tool call against policy controls and can scope those controls at organization, group, user, agent, repository, and branch levels, which maps directly to enterprise concerns about unauthorized actions once agents gain tool use and write access [Scalable, October 2026]. HTGF describes the same problem in simpler terms: connecting identity with task context and policy before an action happens [HTGF]. That is a useful signal that the buyer pain is not generic model safety, but operational control over real system actions.
The strongest tailwind is regulatory and audit pressure in sectors where mistakes are expensive and explainability matters. Kontext says it offers decision evidence and records of policy outcomes, while VentureBeat’s framing of agentic security emphasizes layered governance and human judgment for edge cases [Kontext, September 2026] [VentureBeat]. Tech Funding News reports that the company’s early focus is on banks and fintechs, which fits a market where approval chains, access boundaries, and post-incident audit trails are not optional features but purchasing requirements [Tech Funding News, September 2026].
The substitute markets are close enough that buyers may compare tools that were not originally built for this use case. Snowflake’s Cortex AI Gateway, for example, is positioned to control AI agents and prevent enterprise cost overruns, which places model gateways and AI control planes adjacent to Kontext’s runtime authorization layer [VentureBeat]. More broadly, buyers could attempt to assemble similar coverage from identity products, policy engines, cloud workload security, developer-platform controls, or internal guardrails built by platform teams, especially if agent deployments remain narrow [HTGF] [Scalable, October 2026].
Macro conditions cut both ways. The positive case is straightforward: if enterprises continue to move from copilots to autonomous or semi-autonomous agents, the number of machine identities, tool permissions, and action paths grows quickly, which increases the need for pre-action control points and reviewable decisions [kontext.security] [HTGF]. The friction is that this market still depends on actual production deployment of agents, not just experimentation, so near-term demand may be concentrated in regulated sectors and engineering-heavy teams rather than broad enterprise IT [Tech Funding News, September 2026] [Scalable, October 2026].
One source, partially checked -- Market structure and demand signals are supported by VentureBeat, HTGF, Scalable, and Tech Funding News, but no independent third-party TAM/SAM/SOM figures were confirmed for Kontext’s exact category.
The Competitive Field
Competitive map
MIXED Kontext is positioning itself in a narrow but increasingly relevant layer of the stack: runtime authorization for AI agents, which puts it in competition not only with purpose-built AI security vendors, but also with infrastructure platforms and open-source control surfaces that can become "good enough" substitutes as agent deployment broadens [Scalable, October 2026] [VentureBeat].
| Company | Positioning | Stage / Funding | Notable Differentiator | Source |
|---|---|---|---|---|
| Kontext | Runtime security and authorization platform for AI agents, with local daemon-based enforcement over agent tool calls | Seed, $4 million disclosed in September 2026 | Local runtime control that evaluates actions against policy before execution, with policy granularity spanning organization, group, user, agent, repository, and branch levels | [Kontext, September 2026] [Scalable, October 2026] |
| Protect AI | AI security vendor referenced as a competitor in the category | Not established in the provided public source set | Named category competitor in AI security | [Structured Facts] |
| Snowflake Cortex AI Gateway | Enterprise control layer for AI agents within Snowflake's platform context | Not established in the provided public source set | Distribution advantage through Snowflake's installed enterprise base and data-platform footprint | [VentureBeat] [Structured Facts] |
| OpenClaw | Named competitor in agent control tooling | Not established in the provided public source set | Open-source or developer-oriented alternative was referenced by name in the research set | [Structured Facts] |
| PromptQL | Named competitor in the broader agent tooling and control set | Not established in the provided public source set | Competes for control at the interface between model output and enterprise action | [Structured Facts] |
| Runlayer | Named competitor in runtime infrastructure for AI agents | Not established in the provided public source set | Positioned around agent runtime operations rather than a pure policy layer | [Structured Facts] |
The table points to a market that is still sorting itself by control point. Kontext appears to sit closest to the "decision before action" layer, while Snowflake is approaching the problem from platform governance and data estate control, and vendors such as Protect AI are associated more broadly with AI security rather than a narrowly defined agent-authorization surface [HTGF] [VentureBeat].
The competitive map breaks into three segments. Second are infrastructure incumbents, where Snowflake Cortex AI Gateway matters because it can package controls inside an environment many large enterprises already buy, reducing adoption friction even if its feature set is narrower than a specialist's at the outset [VentureBeat].
Kontext's most credible edge today is product focus. Public descriptions consistently place the company at runtime, evaluating agent actions before execution and tying decisions to identity, task context, and policy, rather than only scanning prompts or reviewing logs after the fact [Scalable, October 2026] [HTGF] [LinkedIn, retrieved 2026]. For regulated buyers, that is a concrete distinction. The same sources also suggest a design choice, local deployment in the agent environment, that could appeal to banks and fintechs worried about control and auditability [Scalable, October 2026] [Tech Funding News, September 2026]. That edge is real but still perishable. It will last only if the company can turn early architectural clarity into integrations, policy libraries, and evidence trails that are painful for customers to rebuild elsewhere.
The main exposure is distribution. Snowflake does not need to win the category definition to become a serious obstacle if AI-agent controls are bundled into existing data and security budgets, and larger platforms usually have more room to underprice a standalone layer [VentureBeat]. Kontext also does not appear, from the public record, to own a privileged channel such as a hyperscaler marketplace partnership, major systems integrator alliance, or named enterprise distribution partner, which means it may have to earn adoption account by account [Kontext, September 2026] [Tech Funding News, September 2026].
The most plausible 18-month scenario is a split market. Snowflake looks like the winner if enterprise demand consolidates around controls embedded inside existing data platforms, especially for customers that value procurement simplicity over best-of-breed runtime policy depth [VentureBeat]. Kontext is the winner if regulated customers decide that agent actions need a dedicated authorization layer with pre-action enforcement and audit evidence that sits closer to the runtime itself [Scalable, October 2026] [HTGF]. On today's evidence, Kontext has a coherent wedge, but not yet a confirmed moat.
Thinly sourced -- This section mixes a few corroborated public facts about Kontext with limited public detail on named competitors. Several competitor rows are supported only by their presence in the structured research set rather than independently detailed company reporting.
Opportunity
PUBLIC
The prize here is straightforward: if agentic software becomes a normal part of enterprise work, the company that reliably decides what those agents are allowed to do at runtime could end up sitting in a control point that every large deployment needs.
The most credible upside case is not that Kontext becomes another general AI tooling vendor, but that it becomes the authorization layer enterprises insert between autonomous agents and sensitive systems. The public evidence supports that framing. Kontext says its software runs in the agent's environment and evaluates actions before they happen, while external coverage describes a local daemon that checks each tool call against policy controls across organizational and code-level scopes [Scalable, October 2026] [kontext.security, retrieved 2026]. That matters because runtime control is closer to infrastructure than to a single application workflow. The company also appears to be starting in financial services, where the tolerance for uncontrolled autonomous actions is low and the willingness to buy security controls is typically higher than in consumer or SMB software [Tech Funding News, September 2026]. A $4 million seed round led by 42CAP, with participation from a16z CSX and HTGF, is modest by category standards, but it is enough to suggest there is investor appetite behind the thesis that agent security will need a dedicated control plane [kontext.security, September 2026] [Startbase, September 2026].
A few distinct paths could take that thesis from early product-market fit to category-scale relevance.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| Security layer for agentic software teams | Kontext becomes the default runtime authorization layer for enterprises deploying coding and operations agents, first in regulated environments and then across broader software teams | Wider adoption of tools such as Claude Code and Codex inside enterprises raises demand for pre-action controls and auditability [Scalable, October 2026] | The product is already described as evaluating agent tool calls and preventing unauthorized actions by coding agents, which places it directly on an emerging enterprise control surface [Scalable, October 2026] |
| Standard control point for regulated firms | The company wins banks and fintechs early, then uses that reference base to sell into adjacent regulated sectors such as insurance and healthcare | Internal governance or compliance teams begin requiring explicit authorization and decision records for autonomous actions [Tech Funding News, September 2026] [kontext.security, retrieved 2026] | Public reporting already points to mid-sized and large banks and fintechs as the initial buyer set, and the product emphasizes policy enforcement, audit trails, and decision evidence [Tech Funding News, September 2026] [kontext.security, retrieved 2026] |
| Embedded governance layer in the agent stack | Kontext becomes a component that AI platforms, integrators, or enterprise security teams standardize on across multiple agent frameworks | Category validation from larger platforms pushing agent governance into the mainstream, including products such as Snowflake Cortex AI Gateway [VentureBeat, retrieved 2026] | The broader market is converging on the idea that agentic systems need a governing control plane, which helps a focused startup if buyers prefer a specialist rather than building from scratch [VentureBeat, retrieved 2026] [HTGF, retrieved 2026] |
The table points to a category that can compound if the first deployment lands in the right place. The common thread is that Kontext is not trying to own the agent itself. It is trying to own the decision boundary between the agent and enterprise tools.
What compounding looks like in this model is a policy and trust flywheel. A team starts by governing one high-risk agent workflow, then extends the same control layer across more users, repositories, and tools as confidence in autonomous actions rises. Public descriptions of the product already emphasize policy scopes at organization, group, user, agent, repository, and branch levels, plus decision records and risk monitoring, which suggests expansion can happen inside an account without a full product rewrite each time [Scalable, October 2026] [kontext.security, retrieved 2026]. If that pattern holds, every new controlled workflow makes the next one easier to approve because the customer has a clearer map of what agents can access and a record of prior decisions [kontext.security, September 2026]. In security markets, that kind of internal standardization can create sticky distribution even without a classic consumer-style network effect.
The upper bound is easier to frame through category analogs than through company metrics, because no public revenue or deployment figures are available yet. VentureBeat's recent coverage of Snowflake Cortex AI Gateway is useful here, not as a direct comparable on scale, but as evidence that major platforms now see agent control and cost governance as a product category worth building around [VentureBeat, retrieved 2026]. If runtime authorization for AI agents becomes a standard enterprise budget line, a focused independent vendor could plausibly grow into a meaningful infrastructure business before platform consolidation sets in. On a scenario basis, not a forecast, if Kontext were to become a recognized independent control layer for regulated enterprise agent deployments, the end state could resemble a high-value security infrastructure asset rather than a narrow feature company. The exact value is too early to quantify responsibly from public evidence alone, but the category setup supports a venture-scale outcome if agent adoption and security standardization move together [kontext.security, September 2026] [VentureBeat, retrieved 2026].
One source, partially checked -- This section relies on one independently reported funding event, multiple product descriptions from company materials, and selective corroboration from Scalable, Tech Funding News, Startbase, HTGF, and VentureBeat.
Sources
Publicly reported
[Scalable, October 2026] Kontext: $4M per la sicurezza degli agenti AI | https://www.scalablepod.it/startup/kontext/
[HTGF] Kontext raises $4M to stop AI agents from going rogue at work | https://www.htgf.de/en/kontext-raises-4m-to-stop-ai-agents-from-going-rogue-at-work/
[Tech Funding News, September 2026] Kontext raises $4M to put guardrails on AI agents for banks and fintechs | https://techfundingnews.com/kontext-4m-seed-ai-agent-security-banking-fintech/
[Crunchbase] Kontext - Crunchbase Company Profile & Funding | https://www.crunchbase.com/organization/kontext-5c20
[LinkedIn] Jens Ernstberger, PhD - Kontext | LinkedIn | https://www.linkedin.com/in/jens-ernstberger-phd-96b0ba14a/
[Startbase, September 2026] Kontext erhält 3,5 Millionen Euro für die Kontrolle von KI-Agenten | https://www.startbase.de/news/kontext-erhaelt-35-millionen-euro-fuer-die-kontrolle-von-ki-agenten/
[kontext.security] Kontext | Runtime Control & Runtime Authorization for AI Agents | https://kontext.security/
[Kontext, September 2026] Kontext raises $4 million led by 42CAP, with backing from a16z CSX and HTGF, to expand its team and build runtime security for AI agents. | https://kontext.security/blog/kontext-raises-4m-funding
[kontext.security, retrieved 2026] Kontext | Runtime Control & Runtime Authorization for AI Agents | https://kontext.security/
[aVenture News, September 2026] Kontext raises $4M to stop AI agents from going rogue at work | https://ffnews.com/news/kontext-raises-4m-to-stop-ai-agents-from-going-rogue-at-work-a572f4f2
[VentureBeat] The three layers of agentic AI security: A defense-in-depth architecture for autonomous agents | https://venturebeat.com/security/the-three-layers-of-agentic-ai-security-a-defense-in-depth-architecture-for-autonomous-agents
[VentureBeat, retrieved 2026] Snowflake launches Cortex AI Gateway to control AI agents and prevent runaway enterprise costs | https://venturebeat.com/security/snowflake-launches-cortex-ai-gateway-to-control-ai-agents-and-prevent-runaway-enterprise-costs/
[LinkedIn, retrieved 2026] Paul Zimmermann - Conlio | LinkedIn | https://www.linkedin.com/in/paul-clemens-zimmermann/
Articles about Kontext
- A Runtime Daemon Vets Every AI Agent Tool Call — The startup’s local policy engine, built by a team with PhDs in cryptography, targets financial services as its first customer wedge.