AIR, an Israeli AI-agent security company, emerged from stealth with $50 million across two seed rounds closed within weeks of each other. According to TechCrunch's September 1, 2026 report, Sequoia led the first, a $10 million round, and Greenoaks led the second, worth $40 million. The company addresses a practical question: which tools and components enterprise agents use, and who checks them along the way.
The founders are CEO Yair Saban and CTO Niv Hoffman. Both are veterans of Israel's Unit 8200, where they worked in offensive cybersecurity. The product is designed to discover AI agents inside a company, continuously vet their skills, tools and third-party components, and prevent interactions with components that fail its security criteria. That describes the company's offering, rather than guaranteeing that an agent is protected against every possible error.
Two rounds and two lead investors
The total consists of two transactions: $10 million led by Sequoia, followed by $40 million led by Greenoaks. TechCrunch reported that the rounds closed within weeks. That structure should be retained, rather than presenting the entire amount as a single investment transaction. The amount also does not establish the company's valuation or either fund's terms, which were not disclosed in those figures.
Additional investors named in reporting include Swish and Netz, alongside angels Zach Frankel, president of Cognition; Yinon Costica, co-founder of Wiz; Ofir Ehrlich, co-founder of Eon; Anne Neuberger; Omer Adam; and Varun Anand, co-founder of Clay. The list identifies financing participants. It is not evidence of the system's performance, nor does it mean the companies associated with those investors are AIR customers.
The Israeli connection follows directly from the founders' identities and professional backgrounds. Understanding the product, however, requires moving from the funding to the control point it aims to create. The question extends beyond who built an agent or which model powers it. It also concerns the components an agent loads, the sources it uses and how an organization decides what it may encounter during work.
First, identify which agents are running
The first stage in the platform description is discovery: identifying AI agents operating within an organization. This provides a foundation for tracking the tools they use. An organization defining policy for a component needs to understand where it is used and which agents may depend on it. Mapping and vetting are therefore connected parts of a view of usage, rather than entirely separate tasks.
On top of that mapping sits continuous vetting of skills, tools and third-party components. In practical terms, a skill adds instructions or capability to an agent's workflow. The name itself is not a security approval. Even when a component fits a task, the question remains whether it meets the organization's intended policy. AIR presents ongoing evaluation of the ecosystem around an agent as a central part of its product.
This also distinguishes knowing a component exists from deciding it can be used. An agent inventory offers visibility, but does not by itself determine whether an action should proceed. AIR's description connects that visibility to an enforcement layer. The organization can therefore identify dependence on a component and impose conditions before an agent interacts with it.
Enforcement where the agent takes action
According to TechCrunch, AIR's enforcement layer can intercept actions such as loading a skill or fetching web content. It checks relevant actions and components against a maintained whitelist, and can block interactions that fail its criteria. The emphasis is on checks during work, rather than simply displaying an inventory after an agent has finished a task.
A whitelist defines a boundary between components that meet specified conditions and those that are not permitted. But the word "approved" does not explain what was examined. An organization assessing such a system should ask what the criteria cover, how re-evaluation works and what happens when an action is blocked. Those are questions for a potential customer to ask, not claims that the product already supplies a particular answer.
Blocking is also different from guaranteeing that the task succeeds. An agent might use only approved components and still produce an answer requiring professional review. Conversely, a block may stop a process that a person must decide how to continue. Component and interaction security should therefore be distinguished from the correctness of a business outcome. These are different layers of responsibility and control; one does not remove the other.
A marketplace of vetted add-ons, and the limits of approval
AIR also operates a marketplace of vetted add-ons. The idea complements enforcement: alongside stopping components that do not meet requirements, an organization gets a place to find reviewed components. Vetting an add-on must still be distinguished from determining whether it fits a particular need. A reviewed add-on does not necessarily require every permission it requests for every possible use, and the organization needs to define its own task boundaries.
For managers and technology teams, the financing highlights a focused product category: securing the tools and sources that AI agents encounter while working. Evaluate suitability through a defined scenario, such as loading a component or accessing content, and establish what the system sees, checks and does when it blocks something. That offers a more practical basis for assessment than the financing amount alone.
The two rounds provide AIR with $50 million, but the product's question is smaller and more tangible: before an agent uses another tool, has anyone checked it, and can the organization stop its use? This is where agents expanding their capabilities meet businesses that need to retain control. The product proposition lies in continuous oversight of that encounter, beyond simply adding another AI component to a system. When evaluating a provider, ask it to distinguish a component it does not recognize from one it has examined and blocked. These situations leave the organization with different information, and their explanation should help the responsible person understand what still needs clarification before work continues.