Cymphony’s latest funding highlights a growing risk for UAE companies: AI agents can inherit access to sensitive business data. Most firms should prepare now, but not rush to buy a new platform.
Not yet, for most companies. Cymphony’s funding is a useful warning, not proof that every UAE business needs a new security platform today. The sensible first move is to find out which AI tools, agents, employees and contractors can reach customer, finance and operational data.
Cymphony has raised $30 million, including a $25 million Series A co-led by Sequoia Capital and SMBC Fin Atlas Beyond Fund. TechCrunch reports that the company is valued at more than $100 million after the investment. Cymphony says its product gives security teams one view of human employees, AI agents and other nonhuman identities, alongside the systems and sensitive data they can access. Cymphony describes its Workforce Graph here.
AI security starts with knowing which identities can reach which data.
The funding follows Cymphony’s move from an early-stage idea into a product with a double-digit number of enterprise customers and seven-figure annual recurring revenue, according to the company’s comments to TechCrunch. Its named customers include KKR, Syngenta, Cass Information Systems and Athennian.
The problem is that AI agents do not always follow the same identity and access controls as employees. They may connect to several systems, process large volumes of data and change how they work while completing a task. That makes a traditional list of users and permissions less useful on its own.
Cymphony says its “workforce graph” combines identity, data and activity signals. Its platform is designed to show who or what has access, what that access can reach and what activity is taking place. It also claims to investigate incidents, prioritise risks and automate some fixes, such as correcting permissions.
The company gave TechCrunch one example involving about 85,000 files that had become accessible to AI tools and agents at a US public company. Cymphony said it helped close the exposure and verified that the files had not been accessed through those AI systems. That is a company-reported result, not an independent audit.
The important change is not the funding round itself. It is the shift from treating AI as a software purchase to treating it as another type of business identity.
A customer-service assistant may connect to a CRM. A finance tool may read invoices or payment records. A coding assistant may receive source code or credentials. A marketing plugin may sync customer information. If those connections are approved without a clear owner, the business may not know what the agent can see or whether its access is still needed.
Cymphony’s own website focuses on four areas: AI-tool visibility, exposed data, identity access and threat activity. It also markets an AI assistant called Maestro, which can investigate risks in plain language and help automate remediation. Those capabilities may interest larger organisations with many cloud systems, contractors and AI deployments.
For smaller firms, the immediate lesson is simpler. Create an inventory of AI tools and integrations. Record the data each one can access. Assign an owner. Remove unused connections. Review admin accounts and MFA, and avoid giving an agent wider access than its task requires.
Usually, no. Cymphony is still a young company. TechCrunch reports that it has about 30 employees, that most customers are in North America and that it is only beginning to see demand in Europe, the Middle East and Africa. Its own investor describes the product as an additional layer today, rather than a replacement for established identity tools.
That makes a trial more reasonable for a large UAE group with several business units, sensitive information and a growing number of AI agents. It is less compelling for a small company that has only a few approved tools and has not yet completed a basic access review.
The lower-risk path is to use the controls already available in your identity, cloud and business software, then document where they fall short. If the exercise reveals scattered permissions or unclear system ownership, address those gaps before adding another dashboard. Paknology can help organise operational systems through its ERP and automation service, but that is not a substitute for specialist cybersecurity work.
Ask three questions this month: which agents exist, what can each one access, and who approves that access? Keep the answers in one maintained register. Recheck it whenever a new AI tool, integration or automated workflow is introduced.
If you operate a large environment, ask Cymphony for evidence relevant to your systems, including deployment scope, regional support, integrations, data handling and how automated remediation is controlled. If you cannot answer those questions yet, the honest answer is not yet: improve visibility first.
Paknology has a commercial interest where this leads to ERP or automation work, and its ERP and automation service may suit a business trying to bring operational systems into better order. A cheaper or simpler option will serve you better if a documented access review using existing tools is enough; Paknology does not provide a dedicated AI-agent security platform.
Sources
Book a free consultation and get a clear roadmap — from company formation to a fully automated digital operation.