Cymphony’s new funding highlights a practical problem: AI agents can inherit access to sensitive files without anyone having a clear view. UAE owners need a permissions map before automation spreads.
Cymphony’s funding matters less than the security problem behind it. AI agents are beginning to work across company systems, using permissions that may have been created for employees, contractors or software integrations. The sensible response for a UAE business is not to ban every AI tool. It is to find out which agents can reach which files, systems and customer records before giving them more work.
TechCrunch reports that Cymphony has raised new funding for a platform that maps employees, AI agents and other non-human identities against the systems and sensitive data they can access. The company calls this combined view a “workforce graph”. (techcrunch.com)
Traditional access reviews are built around people. A manager joins, changes role or leaves. An administrator updates the account. The process is familiar, even if it is often incomplete.
AI agents are less tidy. They may use several connected systems, follow different routes to complete a task, gain new capabilities at runtime or create other agents. That makes it harder to answer a simple question: what can this identity reach right now?
Cymphony combines identity, data and activity signals. Its platform is designed to show the relationship between a person or agent, the tools it can use and the information it can reach. It can then investigate incidents, prioritise risks and automate some permission changes, with a managed service available for more complex cases. (techcrunch.com)
An AI assistant is not only a productivity tool. It is another identity with a route into the business.
The clearest example is not a theoretical attack. Cymphony told TechCrunch that it found about 85,000 files at one US public company that had become accessible to AI tools and agents. The company said it helped close the exposure and verified that the files had not been accessed through those AI systems.
In another case, an external collaborator installed an unsanctioned version of Anthropic’s Claude. It used the collaborator’s existing access to scan thousands of sensitive files. The important lesson is that the risk can start with a legitimate user account. The business may not have added a malicious employee or suffered a stolen password. It may simply have allowed an AI tool to use permissions that were already too broad. (techcrunch.com)
For a smaller company, this does not automatically mean buying Cymphony or another enterprise security platform. It does mean treating AI access as part of basic operational control.
A UAE retailer, consultancy, clinic, distributor or restaurant group should be able to list:
If that list does not exist, more automation will make the uncertainty larger. The first job is discovery, not deployment.
This is close to the wider question covered in Barracuda AI data security for UAE SMEs, although the Cymphony story goes further by treating AI agents as identities that need to be mapped across the business.
Start with one workflow rather than the whole company. Pick the process with the most sensitive information, such as sales proposals, employee records, supplier contracts or customer support.
Create a simple access table. Put the user or agent in one column, the connected system in another, the type of data in a third and the action allowed in a fourth. “Read”, “edit”, “send” and “delete” are not the same permission.
Then remove access that the workflow does not need. A customer-service assistant may need to read order status, but not download every customer document. An accounting automation may need invoice data, but not unrestricted access to staff files.
Keep a record of exceptions. If someone connects an AI tool outside the approved process, the business should know who approved it, what it can access and when the permission will be reviewed.
For companies already connecting several systems, ERP and automation planning may help organise the workflow inventory. It is not a substitute for a specialist cyber-security assessment, but it can make the systems and permissions being automated more visible.
Sometimes the right decision is to do nothing beyond tightening existing controls. If only one owner uses an AI assistant for drafting public marketing copy, there may be no need for a new security platform. Keep confidential files out of the tool and use separate business accounts.
A company with shared drives, multiple software integrations and AI tools connected to internal data has a different problem. It should review access before adding another agent, not after an incident. The review can begin in a spreadsheet if the business is small. The important part is that someone owns it and repeats it when staff, systems or permissions change.
Paknology has a commercial interest in the automation part of this discussion. It provides ERP and automation work, along with websites, apps, company formation, ecommerce, restaurant POS, digital marketing and WhatsApp Business API services. It does not provide Cymphony’s security platform or claim to replace a cyber-security specialist.
A cheaper or simpler option may serve you better: document the access already granted, reduce unnecessary permissions and use the controls in the software you already pay for. If the review exposes a wider automation project, talk to us with your systems list ready.
Book a free consultation and get a clear roadmap — from company formation to a fully automated digital operation.