Bloom Security has launched from stealth with $20 million in seed funding, a round first reported by Axios, to secure what it calls the AI-native endpoint, the increasingly complex layer of AI agents, extensions, and code now running on employee devices. The Tel Aviv-based company announced the round today, led by Glilot Capital Partners, with participation from Ten Eleven Ventures (1011vc), Okta Ventures, and Runtime Ventures. Angel investors in the round include founders of Dig Security, Demisto, Snyk, and Talon.
The Announcement
The funding will support a platform already in production use. Bloom Security is deployed at dozens of large enterprises across the United States and Europe, where customers are using it to gain visibility into their endpoints and replace rigid blanket policies with contextual remediation. The company is targeting large enterprises adopting AI at scale.
Bloom Security was founded by a team with a record of building enterprise security companies from zero to acquisition. It currently employs 30 people, many of whom previously worked together at Dig Security.
Why the Company Exists
According to Bloom Security, the endpoint itself has changed. Devices that were once managed and predictable have become ecosystems of agentic software, MCP servers, browser extensions, and code packages that employees assemble daily. Browsers, IDEs, and AI agents now ship with their own app stores and marketplaces, creating a software layer that grows faster than any security team can track. Existing security infrastructure was never built to see it.
“In the AI era, the employee device is no longer just a managed endpoint,” said Itay Keren, Co-Founder and CEO of Bloom Security. “Every endpoint is now running software no one reviewed, connecting to services no one provisioned.”
Traditional endpoint detection and response tools were designed for malware: binaries, executables, and malicious processes. Bloom Security argues that malware is now only part of the problem. A misconfigured AI agent, a plugin with excessive data permissions, a screen recorder on an executive’s laptop, or a code library pulling from an untrusted source can all create dangerous attack paths. Risk starts with what is already running, and most security teams lack a way to control it.
“As AI adoption accelerated, it became clear that existing endpoint controls were not designed for this new reality,” Keren added. “Security teams need a way to understand, govern, and control modern tools without disrupting how employees work.”
What the Platform Does
Bloom Security combines contextual visibility, proactive enforcement, granular remediation, and proactive prevention in a single platform. It provides a holistic view of every piece of software running across every endpoint, covering tools, extensions, and code, along with the context of how they interact with data and systems. The platform analyzes supply chain risk and examines configurations and permissions to understand actual exposure.
Context is central to the product’s design. “The same tool can be completely acceptable on one endpoint and high-risk on another,” said Ofir Balassiano, Co-Founder and Chief Product Officer at Bloom Security. “Risk depends on context: the user’s role, their access to sensitive data, the other tools operating on that endpoint, their configurations, and how everything interacts. Bloom Security was designed to evaluate that context in real time.”
Beyond visibility, teams gain active control at every stage. Users can block risky installs before they reach employee endpoints, enforce secure configurations directly, and remediate risks without manual approval workflows or disruption to employee work.
The Team Behind It
CEO Itay Keren previously held engineering and sales engineering leadership roles at Palo Alto Networks, Dig Security (acquired by Palo Alto Networks), and Demisto (acquired by Palo Alto Networks). Before entering cybersecurity, Keren served as a Naval Officer, leading teams in high-pressure environments.
Chief Product Officer Ofir Balassiano led the Cortex Cloud Posture Security research group at Palo Alto Networks, focusing on AI, identity, and data security. He previously led the research group at Dig Security and served as a Senior Security Researcher at XM Cyber, beginning his career in the IDF’s Mamram Unit.
Chief Technology Officer Itay Frishman is an engineering leader who built core AISPM and DSPM solutions at Palo Alto Networks and Dig Security, with prior cybersecurity R&D leadership experience in the IDF’s Unit 81.
“While this is technically our first company as founders, our team has built and integrated category-defining products before,” said Frishman. “We understand how enterprise security environments operate, and we built Bloom Security specifically for the reality of how endpoints are used today.”
The Investor View
Glilot Capital Partners, which led the round, framed the investment as a bet on both the problem and the people. “AI has changed the enterprise endpoint in ways the security industry is still catching up to. Agents, MCP servers, browser extensions, and code packages now run on every employee’s machine, entirely outside the reach of traditional controls,” said Kobi Samboursky, Founder and Managing Partner at Glilot Capital. “Bloom identified this gap before the market did, and the business traction we’ve seen in their first months is unprecedented for a company at this stage. A team this experienced with a problem this urgent and momentum this strong is what category-defining companies look like from day one.”
What Comes Next
The launch positions Bloom Security in one of the most underprotected layers of modern enterprise security. The company describes its mission as delivering clarity, governance, and active enforcement to the AI-native endpoint. It aims to create a secure environment where productivity tools can be used to their full potential, free from unnecessary risk.
With enterprise deployments already underway on two continents, a founding team drawn from acquired security companies, and $20 million in fresh capital, Bloom Security enters the market with an argument that will resonate with any organization watching AI tools multiply across its fleet. The endpoint has changed. The company is betting that endpoint security must change with it.