Hush Security raises $30M to govern AI agents at runtime

Why it matters

AI agents are gaining authority inside enterprise systems faster than access controls are adapting. Hush is betting runtime identity, backed by Akamai's reach, becomes the enforcement layer.

Hush Security, founded by cybersecurity veterans Micha Rave, Shmulik Ladkani, Alon Horowitz and Chen Nisnkorn, raised a $30 million Series A to build identity and access controls for enterprise AI agents. Hush announced the financing on July 28, naming Akamai Technologies as a strategic investor alongside returning backers Battery Ventures and YL Ventures.

The round brings Hush's reported funding to $41 million less than a year after the Tel Aviv-based cybersecurity developer emerged from stealth. Battery and YL led an $11 million seed round announced in September 2025. Hush plans to use the new capital to expand engineering and sales, particularly in the United States, deepen integrations with enterprise identity and AI platforms, and add corporate partnerships.

For Rave and his co-founders, Hush is a second attempt to rebuild access control around a change in how software operates. The group previously worked together at Meta Networks, a zero-trust access developer that Proofpoint acquired in 2019. The founders have carried the same basic concern into Hush: credentials designed for people and predictable applications become a security liability when software can choose tools, call services and act across internal systems without waiting for a human at each step.

Rave has spent more than 25 years working across cybersecurity, cloud, virtualization and embedded systems, according to his SecureWorld biography. He previously led product groups at Proofpoint, Meta Networks, Redbend, SanDisk and HARMAN, holds more than 22 patents, and studied electrical engineering at Technion. That product background shapes Hush's pitch. Rave is trying to replace the static credentials stored in vaults with access that is issued only when a verified workload or agent needs it.

Turning an old machine-identity thesis toward agents

Hush began with service accounts, workloads and other non-human identities. The Series A extends that architecture to autonomous agents, a shift that broadens Hush's addressable market while keeping the underlying technical bet intact.

Rave said agents need "strict identity" because they can initiate actions inside sensitive systems. Under Hush's model, each agent enters a central registry, receives scoped just-in-time permissions and has its actions logged. Administrators can revoke access through a central kill switch. Hush also maps the tools, Model Context Protocol servers and resources that managed or shadow agents can reach.

The critical distinction in Hush's product positioning is enforcement at runtime. Hush's product materials describe the platform as replacing static secrets, API keys, tokens and standing privileges with dynamic, scoped, just-in-time identity-based access across workloads, pipelines, databases, services, AI agents and MCPs. That is meant to move security work beyond finding exposed secrets or producing an inventory of machine identities.

For large enterprises, the hard part is operational: replacing embedded credentials can require security, engineering and infrastructure teams to agree on where access is issued, observed and revoked.

The clearest commercial evidence attached to the round is Kyndryl. Hush says Kyndryl has deployed the platform internally and begun reselling it to enterprise clients. Hush also says multiple Fortune 500 customers use its technology, without publishing revenue, customer totals or paid deployment counts.

Kyndryl's reseller role offers Rave a route into large accounts that a young security developer would struggle to reach alone. Akamai could provide a second route into security organizations already buying infrastructure and access products, although the financing announcement identifies Akamai as an investor and does not describe a joint product or resale agreement.

Security vendors are converging on agent identity

The round arrives as identity vendors and large security platforms move toward similar capabilities. Cisco announced plans in June to acquire Astrix Security, citing discovery, lifecycle management and threat detection for agents and other non-human identities. SailPoint also announced a June deal for Entro Security, bringing machine credentials and autonomous agents into its identity-governance portfolio.

Venture investors are funding independent contenders as well. Opal Security raised $23 million in June to govern access across employees, service accounts and agents. Token Security introduced intent-based controls in March, using an agent's stated purpose and observed behavior to determine what it should be allowed to access.

That activity gives Hush a favorable market window and a narrowing path to differentiation. Discovery, inventories, least-privilege policies and agent lifecycle management are rapidly becoming standard promises across the category. Hush is staking its position on secretless runtime enforcement: verify the agent when it acts, issue narrowly scoped access, and remove the standing credential that attackers could steal or reuse.

Akamai's participation strengthens that positioning. Battery and YL were already backing the founders and their original machine-identity thesis. Akamai is joining after Hush expanded the product toward AI-agent governance and began working with Kyndryl. The strategic investment gives Hush an industry backer with existing relationships across enterprise infrastructure and security, even as the practical scope of the relationship remains defined by investment rather than a disclosed product integration.

Rave and his co-founders now have the capital to test whether their architecture can become a control layer across competing clouds, identity providers and AI platforms. The Meta Networks history gives the group experience selling a new access model into enterprises. Hush's next task is larger: persuading security leaders to replace the credentials already connecting autonomous software to production systems, before incumbent identity vendors absorb the category.