Obsidian Security Raises $85 Million at $1.1 Billion Valuation

Obsidian Security raised $85 million at a $1.1 billion valuation. The company builds a platform for governing AI agents across third-party applications. SecurityWeek reported the round and the product focus together, which frames the raise as growth capital for agent-control tooling rather than a pure brand or infrastructure story.

The product centers on governing AI agents as they act inside third-party applications. That problem sits between identity, authorization, and runtime policy: agents do not only read data, they call tools, change state, and chain actions across SaaS systems. A governance platform in that layer has to see which agent is acting, which app and API it is hitting, what permissions and scopes it holds, and whether the sequence of actions matches allowed behavior. Without invented architecture claims, the stated scope already implies continuous visibility and control over agent-to-app paths, not a one-time config checklist.

For engineers and builders, that matters because agent features are shipping into production stacks that already depend on third-party apps for CRM, tickets, code, and cloud ops. Once an agent can act with user or service credentials, the blast radius is app-wide, not chat-wide. Builders integrating agents need clear answers on who approved the agent, what it can touch, how actions are logged, and how to revoke or constrain it when behavior drifts. A dedicated governance layer is a response to that gap when existing IAM and CASB controls were designed for human users and static integrations.

Market context follows from the same product definition. AI agent products are proliferating, and each one multiplies connections into third-party applications. That creates demand for control planes that sit above any single vendor’s agent runtime. Obsidian’s $85 million raise at a $1.1 billion valuation signals investor conviction that agent governance is a category large enough to support a unicorn-scale security vendor, not a feature buried inside one app suite. Competitors will range from adjacent security platforms adding agent policies to agent vendors shipping their own admin controls; the open question is who becomes the system of record for cross-app agent authority.

Practical takeaway for security and platform teams: treat agent access to third-party applications as a first-class control surface now, not after an incident. Inventory which agents exist, which apps and credentials they use, and whether any single system can revoke or constrain them end to end. What to watch next is whether Obsidian turns this raise into broader coverage of agent types and application surfaces, and whether buyers standardize on an independent governance platform or keep control fragmented per app and per agent vendor.