Neo raises $100M to stop rogue AI agents inside your company

Neo emerged from stealth this week announcing a $100 million（約160億円） seed and Series A investment led by Andreessen Horowitz and Bessemer Venture Partners, with additional backing from Craft and Merlin Ventures. The cybersecurity startup was founded by Nick Warner, who previously served as chief operating officer at SentinelOne, where he built the company's go-to-market organization and helped take the company public in 2021. His co-founders are Shlomi Salem, who led detection engineering and threat research at SentinelOne for more than a decade, and Eran Shirazi, who co-founded customer workflow AI firm EasySend and previously ran a vulnerability research group in Israel Defense Forces' elite signal intelligence unit, Unit 8200.

The company's core problem is illustrated by an anecdote Warner shared: a meeting with three humans was joined by about seven AI notetakers, each running independently and unaccounted for. Salem has three of his own notetakers and frequently disables them during meetings, only for one to keep trying to resurrect itself. Warner's quip—"Just racking up tokens"—captures both the absurdity and the cost. The issue stems from how AI tools evolve. A company might approve a single AI notetaker to capture meeting minutes. Over time, the vendor adds features: summarization, email drafting, integration with other systems. Permissions that were reasonable when the tool was simple become dangerous when it develops agentic capabilities—the ability to reason, call other tools, and act independently. Yet most companies cannot see this drift happening inside their systems at all.

Neo has built what Warner calls a "full endpoint sensor"—software that sits on the machine where a person and an AI tool actually meet. The product performs three critical tasks: inventorying every piece of agentic software installed, assessing how each is configured, and enforcing policies on what each is permitted to do. Warner claims Neo is the first to combine all three into a single product. This approach breaks from the prevailing security consensus of a year ago, which focused on monitoring communication channels between AI systems. The theory was that guarding chokepoints would protect everything. But Warner argues this approach is now obsolete because frontier models (the most advanced AI systems) can directly call tools, operate computers, and route themselves around monitored communication channels completely. Older defenses also fail because they work by baselining normal behavior and flagging deviations—a technique that cannot work with software that reasons on its own and has no fixed baseline.

Warner described the security gap as "a communication channel, medium, and a dimension that customers around the world, large and small, are almost entirely blind to." He believes solving it required a "clean sheet redesign" and claims it will be hard for larger security companies to keep up. Though Warner declined to share financial metrics, he said Neo is already running in financial services, healthcare, insurance, and manufacturing companies. His vision for success centers on community adoption: if the cybersecurity industry finds Neo stable, easy to deploy, and well-integrated with existing tools, the company will become a reference point in peer conversations about fighting AI-related threats—turning customers into advocates. Zane Lackey, a general partner at Andreessen Horowitz, and Elliott Robinson, a partner at Bessemer, have taken seats on Neo's board, signaling their confidence in both the founding team and the thesis.

Neo's founding reflects a tension that has emerged as AI agents become more capable and autonomous. Nick Warner, who spent years building SentinelOne's sales organization before the company went public in 2021, saw firsthand how security gaps widen when software capabilities outpace the permissions users originally granted. The company's anecdote about AI notetakers is telling: what began as a sensible choice—one tool to keep meeting notes—morphed into a situation where multiple unauthorized instances spawn within a single meeting, each burning tokens (the computational cost of AI inference) and operating under permissions now misaligned with their actual behavior.

Warner's critique of the existing security approach is deliberate: the industry's consensus a year ago centered on monitoring communication channels between AI systems, the theory being that guarding chokepoints would protect everything. But Warner argues this is already obsolete because frontier models can operate directly on computers and bypass monitored channels. The older approach of baselining normal behavior and flagging deviations also fails with agentic software that reasons independently—there is no static baseline to measure against. Neo's solution is a clean break: place a sensor at the endpoint itself, where the human and AI actually meet, and enforce policy there instead. The board seats for Lackey and Robinson signal that Andreessen Horowitz and Bessemer see this thesis as credible enough to warrant their active governance.

Warner's framing of success is notably social rather than purely technical: he believes Neo will win if the cybersecurity community finds it stable, easy to integrate, and worthy of being discussed and recommended among peers—"fans" rather than just customers. This suggests he understands that in enterprise security, trust and word-of-mouth are often as important as the technology itself.

No comments yet. Be the first to share your thoughts!