Bloom Security secures $20 million in seed funding as AI transforms operations on enterprise endpoints.

      **TL;DR** Bloom Security has secured $20 million in seed funding from Glilot Capital and Ten Eleven Ventures to enhance security for endpoints in the AI era. The company asserts that traditional EDR solutions were designed for malware, not the AI agents, MCP servers, browser extensions, and code packages that are now common on employee devices. Their platform offers contextual visibility across all endpoint software and implements risk-based policies without sweeping lockdowns. It has already been adopted by numerous large enterprises in the US and Europe.

      The workplace landscape has significantly changed over the past three years. Employees now create their own toolkits daily, utilizing AI agents, browser extensions, code packages from public registries, and MCP servers linking various tools. AI tools have become essential, transforming the device on every desk into a complex ecosystem that current security measures are not equipped to handle.

      Bloom Security, which announced its launch today after a $20 million seed funding round highlighted by Axios, aims to address this gap. The funding was led by Glilot Capital Partners and Ten Eleven Ventures, with additional investments from Okta Ventures and Runtime Ventures, as well as contributions from the founders of Dig Security, Demisto, Snyk, and Talon.

      **The Nature of Change**

      The Tel Aviv-based company points out that the enterprise endpoint landscape has changed fundamentally. Previously managed devices have transformed into complex systems of software agents, MCP servers, and code packages. With browsers, IDEs, and AI agents now featuring their own app stores, the software on employee devices evolves rapidly, making it challenging for security teams to keep pace. Current security frameworks were not designed to accommodate this evolution.

      “In the AI era, the employee device is no longer just a managed endpoint,” stated Itay Keren, Co-Founder and CEO of Bloom Security. “Every endpoint is now running unreviewed software and connecting to unprovisioned services.”

      The traditional approach to endpoint detection and response was built for a different threat landscape, primarily targeting malware like binaries and malicious processes. However, on modern endpoints, the threats often arise from legitimate tools that are misconfigured or excessively permissive. Everyday tools, such as AI agents or plugins, can pose significant risks. Most security teams currently lack effective means to manage these risks.

      Bloom Security proposes a comprehensive endpoint security architecture that combines detailed contextual visibility, proactive enforcement, fine-grained remediation, and prevention within a single platform. Rather than enforcing blanket lockdowns, the goal is to manage the complexity of modern endpoints, allowing productivity tools to be utilized safely.

      The platform provides security teams with a complete overview of all software running on every endpoint, from tools to extensions to code, and how each interacts with systems and data. It assesses supply chain risk, configuration, and permissions to evaluate real exposure.

      The core principle of Bloom’s product is that risk is situational. “The same tool can be completely acceptable on one endpoint and high-risk on another,” explained Ofir Balassiano, Co-Founder and Chief Product Officer. “Risk is contingent on context: the user's role, access to sensitive data, the other tools on that endpoint, their configurations, and interactions. Bloom Security was crafted to assess that context in real-time.”

      Enhanced visibility facilitates action. Security teams can prevent risky installations before they reach endpoints, enforce secure configurations directly, and address risks without cumbersome approval processes or disrupting employee workflows.

      “As AI adoption surged, it became evident that existing endpoint controls were outdated for this new landscape,” Keren remarked. “Security teams require a means to comprehend, govern, and manage modern tools without hindering employee productivity.”

      **A Seasoned Team**

      The founders of Bloom Security come with notable experience, having previously held leadership roles at various cybersecurity companies, including Palo Alto Networks, Dig Security (acquired by Palo Alto Networks), and Demisto (also acquired by Palo Alto Networks). CEO Itay Keren has a background in high-pressure environments as a Naval Officer and in cybersecurity. Chief Product Officer Ofir Balassiano has experience leading AI, identity, and data security projects, while Chief Technology Officer Itay Frishman has developed core security solutions.

      “This may be our first venture as founders, but our team has previously built and integrated leading products,” Frishman noted. “We have a deep understanding of how enterprise security operates and designed Bloom Security to suit the current usage of endpoints.”

      Currently, the company employs 30 people, many of whom have collaborated at Dig Security.

      **Early Success and Future Goals**

      Although Bloom Security is just now emerging from stealth mode, it is already utilized by numerous large enterprises in the US and Europe. Clients are gaining complete visibility into their endpoints and moving away from rigid policies in favor of precise, contextual remediation. The company mainly targets large enterprises adapting to AI on a large scale.

      This early traction has attracted attention from investors. “AI has transformed the enterprise endpoint in ways that the security industry is still adapting to,” stated Kobi Samboursky, Founder and Managing Partner