Threat Intelligence & APT SecurityWeek 2 weeks ago

Rig Security Emerges From Stealth With $12M to Tackle Agentic AI Identity Risks

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Rig Security has emerged from stealth with $12 million in seed funding and an identity protection platform built for the agentic era. The funding round was led by Ten Eleven Ventures and Brightmind Partners with participation from the CrowdStrike Falcon Fund and a range of angel investors. Tel Aviv-based Rig Security was founded in 2025 by Guy Kozliner (CEO). He was formerly a member of the CTO..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Rig Security has emerged from stealth with $12 million in seed funding and an identity protection platform built for the agentic era. The funding round was led by Ten Eleven Ventures and Brightmind Partners with participation from the CrowdStrike Falcon Fund and a range of angel investors. 

Tel Aviv-based Rig Security was founded in 2025 by Guy Kozliner (CEO). He was formerly a member of the CTO team at Wiz, the firm co-founded by its CTO Ami Luttwak and a pioneer in graph security solutions. Kozliner realized the graph approach he used at Wiz could also be applied to the new human/AI identity problem. Luttwak, noticeably, is one of Rig’s angel investors.

Autonomous Ai agents adopt the identity of the developer or service that created or launched them. Once launched, they act with all the permissions of their assumed identity; but a SIEM cannot distinguish an action between the legitimate human user and a rogue or subverted agent. Anything the source user is allowed to do, the agent can also do with impunity.

This breaks traditional security tooling. The standard approach is to block an unrecognized dangerous act. But rogue agents act at machine speed and independent of their creator, and this makes the standard remediation – disable the account – unusable, because it also blocks the employee.

It is a new and dangerous gap in security. Identity has long been the dominant breach vector, but the arrival of autonomous agents acting independently and with apparently legitimate permissions has made a difficult situation much worse.

Rig Security and the Rig platform intend to close this gap by understanding whether an action is the legitimate action of a permissioned user or the dangerous action of an agent using the user’s identity.

Advertisement. Scroll to continue reading.

“Today the most active identities in an enterprise are AI agents, and they are acting under human names. Security teams can see that an account did something dangerous. What they cannot see is whether a person did it or an agent did, and they cannot stop the agent without blocking the person,” comments Guy Kozliner, founder and CEO at Rig Security. “The problem is access that is broader than intended, ungoverned, and hiding behind human activity.”

There are two primary components to the Rig solution: RICE (Rig identity correlation engine) and Bifrost (its endpoint sensor).

Written By Kevin Townsend

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →