Enterprises Gave AI Agents the Keys. Nobody Kept Copies.

01 /The Concept

Ask an enterprise CISO how many AI agents are running on their infrastructure right now. Most cannot answer. They know how many employees they have. They do not know how many agents those employees have provisioned, what systems those agents have accessed, or what permissions those agents still hold from tasks completed months ago.

Enterprise identity and access management was designed for humans: assign a role, grant permissions, audit the log, revoke access when they leave. The model works because human identities are stable, bounded, and finite.

An agent provisioned to read customer records for a support task may, given the wrong prompt, write to those records, email a customer autonomously, or query a database it was not supposed to touch. Unlike a human employee, it does not have working hours. Unlike a human employee, it may be running hundreds of parallel sessions simultaneously. Unlike a human employee, no existing IAM system was designed to govern it — the access control assumptions of Okta, CyberArk, and SailPoint were all built before non-human identities became the majority identity type in enterprise environments.

Hush Security, founded in 2024 by the team that built Meta Networks before its $120 million acquisition by Proofpoint, provides what it calls a machine access platform. The core mechanism is just-in-time permission scoping: rather than granting an AI agent standing access to enterprise systems, Hush issues scoped credentials at runtime that expire after the specific action completes. Every action is logged. A centralized kill switch can terminate any agent session immediately across the entire enterprise.

The company raised $30 million in Series A funding in July 2026, with Akamai Technologies joining as a strategic investor alongside existing backers Battery Ventures and YL Ventures. Total funding is $41 million.

02 /Why It Matters

The non-human identity problem predates AI agents by decades. Cloud infrastructure generates millions of machine identities — API keys, service accounts, OAuth tokens — that most enterprises cannot accurately inventory. The 2025 Verizon Data Breach Investigations Report found that compromised credentials remain the leading initial attack vector in enterprise breaches, and the majority of credential-based incidents involve service accounts rather than human accounts. The AI agent wave is landing on top of an identity governance problem that was already severe.

What AI agents add is a dimension service accounts do not have: the ability to request, discover, and sometimes invent permissions based on what they are trying to accomplish. A service account has defined, static permissions. An AI agent has agency about what to access next. That makes the attack surface not just the credentials — it is the agent's own decision-making at runtime.

The established security vendors have recognized this. CrowdStrike, SentinelOne, and Palo Alto Networks have all made identity protection a platform priority in the past two years. Wiz acquired Gem Security in 2024 specifically to strengthen identity threat detection. The specific variant — AI agent identity, non-human and non-static and high-volume — is new enough that the large platforms have not solved it, which is the window Hush is operating in.

Akamai as a strategic investor is a market signal in its own right. Akamai's core franchise is protecting internet infrastructure from abuse at the traffic layer. Their bet on Hush is a read on where AI agent traffic is going, in the same way their early positions in CDN and bot protection anticipated where web traffic was going.

03 /Opportunities

Every enterprise security startup that addresses a genuinely new attack surface faces the same strategic question: build to be acquired by CrowdStrike or Palo Alto, or try to expand the category before they do. Hush's most plausible outcome at scale is acquisition by one of the large platforms once the category is validated — which is not an argument against the investment thesis, it is the investment thesis.

The sub-problem most acutely unaddressed within AI agent governance: audit and attribution at the agent-action level. Enterprises in regulated industries — financial services, healthcare, legal — deploying AI agents face a compliance question they cannot currently answer: which agent accessed this data, when, at whose instruction, and what decision did it make with it? That is a data lineage and chain-of-custody problem as much as an access control problem. Solving it has the same regulatory urgency as solving the credential problem, but requires a different product surface.

The entry angle for a new builder: the regulated industry segments most aggressively deploying agents are also the most exposed when something goes wrong. A compliance-focused agent audit product — not a runtime control plane like Hush, but a post-hoc investigation and reporting tool — would be complementary to Hush rather than competitive, and could find a buyer in enterprise legal or financial services compliance teams who care more about the evidence trail than the real-time kill switch.