Bloom Security, founded by ex–Palo Alto Networks leaders who came up through Dig Security, raised a $20M seed to secure AI agents and plugins on enterprise laptops. The round is real and named; the "dozens of enterprises" traction claim is not.

A trio of former Palo Alto Networks leaders has raised $20 million to sell enterprises on a threat most of them haven't budgeted for yet: the AI agents, browser extensions, IDE plugins and unreviewed code packages quietly running on employee laptops.

The startup, Bloom Security, is Tel Aviv–based and led by CEO Itay Keren, CPO Ofir Balassiano and CTO Itay Frishman. The seed round was co-led by Glilot Capital Partners and Ten Eleven Ventures, with Okta Ventures and Runtime Ventures participating and angel checks from founders of Snyk, Demisto, Dig Security and Talon, according to Calcalist Tech, which first reported the raise late last month. The pitch: a modern endpoint is an "ecosystem" of AI tools that traditional endpoint detection and response software "weren't built to see," and Bloom maps what those tools can touch, scores the risk by user and permissions, and blocks the dangerous ones.

The sharper description is that this is the Dig Security team going again. Many of Bloom's roughly 30 employees worked together at Dig, the data-security startup Palo Alto Networks acquired in 2023; "Palo Alto Networks veterans" is the polite version of "the people PANW bought, now doing the next one." That is a real credential — it's also exactly the résumé Glilot and Okta Ventures are underwriting on thesis. Glilot raised a $500 million fund in 2025 aimed at startups that "protect companies' AI"; Okta Ventures retooled its thesis around agentic AI in 2024. A $20 million seed for a category-fit team is, at this point in the cycle, the going rate, not an outlier.

What isn't documented is the product's traction. Bloom says it's already deployed at "dozens of large enterprises" across the U.S. and Europe, but has named no customer, released no benchmark, and offered no independent test against the incumbents — CrowdStrike, SentinelOne — it's positioning around. There's no revenue figure, and as an Israeli entity the round leaves no U.S. Form D trail; the $20 million rests on the company's word and its investors'.

Worth watching: whether a single named customer surfaces, and whether "AI-native endpoint security" turns out to be a product category or a slide that legacy EDR vendors absorb in a release note.