Several AI security market categories are headed for bigger platforms
In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as products and which will become features inside bigger platforms.
Care talks about Q3 funding going to fewer, larger rounds, Israel’s share of cyber venture investment, and the five controls an organization needs before an agent touches production. He names three categories he would bet on for 2028 and three he would bet against.
You spent years at Gartner, where you were responsible for defining the Fraud market. Which of the new AI security categories remind you of that early fraud market, and which ones do you expect to end up as features inside someone else’s platform?
Fraud was never a product category at the start. It was a problem that sat between the payments team, the risk team and IT, and nobody owned the budget. Vendors sold point solutions: device fingerprinting here, a rules engine there, some behavioral analytics bolted on. What turned it into a market emerged when buyers realized they needed to orchestrate those signals and decide in real time, at the point of transaction.
Agentic AI security feels very similar. We have discovery tools, prompt filters, guardrails and AI posture management, and each answers part of the question. The category that survives will be the one that makes runtime decisions about what an agent is allowed to do, with context about who it is acting for. That is the fraud decisioning engine all over again.
What becomes a feature? Model scanning, AI bills of materials and most of AI security posture management. Those belong inside the cloud security platform, the data security platform or the developer pipeline. Standalone prompt-injection detection is on borrowed time too. It will be absorbed into gateways and the model providers’ own guardrails. The consolidation has already started: this year Cisco bought Astrix, 1Password bought Apono, and Check Point moved on Cyata, all to fold agent and machine identity security into bigger platforms.
Q3 funding jumped about 50% from the prior quarter even as deal counts fell at every stage. What happens to the Series A founder with a strong idea and no AI label on the pitch deck?
They have a harder raise, but not an impossible one. Capital is concentrating in fewer, larger rounds, and investors are pattern-matching on AI because that is where they believe the exits are. A founder without the label is fighting the pattern, so they need evidence instead. And the headline is bleaker than the data. Pinpoint counted 62 seed and Series A rounds in Q3, 60% of all deals, raising $1.16 billion between them. The money is there. It just has to be earned with proof rather than vocabulary.
My advice is simple: don’t put “AI” on the deck just to get the meeting. Investors and buyers can both tell, and it costs you credibility in diligence. Show a buyer with a budget line, a measurable outcome and a sales cycle you can actually describe. If you reduce losses, cut analyst hours or close an audit finding, say so with numbers.
There is also a quieter opportunity. Every agent deployment creates new problems in the unglamorous parts of security: identity, data handling, logging, third-party risk. Founders who solve those well don’t need to be AI companies. They need to be the thing AI deployments can’t go live without.
Israeli startups raised at least $2.425 billion in Q3, close to half of global cyber venture investment. Is that concentration a strength for the industry or a single point of failure?
It’s both, and the framing hides the real question. Start with the number: “close to half” depends on whose global total you use. Against Pinpoint’s $5.26 billion, it’s about 46%. Against Crunchbase’s $6.8 billion, it’s closer to a third. Either way, it’s a remarkable share for a country of around ten million people. Israel has an extraordinary pipeline of founders who learned the problem from the attacker’s side, and that is a genuine strength. Investors back that track record, and they are mostly right to.
The risk is less about geography and more about monoculture. When so much capital flows through one ecosystem, you see the same founding patterns, the same go-to-market playbooks and often the same investors on the cap table. That shapes which problems get funded. Technically deep, offense-informed products do well. Problems that need patient work with regulated buyers in Europe or Asia get less attention.
There is a practical resilience point too. Buyers in critical infrastructure and government are paying closer attention to where a vendor’s engineering and support teams sit. That is not a reason to avoid Israeli vendors. It is a reason to ask the same continuity questions you would ask of any concentrated supplier.
One investor theme dominates: securing software that can act autonomously. Strip away the marketing. What is the minimum set of controls an organization needs before it lets an agent touch production systems?
Treat the agent as a new kind of identity, not as a feature of an application. Before it touches production, I’d want five things.
First, every agent has its own identity, with an owner, a purpose, and a lifecycle. No shared service accounts and no borrowing a human’s credentials.
Second, least privilege with short-lived, scoped credentials. The agent gets access for the task, not for the job title, and that access expires.
Third, a human approval step for anything irreversible or high-impact: deleting data, moving money, changing access rights, pushing to production.
Fourth, full logging of what the agent was asked, what it decided and what it actually did, in a form your incident responders can read.
Fifth, a kill switch that works, and that someone has tested.
None of this is exotic. It is identity governance and change control applied to software that makes its own decisions. The organizations that struggle are the ones that skipped those disciplines for humans and are now discovering they need them for machines.
Name three categories you’d bet on for 2028 and three you’d bet against.
The first is easy. Runtime authorization for agents, meaning policy decisions at the moment an agent acts, with context about who it is acting for.
Secondly, Identity threat detection (AI-TDR) that treats non-human identities as first-class citizens, because that population is growing far faster than the human one. Investors already agree: identity was the busiest segment in Pinpoint’s Q3 data, with 23 transactions. And AI-assisted security operations that measurably reduce analyst workload, with outcomes you can audit rather than demos you have to trust.
Three I’d bet against as standalone categories. Prompt-injection filtering on its own, because it will be absorbed into gateways and model platforms. AI security posture management as a separate product, because it belongs inside existing cloud and data security platforms. And “AI firewalls” that promise to make any model safe through inspection alone. Inspection helps, but it does not replace design.
To be clear, betting against a category is not betting against the companies in it. Several of them will do very well by becoming part of something bigger.
Download: The IT and security field guide to AI adoption
