Here's a security problem that's quietly becoming every enterprise's nightmare: your organization is deploying AI agents to do real work—writing code, querying databases, firing off API calls—and most of them are authenticated with the digital equivalent of a sticky note taped to the server room door. A shared service account. A hard-coded credential. A token nobody's rotated since 2022.

NewCore, a cybersecurity startup that just emerged from stealth with $66 million in funding, is betting that this gap between "AI agents doing things" and "anyone actually knowing what they're authorized to do" is about to become a very expensive problem. The seed round was led by Cyberstarts, with Index Ventures and Evolution Equity Partners also writing checks, pegging NewCore's post-money valuation at $300 million.

The Actual Problem Here

Let's be precise about what's broken. Traditional identity and access management (IAM) platforms—Okta, Microsoft Entra, the usual suspects—were architected in an era when "identities" meant human employees logging in through a browser. They bolt on machine identities and service accounts as an afterthought, and they were never designed to handle something like an AI coding agent that might spin up dozens of ephemeral sessions, call third-party APIs autonomously, and operate continuously without a human in the loop.

When Goldman Sachs trialed Devin as a de facto employee, or when McKinsey disclosed it had 25,000 AI agents working alongside its 60,000 humans, neither company was operating with an identity governance framework designed for those agents. They were improvising. And improvisation at scale in security contexts is how breaches happen.

The core technical gap is this: AI agents need dynamic, fine-grained, revocable permissions that can be granted and pulled in near real-time—not static service account credentials that persist indefinitely because nobody remembered to clean them up. Existing platforms can approximate this, but it's retrofitted behavior on top of infrastructure that was never meant to support it.

Who's Building This

NewCore's founding team isn't a group of people who just discovered enterprise security last quarter. CEO Zohar Alon previously built Dome9, a cloud security startup that Check Point acquired. CTO Amihai Neiderman comes from Unit 8200, Israel's elite signals intelligence unit, and later founded healthcare AI company Nym Health. CCO Erez Yarkoni has held CIO roles at both T-Mobile USA and Telstra. That's a genuinely credible set of credentials for a company tackling infrastructure-level security.

The origin story is also instructively mundane: Alon was reviewing a tech budget for a company paying serious money to a legacy identity provider. He assumed satisfaction was proportional to spend. It was not. That kind of stagnant market—high lock-in, low satisfaction, limited competitive pressure—is exactly where a focused startup can carve out real ground if the underlying technology shift is large enough. The AI agent wave may be exactly that shift.

What NewCore Actually Does

NewCore's platform manages human and AI-agent identities within a single unified system, treating agents as first-class identity principals rather than second-class service accounts. That means each agent gets its own permissions profile, lifecycle management, and revocation mechanisms—the same governance primitives you'd apply to a human employee, adapted for software that never sleeps and scales horizontally.

A few specific design choices are worth noting. Their "split-key" architecture divides critical identity credentials between the customer and the platform, eliminating a single point of compromise. If NewCore gets breached, attackers don't walk away with your keys—they only get half the puzzle. That's a meaningful architectural decision, not just marketing copy.

They've also built what they call an "Agentic Skill" integration package for AI coding assistants—Claude Code, OpenAI's Codex, Cursor—that allows those tools to operate as managed identities when touching enterprise systems. Instead of someone manually distributing credentials to an AI tool (a process that is, let's be honest, happening via Slack DMs at most companies right now), the agent authenticates through NewCore's governed framework.

The mobile app for human oversight is a smart UX call. Employees can grant, review, and revoke agent access from their phones. Given that one of the legitimate concerns about autonomous AI systems is the erosion of meaningful human oversight, building that control surface directly into the product is the right instinct.

The Skeptic's Checklist

So where's the friction? A few things worth watching:

• Customer traction is thin—by design, they say. Fewer than 10 paying customers and more than 10 design partners, with billing expected to start this summer. That's early-stage normal, but $300 million post-money on sub-10 customers is a valuation that's pricing in a very specific future arriving very quickly.
• Okta and Entra aren't standing still. Alon's argument that incumbent platforms are bolt-on rather than integrated is fair today—but both companies have substantial engineering resources and existing enterprise relationships. "Built from the ground up" is a genuine advantage until the incumbents ship enough features to close the gap for most buyers.
• The agent identity problem is real but the market timing is uncertain. If enterprise AI agent deployment accelerates sharply over the next 18 months, NewCore's timing is perfect. If adoption is slower or more cautious than expected, they're selling infrastructure for a workforce that hasn't fully materialized yet.
• Complexity is a double-edged sword. A unified platform for human and AI identity sounds elegant. Convincing large enterprises to swap out or layer on top of their existing IAM stack—a notoriously sticky category—is a long, expensive sales cycle.

The Bigger Picture

Here's what I think is actually true: the identity problem for AI agents is not hype. It's a real, underappreciated attack surface that's growing as fast as agent deployment itself. Every AI agent operating with overprivileged, poorly monitored credentials is a potential lateral movement vector for attackers. The industry is going to need better tooling here, full stop.

Whether NewCore specifically is the company that wins this market is a separate question. But the problem they're solving is the right one to be working on. When TCS's chairman starts publicly predicting that AI agents could match his company's human headcount, the people who built IAM for a 60,000-person company need to start thinking about what IAM looks like for a 120,000-entity organization where half the entities never log off.

"The question is whether we're going to build the guardrails in time." — Zohar Alon, NewCore CEO

That's not a rhetorical flourish. It's an engineering problem with a deadline. And right now, most enterprises are behind on it.