Cygrid’s €2.66 million launch asks who can stop an AI agent mid-action

The credential is not the decision

Imagine a company assistant that can read a shared folder and answer questions about its contents. A request to summarise one document and a request to export the whole folder may arrive through the same authenticated account. Recognising that account does not, by itself, distinguish the two operations. This is an illustrative security problem, not a reported incident involving Cygrid or its customers.

Cygrid is building around that distinction. In its October 22 announcement, the Berlin company said it had raised €2.66 million in pre-seed funding led by Atlantic, with participation from d11z and angel investors. It also announced its emergence from stealth. The funding and public launch are current events; the promise of preventing inappropriate actions is the product proposition that follows from them.

The company describes an identity-enforcement platform covering people, machine identities and AI agents. Its intended job is to connect knowledge of who or what is acting with a decision about whether a particular operation should proceed. That is a more demanding brief than producing an inventory of accounts or telling an administrator that a token has excessive permissions.

Three different jobs behind one security pitch

On its official product page, Cygrid separates visibility, risk intelligence and enforcement. The first concerns identifying accounts and connections. The second concerns deciding what access is appropriate. The third concerns applying that decision to actions. The website describes enforcement through SaaS APIs and an MCP gateway. Those descriptions establish the advertised architecture, not independently measured coverage of every application or operation.

The distinction matters because the three jobs can fail separately. An account inventory may be complete while a policy is too permissive. A policy may be sensible while the relevant action happens outside the enforcement path. A blocked action may protect data but also interrupt legitimate work. None of those possibilities is a finding about Cygrid; they are the practical questions its category creates for a security team.

Consider a hypothetical employee who leaves a company while an integration they configured remains active. Discovering the integration is one task. Determining whether its work still has an owner is another. Removing or narrowing access is a third. Treating all three as a single dashboard metric would hide the operational work required to resolve the risk.

What a useful evaluation would put on the table

A buyer could begin with a small set of concrete operations: reading a document, changing a record and exporting a collection. For each operation, the team would identify which identity acts, which policy applies and where that policy is enforced. This would be a proposed evaluation, not a claim that Foundra has tested the service. The output should make clear which cases are supported and which remain outside the product’s reach.

The next question is what happens when the security layer cannot make a decision. Allowing work to continue and stopping work are different failure policies, each with consequences. A company handling time-sensitive customer operations may need an authorised human route around a temporary block. That route would itself need accountability; otherwise an emergency exception could become the normal way around the control.

Cygrid’s announcement includes customer and activity claims, but those are company-supplied accounts rather than an independent security assessment. This article does not convert them into a demonstrated breach-prevention rate. A count of blocked actions, even if accurate, would not by itself say how many were truly dangerous, how many were legitimate, or which risky actions the system never encountered.

The market is in the boundary cases

The commercial opportunity is not simply that companies have more identities. It is that software can now perform sequences of work through identities whose privileges may outlast the original task. The product has to make the permitted sequence legible to the organisation using it. In that sense, an administrator’s ability to explain a decision could matter as much as the speed of making it.

The pre-seed round gives Cygrid resources to pursue that proposition. It does not settle whether the platform can handle a buyer’s particular mix of applications, policies and exceptions. For the prospective customer, the most revealing demonstration would be an ordinary authorised task next to a closely related prohibited one: two valid logins, but only one permitted action.