Pluto Security Raises $42M to Solve AI Shadow Risk for Enterprises

TL;DR

• Pluto Security has raised $42M to tackle AI shadow risk, the uncontrolled employee use of generative AI tools that is exposing enterprise data.
• The round will fund expansion of Pluto's platform that discovers unsanctioned AI apps, prevents sensitive data leaks, and enforces governance without blocking productivity.
• The raise signals a major shift in cybersecurity VC, with AI governance moving from niche compliance concern to core enterprise security stack.

The Shadow AI Problem Enterprises Can't Ignore

Enterprise security teams are losing sleep over a new reality: every employee is now a potential security risk, not out of malice, but because of AI. With thousands of generative AI tools, copilots, agents, and browser extensions just a click away, workers are pasting source code, customer data, financial forecasts, and legal documents into tools IT has never approved, let alone secured.

Security leaders call it AI shadow risk, and it's exploding. Traditional data loss prevention and CASB tools weren't built for a world where an engineer can spin up a coding assistant in seconds, or a salesperson can upload a pipeline spreadsheet to a free summarizer. The result is gaping new holes: untracked data flows to third-party model providers, retention and training risks, compliance violations, and agent-based tools with excessive access to SaaS systems.

That's the gap Pluto Security says it was built to close.

What Pluto Actually Does

Unlike legacy tools that simply block AI domains, Pluto takes a discovery-first, governance approach designed for how people actually work. The platform continuously maps every AI tool, model, agent, and integration in use across the company — sanctioned or not — from ChatGPT and Gemini to niche vertical copilots and open-source models running in engineering.

From there, it layers three core capabilities. First, real-time data flow inspection to detect and redact sensitive information like PII, credentials, IP, and customer data before it leaves the company. Second, risk scoring for AI vendors based on data retention, training policies, SOC 2 status, and model infrastructure. Third, policy enforcement that lets security teams set granular rules — allow this AI for marketing but block file uploads, allow code assistants but mask secrets — instead of blanket bans that employees just work around.

The company says early customers have discovered 5 to 10 times more AI tools in use than IT estimated, with over 60% of AI-driven data egress happening through unsanctioned apps.

Who's Backing the $42M Bet

Pluto's $42M raise, which brings its total funding to just over $50M, was led by a top-tier Silicon Valley venture firm with deep cybersecurity roots, with participation from existing seed investors and angels from major CISOs and AI infrastructure companies.

The round is structured as a Series A and will be used to triple headcount across engineering and go-to-market, expand its New York and San Francisco hubs, and accelerate R&D around agentic AI security — specifically controlling autonomous agents that can read email, write code, and take actions across enterprise SaaS.

In a statement, Pluto's co-founders said the funding validates that AI security is no longer just about securing models, but about securing how humans use models. Backers pointed to the team's background in cloud security and data infrastructure, and to rapid enterprise traction in finance, healthcare, and tech where regulatory pressure is highest.

Why Investors Are Racing Into AI Security

Pluto is riding a massive wave. Venture funding for AI security and governance startups has surged in 2025 and 2026 as CISOs shift budget from traditional endpoint and network security to AI visibility and control. Gartner and others now rank AI TRiSM — trust, risk and security management for AI — as a top enterprise priority.

Competitors include both large incumbents adding AI discovery features and startups focused on prompt security, model red-teaming, and data security posture management. Pluto is betting that the winning platform will be employee-centric: sitting between the workforce and the sprawling AI ecosystem, much like endpoint security did for laptops or identity providers did for SaaS sprawl.

What It Signals for the Future

The Pluto raise makes one thing clear: banning AI is over. With productivity gains too large to ignore and AI features embedded in everything from Slack to Excel, enterprises aren't asking how to stop AI use — they're asking how to make it safe.

Expect the next 12 months to bring consolidation around AI governance platforms, tighter integration with data security and compliance workflows, and new regulatory pressure in the U.S. and EU requiring companies to inventory AI use and prove data controls.

If Pluto delivers, shadow AI could go from an invisible nightmare to a managed, measurable risk — letting security teams finally say yes to AI without crossing their fingers.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.