AI security startup Reco has raised an additional $55 million, bringing its total funding to $140 million. The company is repositioning around a context graph that links AI agents to apps, people, accounts, and permissions to help enterprises manage agent sprawl. Reco reports over 100 customers and found 21,000 unknown agents at a Fortune 100 customer.
SynthePulse Insight · AI deep reading
Version 1 · 1 source
Reco announced on September 29, 2026 that it closed $55 million in funding, bringing its cumulative total to $140 million. It has shifted its narrative from SaaS security to a "context graph" connecting agents and permissions, but core data such as valuation, ARR and customer cases all come from the CEO's own account, lacking third-party verification.
Reco announced on September 29, 2026 that it closed $55 million in funding. This is not a brand-new round, but an extension of its $30 million Series B from February 2026, bringing the company's cumulative funding total to $140 million.
There is one noteworthy detail in the investor list: customer AT&T participated through its venture arm, with Forestay and Quadrille Capital also taking part. A customer becoming a shareholder is usually read as an endorsement of product adoption, but this in itself does not constitute independent verification of product capability.
The report did not disclose the valuation, lead investor or specific terms of this round. Reco said the new funds will be used for hiring, sales, partnerships and customer support.
Until last year, Reco mainly sold software for mapping and protecting SaaS and AI platforms. Now it has repositioned itself as a broader solution that uses a context graph to connect agents with applications, people, accounts and permissions, letting security teams see what agents can reach and cut off access they do not need.
The backdrop to this shift is that enterprises are deploying AI agents faster than they can track them. Klein told TechCrunch that market demand for agent security is "not just about the agents themselves, but about the entire end-to-end ecosystem."
From a product narrative standpoint, Reco is betting that its existing SaaS application coverage, and the AI agents these applications increasingly offer, can help it stand out in a crowded field. The company currently integrates with more than 280 applications, and Klein said new integrations can be completed within days.
Reco uses several specific cases to demonstrate the urgency of demand. Klein said that at one Fortune 100 customer, the Reco platform discovered 21,000 agents the company did not know about.
At another large financial services customer, Reco claims to have identified an agent set up by a former employee that could access Salesforce and share data with domains the company could not see.
If true, these cases do illustrate the visibility gap caused by agent sprawl. But note that they all come from the company's own account, and the report provided no customer names, verification methods or technical details, so they can only be treated as source_claim, not as verified facts.
Klein also said the platform uses browser and network signals to discover agents beyond its directly connected applications, and has controls to inspect prompts and tool calls. This is a description of platform capabilities, and likewise lacks third-party performance evaluation.
Klein said the company's valuation has "more than doubled" since the February Series B was announced, and vaguely estimated it at the "high hundreds of millions," but he declined to disclose specific figures. This means outsiders cannot calculate a checkable valuation range from it.
He also said Reco's current annual recurring revenue is in the "tens of millions of dollars" range, and predicted it will triple this year. The company has more than 100 customers, with financial services companies accounting for about 40% of its business.
These figures form the main support for this funding narrative, but they all come from the CEO's own account, and the report provided no third-party verification. Therefore, statements such as the valuation "doubling," ARR in the "tens of millions" and "more than 100" customers can only be marked as source_claim at the evidence level, not confirmed.
Reco is not facing a blank market. Public Crunchbase and PitchBook records show at least two dozen companies selling some form of AI agent security product.
These vendors' products have different emphases: some scrutinize the tools agents use, some help enterprises control the data agents can reach, some like CrowdStrike build detection and response controls on the devices where agents run, and others focus on discovering and resolving unapproved AI use.
But their promises sound quite similar, all involving knowledge graphs, continuous monitoring, runtime security, tool access, MCP scrutiny and so on. Some vendors are even updating their products to hop on this bandwagon.
This crowding means Reco's differentiation cannot be built simply on "we also do agent security." It needs to prove that its context graph, 280-plus integrations and existing SaaS coverage bring visibility or control that others do not have, and the report provided no independent comparison in this regard.
Reco is not the only company emphasizing the risk of agent sprawl. Chris Sestito, co-founder and CEO of security startup HiddenLayer, said more than 50 of its customers already have AI agents touching critical systems and sensitive assets in production environments.
Another AI startup, Cymphony, said that at one U.S. public company it found about 85,000 files already accessible to AI tools and agents.
These figures, like Reco's cases, all come from the respective company executives or the companies' own accounts, and the report did not disclose statistical methods or accuracy, nor was there independent verification. They can show that the industry is collectively building a narrative of urgency, but they cannot be treated as reliable measures of market size.
The actual impact of this funding round on Reco's competitive landscape remains to be seen. The report did not disclose the valuation, lead investor or specific terms, nor did it provide technical details of the platform or third-party performance evaluation.
Therefore, what is more worth watching is not the funding amount itself, but several nodes that can be verified later: whether Reco can disclose checkable ARR and valuation figures; whether the cases of 21,000 unknown agents and the former employee's agent can be confirmed by customers or third parties; and whether, in a market with at least two dozen-plus vendors, its context graph solution can produce comparable evidence of differentiation.
Until these questions are answered, Reco's funding is an event confirmed to have happened, while the growth story around it remains mainly at the level of the company's own account.
All facts in this article come from a TechCrunch report dated September 29, 2026, with no other independent sources for cross-verification. Reco's valuation, ARR, customer count, integration count and customer case data all come from the company CEO's own account, lacking third-party verification; Klein declined to disclose specific valuation figures, only vaguely describing it as "high hundreds of millions." The HiddenLayer and Cymphony data likewise come from their respective company executives or the companies' own accounts, not independent verification. The report did not disclose the valuation, lead investor or specific terms of this funding round, nor did it provide technical details of the Reco platform or third-party performance evaluation.
Reco's $55 million extension round and $140 million in cumulative funding are confirmed facts, but the valuation, ARR, customer count and 21,000 unknown agents case it uses to support its growth narrative all come from the company's own account. In a track with at least two dozen-plus vendors and highly similar product promises, the real dividing line is not who raised money, but who can produce independently verifiable evidence of differentiation.
Primary report
Primary source