Token Security
Non human identity security platform that discovers, governs, and secures every machine identity and AI agent across on premise, hybrid, and cloud, with posture management, threat detection, least privilege, and a conversational Token AI Agent.
Token Security is a non human identity security company, headquartered in Tel Aviv with a New York presence, that secures the machine identities and AI agents proliferating across modern enterprises. Founded in 2023 by Itamar Apelblat and Ido Shlomo, both with deep cybersecurity backgrounds, it has raised about twenty seven million dollars across a seven million dollar seed round led by TLV Partners and a twenty million dollar Series A in January 2025, backed by Notable Capital and SNR with angels including Kevin Mahaffey of Lookout and Shlomo Kramer of Cato Networks. It was named to The Information's list of the fifty most promising startups of 2025.
Where human identity relies on passwords and multi factor authentication, non human identities such as service accounts, API keys, OAuth tokens, secrets, and AI agents often run with broad, permanent access and little oversight, and they now outnumber humans in most enterprises. Token Security treats every one of them as a first class identity, discovering all AI agents and machine identities across on premise, hybrid, and cloud environments, mapping ownership, and enforcing least privilege. Its platform combines security posture management, identity threat detection and response, behavioral anomaly detection, and access review and certification workflows designed specifically for identities that have no manager and no meaningful last login. AI driven automation triggers intelligent remediation on dynamic risk thresholds, and the Token AI Agent lets teams query inventory, posture, secrets, and threats in plain language. Token also shipped the industry's first Model Context Protocol server for non human identity.
The platform is built for governance from the ground up, spanning on premise and cloud, mapping controls to regulatory frameworks, and giving security teams audit ready evidence and attack path analysis. Because it runs on its own security stack, it does not offer customer choice of underlying model, a general agent testing surface, or browser and computer use. For a security team that needs to see, govern, and secure the machine identities and AI agents spreading through its environment, especially across hybrid infrastructure, Token Security is a strong and category leading fit; a team looking for a general purpose agent builder or a secrets only vault will find it purpose built for identity governance instead.
Vendor details
Canonical URL
https://token.security
Category
Security / SOC agent
Subcategory
Non human identity and AI agent security
Funding status
Independent, headquartered in Tel Aviv with a New York presence, founded in 2023 by Itamar Apelblat and Ido Shlomo. Token Security has raised about twenty seven million dollars across a seven million dollar seed round led by TLV Partners and a twenty million dollar Series A in January 2025, backed by Notable Capital and SNR with angel investors including Kevin Mahaffey, founder of Lookout, and Shlomo Kramer, co-founder of Cato Networks. It was named to The Information's list of the fifty most promising startups of 2025 and is recognized as a leader in the emerging non human identity security category.
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
Token Security discovers and governs non human identities across cloud, SaaS, on premise, secrets vaults, and CI CD systems, tying each identity to an owner and access path and driving remediation. It shipped the industry's first Model Context Protocol server for non human identity, and its Token AI Agent queries inventory, posture management, secrets, and threat detection in natural language.
In practice
AI agents and service accounts are multiplying across your cloud and on premise systems with broad permissions and no owner, and human style controls do not catch them. Token Security discovers every non human identity in seconds and enforces least privilege before one is abused.
A leaked API key or over privileged token is the entry point for a growing share of cloud breaches, but your team cannot even inventory them. Token Security maps ownership, scores risk, and triggers remediation on dynamic thresholds.
Security teams drown in fragmented identity data and cannot answer which inactive machine identities are riskiest. The Token AI Agent lets them ask in plain language across inventory, posture, secrets, and threats and get guided remediation.
Sources & related URLs
Research sources
Research notes
Added via Crunchbase agentic discovery CSV, enriched full fidelity 2026-07-07. Categorized Security / SOC on non human identity and AI agent security. Independent; about twenty seven million dollars raised through Series A.
Capability coverage
10.0 / 14 capabilities · 71%
| Integrations & Tool CallingDiscovers and governs non human identities across cloud, SaaS, on premise, secrets vaults, and CI CD, then acts through remediation and decommissioning, Token Security docs 2026-07-07 | Full |
|---|---|
| Workflow OrchestrationRuns lifecycle management and intelligent remediation workflows triggered on dynamic risk thresholds across the identity estate, Token Security docs 2026-07-07 | Full |
| Knowledge Grounding & RAGGrounded in the enterprise's own identity inventory and access paths, with attack path analysis and context aware queries through the Token AI Agent, Token Security docs 2026-07-07 | Full |
| Human Oversight & GuardrailsAccess review and certification workflows and guided remediation keep security teams in control of what gets changed, Token Security docs 2026-07-07 | Full |
| Security, Identity & GovernanceThe product is itself an identity governance and security platform, enforcing least privilege and zero trust and mapping controls to regulatory frameworks, Token Security docs 2026-07-07 | Full |
| Observability & AuditabilityProvides full visibility and auditability of every non human identity with threat detection, monitoring, and audit ready evidence, Token Security docs 2026-07-07 | Full |
| Memory & State PersistenceMaintains a continuous inventory and behavioral baselines of identities as a persistent system of record, though a distinct learning memory is only implied, Token Security docs 2026-07-07 | Partial |
| Deployment & Data ResidencyWorks across on premise, hybrid, and cloud environments rather than a single cloud only footprint, Token Security docs 2026-07-07 | Full |
| Prebuilt Agents, Templates & PacksShips prebuilt detections, remediation workflows, and one conversational agent rather than a broad library of prebuilt agents, Token Security docs 2026-07-07 | Partial |
| Triggers & Channel CoverageContinuous discovery and real time behavioral anomaly detection respond as threats happen and trigger remediation on risk thresholds, Token Security docs 2026-07-07 | Full |
| Model Flexibility & RoutingRuns on its own security stack with no documented customer choice or routing of the underlying model, Token Security docs 2026-07-07 | Unable to verify |
| APIs, SDKs & MCP ExtensibilityShipped the industry's first Model Context Protocol server for non human identity, alongside an API and open source tools, Token Security docs 2026-07-07 | Full |
| Testing, Debugging & OptimizationOffers security attack path analysis but no agent testing, simulation, or debugging surface, Token Security docs 2026-07-07 | Unable to verify |
| Browser & Computer UseSecures identities rather than driving a browser or operating a computer interface, Token Security docs 2026-07-07 | Unable to verify |
Recent platform changes
No recent material changes tracked yet.
Pricing
Not public; quoted through enterprise engagement with no self serve tier
enterprise subscription scoped to the identity estate and environments covered
What is public
No list pricing. Token Security sells through enterprise engagement, with no public rates and no self serve tier.
Billing mechanics
Presumed enterprise subscription scoped to the identity estate, the environments covered, and the modules enabled, though not disclosed.
Cost watchouts
Broad coverage across cloud, on premise, and CI CD and larger identity estates can raise cost, and deployment across many environments may add scoping effort.
Variable cost rationale
Sold as an enterprise platform scoped to the number of non human identities, the environments covered across cloud and on premise, and the modules enabled, so cost tends to grow with the size of the identity estate.
Additional watchouts
Confirm how pricing scales with the number of identities discovered and the environments in scope, and whether modules like threat detection and response are priced separately.
Sales call required
Yes — required for paid access
Free / trial
Demo on request; no public free tier
Key ambiguities
No public rate is disclosed, and the pricing basis, whether per identity, per environment, or platform tier, is not clear.
Related vendors
- 7AI — Swarming agentic SOC from the Cybereason founders: sixty plus domain…
- Airrived — Agentic OS that unifies SOC, GRC, IAM, vulnerability management, IT,…
- CrowdStrike — Cybersecurity platform whose Charlotte AI delivers agentic…
- depthfirst — AI security platform that detects, triages, and remediates software…
- Dropzone AI — Production proven AI SOC analyst that investigates every alert in…
- Exaforce — AI SOC platform unifying Exabots agents with an integrated knowledge…