Israeli security company Reco raised $50 million in a funding round that included a strategic investment from AT&T Ventures and new investors Forestay and Quadrille Capital. The round brings the company’s total funding to $135 million. Reco specialises in securing AI agents in organisations.
What Reco does
Reco’s platform is built on Reco Graph, a mechanism that maps the relationships between AI agents, identities, applications, permissions, data and workflows. The system enables security teams to understand which agents are active in the organisation, which identities and permissions they use, which data and systems they have access to, and which processes they can initiate.
The strategic investment from AT&T Ventures points to demand from large organisations for solutions that address AI agent security risks. When a telecommunications company of this scale invests, it typically means they are seeing the problem in practice in their own systems.
Why this matters for organisations building AI
When you build an AI system for an organisation, the agent needs permissions. If it answers customer questions, it needs access to the CRM. If it processes orders, it needs access to inventory and billing systems. If it summarises meetings, it needs access to calendars and documents.
Every such permission creates an attack surface. If the agent is compromised, or if its instructions change unexpectedly, its access to business systems becomes an entry point. Unlike an employee, an agent can perform thousands of actions per second, and it is not always clear who approved what.
Reco’s funding round at this size indicates that organisations are beginning to understand the problem only after they have already deployed agents. Now is the time to address it before, not after.
What to do this week
If you are building an AI system for an organisation, plan now how you will manage permissions. Ask yourself: which systems does the agent need to access? Who can change these permissions? How will you know if the agent tried to access something it should not? How will you revoke access in an emergency?
If you are working with an external vendor, check how they handle agent permissions. If the answer is vague, that is a problem. If you are building in-house, plan ahead for mapping every permission and a rapid revocation mechanism. This is not something you add after the system is already in production. Read more about AI agents for business and how to build them correctly from the start.
Sources
Frequently asked questions
How do you check if an AI agent has been granted more permissions than it needs?
You need to document in writing which systems the agent is supposed to access and why, then check against the actual permissions. If there is a permission that is not documented, or you cannot explain why the agent needs it, remove it. Such a check should be part of the build process, not something done once a year.
What is the difference between managing employee permissions and managing AI agent permissions?
An employee performs actions at human speed, and it is clear who approved each action. An agent can perform thousands of actions per second, and approval is usually general rather than for a specific action. In addition, an agent can change with every code or instruction update, meaning permissions that made sense yesterday may become dangerous today.