If you’ve driven a newer car with lane-keeping assist, you know how it feels. You drift a little toward the line, and the steering wheel pushes back just enough to nudge you back into your lane. It doesn’t take the wheel away from you, and it doesn’t make you ask permission every time you want to change lanes. It knows where the road is and keeps you from wandering off of it while you’re still doing 70 on the highway. That’s close to what organizations need from security for autonomous AI agents, and it’s a lot harder to build than it sounds. Yuval Zacharia, co-founder and CEO of Bay Security, joins me on this episode of the TechSpective Podcast to talk about what it takes to let agents move at full speed without ending up in a ditch. Agents Go Wrong Without Being Compromised Most of the security stack assumes there’s an adversary somewhere. Firewalls, endpoint protection, and identity management were all built to keep bad guys out or catch them using stolen credentials. Agents complicate that picture, because an agent can do something harmful while working exactly as designed. As Yuval put it, “They don’t have to be compromised in order to go wrong.” Give an agent a vague prompt and broad permissions, and it’ll often take the shortest path to finishing the job, even when that path is something no security person would approve. And agents usually have broad permissions, because they inherit them from the user who installed them. That means access to files you forgot existed, secrets stored on the machine, and whatever SaaS apps you’re signed into. Attackers have noticed this as well, and an agent that reads your email on your behalf will also read instructions someone hid inside a message, and it may act on them. Identity and access management has spent years sorting out who has access to what, and agents add another layer on top of that, which is whether a given action should be happening right now, given what the person actually asked for. Approving Every Step Doesn’t Scale Keeping a human in the loop sounds like a reasonable safety net, and it makes a nice sound bite, but the whole reason to use AI is that it moves faster than people can, and if a human has to sign off on every tool call and every file access, you’ve slowed the whole thing back down to human speed. Anyone who’s clicked through a cookie consent banner knows how this plays out, because nobody reads them and everybody clicks “accept all.” Approval prompts for agents end up the same way. Blocking AI tools outright doesn’t work any better. I remember when companies banned Dropbox and personal Gmail, and employees just found another tool. AI is the same game of whack-a-mole, only worse, because there are always more models, plugins, and connectors than any security team can keep up with, and AI is now built into the software companies already use. Guardrails That Ride Along With approval prompts and blocking both falling short, Bay’s approach is to steer the agent instead, with guardrails inside the agent’s session, in line and in real time, wherever the agent happens to be running. That could be a coding assistant on a developer’s laptop or a long-running agent on a cloud server that keeps working after everyone has gone home. Bay’s platform is designed to understand the organization’s policies and the intent behind the original request, then compare that against what the agent is actually doing. If someone asks an agent to summarize their inbox and it starts gathering credentials from the machine, the actions don’t line up with the request. That’s the moment to nudge the agent back into its lane or stop it entirely, before anything leaves the building, instead of chasing an alert after the fact. The guardrails also need to fit the work. What’s normal for a developer’s coding agent might be a red flag for an agent working in finance, so a single policy for everyone either blocks too much or misses too much. Yuval expects a future where each employee runs dozens of agents, many of them without anyone watching in real time, and that only works if the steering happens automatically. Reasoning about intent is hard, though. A system that guesses wrong too often will flood people with false alarms and bring back the same approval fatigue it was supposed to fix. Where to Start Yuval’s advice for organizations starts with finding out which agents and tools people are already using, along with the ones they should be using but aren’t. She suggested security teams “influence the AI adoption and not just be there and observe it.” From there, check how those agents are configured, get rid of plaintext credentials sitting where an agent can grab them, and sandbox what you can. Then put guardrails in place that can tell whether what an agent is doing matches what it was asked to do. Agents are already running across most businesses whether security teams sanctioned them or not, so the controls around them have to work at the same speed the agents do. Bay Comes Out of Stealth With $50 Million Bay officially emerged from stealth this week, about nine months after it was founded. The company has raised $50 million so far, which includes a $37 million Series A led by Battery Ventures and a previously undisclosed $13 million seed round led by YL Ventures and Striker Venture Partners. Micron Ventures, M12 (Microsoft’s venture fund), and Wiz CEO Assaf Rappaport also took part in the Series A. The company says dozens of enterprises already use the platform, including Micron, Peloton, ClickUp, and Wix. According to the company, it can roll out AI governance and enforcement across employee devices, cloud infrastructure, and SaaS applications in under five minutes, without adding a persistent endpoint agent, a kernel driver, or a network proxy. Bay says it evaluates each proposed agent action against the context of the full session and decides locally, in milliseconds, whether to let it proceed. Instead of relying on security teams to write rules for every new agent or tool, the platform learns from the organization’s own agent activity and adjusts its policies as new agents and workflows come online. Zacharia co-founded Bay with CPO Aner Morag, who was previously VP of Product at Noname Security, and VP of R&D Boris Danilovich, who led a 90-person engineering department at CrowdStrike. The company plans to use the funding to grow its product and engineering teams and to expand its sales, marketing, and customer teams in the United States and Europe.
