The Startup Race To Secure AI Agents Is On
Cyber startup Descope's veteran founders have raised $35 million more to pun Okta and other incumbents into submission.
The Upshot
The founders at Descope are a corny bunch.
Check them out on their website – all eight of them – and each has a joke password listed instead of a title: 1MoreJ@lebi for co-founder Rishi Bhargava, a reference to the Indian snack; J@VaTheHutt for CEO Slavik Markovich, combining a programming language with a goofy ‘Star Wars’ villain.
“Rishi and I have worked together for the last 15 years, so he’s the newcomer to the team,” Markovich quips. “A bunch of us others, we’ve worked together for 30 years.”
It’s the kind of flippancy you earn after spending careers in one particularly nerdy sector, cybersecurity, and after selling your previous startup for more than $500 million. Markovich and crew pulled that off in 2019, selling security Demisto to Palo Alto Networks.
When they emerged from stealth in 2023, Tel Aviv- and Los Altos, Calif.-based Descope had already raised $53 million in funding to try to solve an old problem: identity and authentication.
Big companies already existed in the space like Auth0 and Ping Identity, but they’d just been acquired. Descope would beat them by being “no-code,” faster to get up and running, and easier for anyone to use.
And if that’s all Descope had ever become, it could’ve done well, Markovich says. But then a new technology – the AI agent – burst onto the software scene in recent months. Descope has taken on a more serious, more lucrative, mission: bring some order to this new agentic Wild West.
At Upstarts, we’ve written about a bunch of startups like Decagon, HappyRobot, and Roadway that are helping customers use agents for everything from customer support to logistics and growth marketing. OpenAI now wants you to shop with them in ChatGPT.
At the same time, coding agents have gone viral for deleting a customer’s live database while they slept; others have been tricked by researchers to cough up private customer data.
“These connections are literally a backdoor into your organization, because the agent now has a token to act on your behalf,” says Markovich. “And that’s a very scary thought.”
The race is on to build security software to lock these agents down. Against bigger incumbents like Okta (which owns Auth0), Palo Alto Networks and Ping (owned by Thoma Bravo), Descope is a newer entrant.
But with 1,000-plus companies on its software spanning hundreds of millions of end users and million-dollar contracts already signed with a customer base that includes Databricks, Navan and GoodRx, Descope’s founders and investors think they’ve got a shot.
So Descope has raised another $35 million in funding from its existing investors, led by Notable Capital and Lightspeed Venture Partners; Dell Technologies Capital, Unusual Ventures, Cerca Partners, and Triventures also joined.
The startup declined to comment on its valuation, but Upstarts estimates it’s now in the ballpark of $500 million – not so far off from where its founders sold their last startup years ago.
“Identity is critical, and we think it’s the enabler, the next frontier for agents,” Markovich adds. More on what Descope is building – and the venture-backed swarm coming for agentic security – below.
Presented by Vanta.
To scale your company, you need compliance. And by investing in compliance early, you protect sensitive data and simplify the process of meeting industry standards—ensuring long-term trust and security.
Vanta helps growing companies achieve compliance quickly and painlessly by automating 35+ frameworks—including SOC 2, ISO 27001, HIPAA, and more.
And with Vanta continuously monitoring your security posture, your team can focus on growth, stay ahead of evolving regulations, and close deals in a fraction of the time.
Start with Vanta’s Compliance for Startups Bundle, with key resources to accelerate your journey.
Step-by-step compliance checklists
Case studies from fast-growing startups
On-demand videos with industry leaders
Cyber Cope
Three years after Demisto’s acquisition, Descope’s founders marched out of Palo Alto Networks with 15 co-workers to start a company, but their exact target wasn’t clear.
Identity was supposed to be a solved problem, but they kept circling back to it. “The biggest thing we were seeing is that for any engineering team, they really wanted a flexible solution,” Bhargava says.
Descope’s innovation was a better mousetrap, a drag-and-drop system for configuring security preferences like when to require two-factor authentication, with the ability to connect more areas of a business, such as marketing or audits, easily over time.
The result is a tool that Descope claims is fully operational within weeks with a customer, compared to months-long or even a year-long process with others that require custom code.
At GoodRx, a telemedicine provider and app that helps find cheap drug prescription prices, CTO Nitin Shingate says his team selected Descope for that speed to connect social media log-ins and other verification for mobile users, migrating millions of patient accounts over from Auth0.
Shingate is enthusiastic enough about Descope to have joined its newly-launched customer advisory board; another member, You.com, chief product officer Saurabh Sharma, shares a similar story about selecting the startup because it could move faster – in You.com’s case, in less than three months – to support its enterprise-facing business launch.
Descope pulled off the project, Sharma says, in part because of its startup hustle: “We knew that maybe sometimes things won’t always be perfect, but their service was a big part of it for us.”
That’s where Descope’s team factors in, argues investor Oren Yunger at Notable Capital. Yunger had once hoped to invest in their last startup, Demisto, only for it to sell before he could; the VC spent the next few years checking up on Markovich and co. for another chance.
Of Descope’s team of eight founders, all are engineers; most of them still code, with Markovich the CEO still programming on the weekends, Yunger notes.
“They’re not doing this because they needed to start something new. They want to,” he says. “They have a chip on their shoulder, and they’re committed to doing something great here.”
Call Your Agent
Customers are using Descope with agents already, but there’s much more to do. At You.com, Sharma says his team has connected its agents to Google Drive and SharePoint through Descope, allowing for the automated creation of reports or sharing of files.
But eventually agents should be able to connect across four or more systems to pull in internal and external data, while Descope manages how much access each agent should get compared to their human counterpart.
Imagine a scenario where actual Alex can edit any pricing data on our premium newsletter subscription within Substack’s dashboard, but agent Alex can go read the info, such as to see what special offers are expiring soon, without the ability to make any changes directly, to protect Upstarts from giving away the farm.
“We see a world where humans can authorize their identity, log into our platforms and others, and they’re doing a great job of that,” says Sharma. “But I think the next generation is going to see 10x, 200x more use cases for authentication.”
Descope will face stiff competition. Okta and Auth0 announced more agent security features at an event last week. 1Password, arguably a more consumer-facing business historically, recently announced a partnership with AI unicorn Perplexity to provide credentials and access controls for its web browser, Comet. And a number of other startups will inevitably jump into the race.
Such venture-backed land grabs are becoming a theme in the startup ecosystem, particularly in vertical AI. Several weeks ago we wrote about Console, bringing agents to IT tickets, and its investor made a similar point; we’ve seen this earlier in our coverage around Decagon, Sierra and the race to build customer support agents, and it’s playing out all over.
That’s partly why Descope has raised its new funding, to hire and build out marketing for its agent-facing tools, notes Guru Chahal, its backer at Lightspeed Venture Partners.
“They have a very unique opportunity because of their developer love and existing accounts,” argues Chahal. “They have the right to win, and they’re off to a great start, but they need to make sure they’re part of the conversation.”
According to Bhargava, that’s part of the fun. “The agentic side is very much like the cloud security stage 10 years ago, when everybody was getting started,” he says.
Markovich says the Descope team has no intention of selling their ticket to a bigger player again, at least for now. Their end goal this time’s an IPO.
“This is probably our shot at it, so we’re trying to take it all the way,” he says.
I might be wrong but I feel like the trend these days is to favor small nimble companies that can build a product around your needs.
Not that this is smth new, but in the past, many companies would shy away from this kind of partnership because you never know how long the company will be around to support you with that custom solution.
I wonder if funding rounds in tens of millions gives customers more confidence. Or maybe the cost of switching between SaaS platforms is not as high as it used to be.