The AI Supply Chain Just Got Its Own Security Industry
Something shifted this week that didn’t get nearly the attention it deserves. Two separate signals landed within 48 hours of each other, and if you read them together, they tell a story about where enterprise AI is heading — and what problems are about to become expensive.
On September 1, an Israeli cybersecurity startup called AIR came out of stealth with $50 million in two seed rounds to do one thing: vet the skills, plug-ins, MCP servers, and add-ons that AI agents use. On September 2, Amazon announced that Alexa for Shopping can now tell you whether a suspicious email or text actually came from Amazon. Different products, different companies, same underlying realization — the things we’re wiring into AI systems need scrutiny, and right now nobody’s giving it to them.
I’ve been running AI agents daily for development work. I know what it feels like to install a tool, grant it access, and hope the author was having a good day. We’re building on top of a software supply chain that hasn’t learned the lessons we already paid for.
What AIR Is Actually Building
AIR was founded by Yair Saban and Niv Hoffman, both veterans of Israel’s Unit 8200 intelligence corps where they worked on offensive cybersecurity. That background matters — they’re not approaching this as generic security consultants. They’ve seen how attackers think about supply chains.
Their platform does three things: it discovers AI agents running across a company’s environment, continuously vets the skills and add-ons those agents use, and blocks any that don’t pass security criteria. They also maintain a marketplace of vetted add-ons. The company says it filters out roughly 27% of the add-ons and skills it finds online.
That 27% number is worth sitting with. More than one in four skills or plug-ins available for AI agents would fail a security check. That’s not a rounding error — that’s the market.
Saban’s pitch is that AI agents in enterprises are starting to resemble operating systems, but the tools they install don’t get the scrutiny we give to regular software. He drew a direct line to the early 2000s driver signing problem: “In the early 2000s, whenever you installed a driver, the driver didn’t need to be signed. Today, every time you install a driver, you see a signature saying who signed it, because the driver is actually loading code into the kernel. You don’t have that with skills or plug-ins or MCPs, and it’s the shame, because it’s the same mechanism, it’s the same lesson, but we haven’t learned it.”
That driver analogy is the most honest framing of this problem I’ve seen. We spent a decade figuring out that kernel-level code needs signatures. Now AI agents are loading “skills” that can read databases, send emails, and call APIs — and we’re treating them like browser extensions instead of what they functionally are: code that runs with organization-level permissions.
The Competitive Landscape Is Already Crowded
AIR isn’t alone. Noma Security offers discovery, access controls, and runtime monitoring for agents, MCP servers, and skills. Zenity sells security and governance tools that work similarly. Astrix Security’s identity platform lets companies discover and control agents and MCP servers. Operant AI offers agent protections and an MCP gateway.
The money flowing into this space tells you how seriously investors take the threat. Zenity raised $125 million in Series C funding in August. Noma raised $100 million in Series B last year. HiddenLayer — which takes a broader approach to securing AI models, agents, and workflows — raised $100 million in Series B on September 2, led by Delta-v Capital with participation from Ten Eleven Ventures, Morgan Stanley, Microsoft’s M12, and Booz Allen Hamilton. HiddenLayer’s ARR grew more than 10x in the past year, according to CEO Chris Sestito. Gartner estimates companies will spend $2.83 billion this year on products to secure AI tools, 83% more than 2025, and expects that to reach nearly $4.78 billion next year.
This isn’t a niche. It’s a market forming in real time around a problem that didn’t exist two years ago.
AIR’s lead investors signal where the money sees the opportunity. Sequoia led the first $10 million round. Greenoaks led the second $40 million round. The second round closed within weeks of the first, which usually means the company found product-market fit faster than expected.
The Real Problem: Continuous Re-Verification, Not One-Time Scanning
Here’s what separates this category from traditional security tooling: a skill that’s clean today can be compromised tomorrow. A package an AI agent downloads can change its behavior after you approved it. A developer’s account can get taken over. The threat isn’t static — it’s persistent.
As Sequoia partner Bogomil Balkansky put it in an emailed statement: “This is not a scanning problem, it is a continuous re-verification problem. Inspecting every skill, plugin, MCP server and sub-agent an enterprise’s agents touch, re-inspecting each one every time it changes, in real time and across an entire company’s agent fleet, is an infrastructure problem long before it is a security problem.”
That distinction matters for anyone building with AI agents. A one-time security review before deployment doesn’t cut it when the components you depend on can mutate without your knowledge. You need ongoing visibility and re-verification. This is closer to endpoint detection and response — the “EDR for AI” analogy HiddenLayer’s Sestito used — than to a firewall rule you set once.
For developers and ICT teams, the practical takeaway is that the security model for AI agents needs to be continuous, not point-in-time. If you’re wiring an agent into production systems, ask what happens when a skill it depends on changes. Ask who verifies the tools your agent pulls in. Those questions don’t have standard answers yet, which is exactly why this market is forming.
Amazon’s Alexa Scam Detection: The Consumer Mirror
The Amazon Alexa announcement is the consumer-facing echo of the same pattern. Amazon is adding a feature that lets users verify whether an email, text message, or call actually came from Amazon by checking against billions of messages the company has sent. It’s a response to impersonation scams that target customers through fake communications.
This isn’t AI agent security — it’s customer protection — but the underlying logic is identical. Someone is sending a message that appears to come from a trusted source. The recipient needs a way to verify it without trusting the surface-level presentation. Amazon’s solution is a verification path that checks the claim against known-good data.
Both AIR and Amazon’s feature are responses to the same structural vulnerability: when AI systems and the tools around them become powerful enough to act on our behalf, the trust boundary between “legitimate” and “convincing fake” gets thinner. Verification becomes a feature, not an afterthought.
The Open-Weight Angle Nobody’s Talking About
One of the most interesting threads in AIR’s approach is its focus on open-weight models. Sestito told TechCrunch that the company parses and scans about 50 different AI file frameworks to verify that open-source models are what they claim to be — checking for hidden models inside other models, or models that purport to be one thing but are actually another.
This is the dirty secret of the open-weight movement: the same distribution model that makes these models accessible also makes them an attack surface. Anyone can upload a model to Hugging Face or similar platforms. If you’re downloading a model and loading it into your agent’s workflow, how do you know it hasn’t been modified to exfiltrate data or insert malicious behavior? The model file itself becomes a supply chain vector — and most teams aren’t scanning their model downloads the way they scan their npm packages.
HiddenLayer explicitly called this out as a new attack opportunity. AIR built its continuous vetting around it. The fact that two security companies independently identified open-weight model integrity as a priority tells you this isn’t a theoretical concern.
What This Means for Teams Running AI Agents
If you’re an ICT team or a developer putting AI agents into production, the emergence of this security category should change how you think about your deployment. Here’s what I’d focus on:
Inventory first. You can’t secure what you can’t see. Before worrying about vetting individual skills, know what agents are running in your environment and what tools they have access to. Shadow AI — employees using personal accounts or unapproved tools — is a real exposure that AIR specifically targets.
Treat skills like dependencies. The package management analogy is apt. You wouldn’t deploy code without knowing what libraries it pulls in. Apply the same discipline to the skills, plug-ins, and MCP servers your agents use. Maintain a whitelist. Re-verify when things change.
Plan for continuous verification, not one-time approval. The tooling is forming around this model for a reason. A skill that’s safe on Tuesday can be compromised by Thursday. Your security posture needs to account for change over time.
Watch the open-weight supply chain. If your agents load models from public repositories, treat those downloads with the same scrutiny you’d apply to any executable content. Verify the source. Check integrity. Assume compromise is possible.
The Irony Nobody Mentions
There’s a quiet irony in watching an entire security industry form around AI agents. We built these systems to automate work, to reduce the need for human oversight, to let software handle tasks we’d rather not spend time on. Now we’re building a parallel industry to watch the automators and make sure they don’t go off the rails.
That’s not an argument against AI agents. It’s an argument for honesty about what we’re actually building. Every powerful automation tool creates new attack surfaces. The early internet had no security industry — it formed around the threats that emerged. AI agents are following the same arc, just faster.
The $50 million AIR raised, the $100 million HiddenLayer closed, the $125 million Zenity grabbed — this money isn’t betting on AI agents failing. It’s betting that enterprises will pay to deploy them safely. That’s a healthier signal than panic. It means the market understands the risk and is building accordingly.
What I’d watch next: whether the big platforms — Microsoft, OpenAI, AWS — start baking these checks into their agent frameworks natively, or whether independent tools like AIR maintain the cross-platform angle Saban is betting on. His argument is that companies will want a vendor-neutral layer that works across whatever agents and models they use. That’s a credible thesis, but platform vendors have a habit of absorbing adjacent markets. The next 18 months will tell us which way this goes.
For now, the supply chain lesson is clear: AI agents need the same scrutiny we eventually learned to give every other piece of software that runs with real permissions. The companies raising money in this space aren’t selling fear. They’re selling the infrastructure to make agent deployment actually safe at scale. That’s a category worth paying attention to.