Pluto Security raises about $34 million, bringing total funding to $42 million, to track what employees build with AI

Take an employee with no developer to ask, using Claude Code or Lovable to put together a small internal app ^[7]. The app can end up resting on skills, extensions, packages, MCPs and models ^[15]. The source says each new capability of this kind introduces questions about data access, dependencies and control ^[1].

Pluto's case rests on speed. "Security has traditionally been built around stopping things, but that model breaks down when the business is moving faster than security can evaluate every new tool," Bahat said ^[5]. Pluto's own counts point to fewer builders than a pitch that pictures every employee as one.

The company says it has secured more than 1 million endpoints ^[13]. It also says employees across its customers have built thousands of applications ^[15]. If "thousands" means fewer than 10,000, and both figures cover the same machines, that is under one application per 100 endpoints ^[18]. On those terms, builders are a small minority of the machines Pluto covers.

A control for a minority has to find the builders without slowing everyone else. Pluto's stated design is to learn what users are trying to accomplish and use that context to decide where controls belong, with blocking not the default ^[6]. The platform is said to stop risky activity without interrupting legitimate work ^[16]. The report does not include pricing, the number of people building, or a customer describing a blocked action. A pilot can test the legitimate-work claim directly by counting the blocks that hit builds someone needed.

The latest round is about $34 million ^[3] against $42 million in total funding ^[2], which leaves roughly $8 million raised earlier ^[9]. Plutonium, the company's AI supply chain security hub, runs on its proprietary RisksDB ^[17]. Saaya Pal, a partner at Jump Capital, said: "there was no good public data on what AI tools are actually doing inside enterprises, so the team built it and gave part of it away." ^[10] She said most of Pluto's pipeline now comes inbound ^[11]. Because part of the database is public, a buyer can judge the data before any sales call.

Pluto describes all of its 40-plus customers as enterprises ^[14]. In our view the buyer is a security team that already runs a large endpoint fleet.

We'd inventory before enforcing. Inventory is cheap to undo and shows whether a fleet looks like the one Pluto describes; the tradeoff is that a bad skill keeps running until someone reads the report. To place enforcement, a team can sort each employee-built tool on two axes: whether it can reach sensitive data or credentials, and whether it pulls in dependencies nobody has reviewed. Reach plus unreviewed dependencies goes to enforcement. Reach with reviewed dependencies goes to an access review. Unreviewed dependencies with no sensitive reach get inventoried and watched. Tools with neither sensitive reach nor unreviewed dependencies get left alone.