Securing the agentic enterprise.

Enterprise AI began as a content problem: prompts in, answers out. That phase is ending. The new default is the autonomous agent, a long-running, stateful system that holds permissions, calls tools, accesses data, and makes decisions on the endpoint or in the cloud.

Key Statistics

  • 80% of enterprises expose sensitive data through agents.
  • 93% of organizations run AI agents with excessive permissions.
  • 70% of companies are exposed to RCE via compromised agents.

The Risk Surface

The risk surface consists of two parts:

  1. What an agent has.
  2. How an agent fails.

INTERNET ACCESS

  • Outbound reach: exfil

DATA ACCESS

  • Files, DBs, secrets

COMMUNICATION

  • Email, Slack, Jira, Notion

EXTERNAL ATTACK

  • Prompt injection: Adversarial content in retrieved docs, emails, tickets.
  • Overpersistence: Won't stop, retries forever, escalates scope.
  • Tool misuse: Write where a was intended; wrong destination.

Drift Over Time

  • Human error: Wrong instruction; the agent executes faithfully.
  • Scope drift: Permissions accumulate; nobody rebaselines.
  • Trust-boundary chains: Benign read + benign write = unauthorized data movement.

Policy Rule

Today's playbook is to write a policy: block tools, disable internet, no writes to prod, require approval. It fails in three structural ways:

  1. Guesswork: Written without behavioral data. Teams over-block (kills utility) or under-block (misses risk). Either way, it's a guess.
  2. Continuous evolution: Agents, integrations, users, and contexts evolve continuously. Policies are frozen the moment they ship.
  3. Evidence-based approach: Grounded in how agents actually behave, not in guesswork.

Forge's Approach

  1. Capture: Every prompt, tool call, data access and output across the enterprise is normalized into one record.
  2. Baseline: Behavioral profiles per person, agent, MCP, and tool. What's normal for this user, this workflow.
  3. Recommend: Policy based on real behavior: unused permissions, risky tool combos that catch risk.
  4. Enforce: Isolate agents, kill sessions, gate approvals, redact data at the moment of action, not after.

Behavioral Profiling

Understand what "normal" looks like:

  • PERSON: hours, workflows, data classes
  • AGENT: tools chosen, success patterns
  • MCP: callers, payloads, frequency
  • TOOL: Set up in minutes with the EDR your security team already runs.

Case Study - Deployment

From blocker to enabler.

  • An investment firm had recently procured a popular agent platform to enable research copilots for analysts, compliance assistants, and trade-ops agents. Rollout beyond pilot stalled behind manual review. DLP, IAM logs, and secrets scanners couldn't see what the vendor's agents were actually doing across the firm's tools and data. We gave them trace-level visibility and runtime control in one week.

Time to Value

  • 1 week: Autonomous agents are the new insider threat. We build the behavior profiling layer to first enforced policy.
  • 30 days: Analysts and engineers baselined by week 1, runtime policies enforced in week 1.

Team & Backers

  • Rohan Kalahasty, CEO: AI Research @ MIT, Harvard, previously at Google.
  • Anu Bharadwaj: Palantir.
  • Aaron Levie: Cofounder @ Box. CEO @ Okta.
  • Jeetu Patel: President @ Cisco.
  • Founding Team: Second-time founders with deep experience in enterprise security, AI red-teaming, and goal-driven agent systems.