kiss — Investor Deck

kiss.

Keep It Simple Security

The control plane for AI agents.
Agents request - kiss decides and executes.

Raising $10M - Seed

The problem

Agents now hold real credentials - and act unsupervised.

Hand an agent your keys and it becomes the operator. Security teams lose the control surface.

Credential exposure

One compromised agent leaks its keys - and your entire integration surface with them.

Unbounded blast radius

Agents over-execute, hallucinate, or get prompt-injected - with nothing between intent and impact.

Zero auditability

No central record of what happened, who authorized it, or why.

The principle

Check intent against your business - then execute.

Agents decide what to do. kiss decides if it's allowed - validating each request against your real business logic and data first.

Intent

“Refund $85 to cus_123.”

Agent asks. Holds no credentials.

kiss checks your business

Static policies

Within the agent's refund limit?
Refund to the original method only?

Dynamic business values

Matching, approved ticket in Jira?
Order exists - and totals exactly $85?

Execute

All pass → kiss runs it.

Your credentials, your systems - never the agent's.

Attacks we stop

Every attack is a valid action with corrupted values.

Authorization says yes. Only a check against an independent business record says wrong. That check is the product.

Payroll redirect

Real · Okta O-UNC-034

update_direct_deposit → attacker acct

kiss blocks: New bank account must match an employee-filed, verified request. No match → block.

Vendor payment fraud (BEC)

Real · FBI IC3

pay_invoice $48k → attacker IBAN

kiss blocks: Payee must match the vendor record's verified account. ACH has no rails protection - we're the only check.

Prod deploy hijack

Agentic

deploy(app, env=production)

kiss blocks: Target must match the linked PR. Meant for staging → block, step up to the release owner.

Bulk data exfiltration

Agentic

export(scope=ALL, dest=external)

kiss blocks: Scope must match the ticket that authorized it. ALL ⊄ one account → block.

How it works

Intent to execution, in four steps.

Agent requests

Submits intent - action, identity, context. No credentials of its own.

kiss decides

Validates against your policy, business data, and risk. Allow, deny, or ask.

kiss executes

Runs it through managed connectors. Keys never leave our infrastructure.

Everything is logged

A full record per action: who, what, decision, and result.

Why now

Agents are going autonomous. The governance layer doesn't exist yet.

Every platform is shipping agents. We're one breach away from execution security becoming mandatory - and there's no incumbent.

$39B

TAM by 2030

Agentic AI governance and policy management market, growing ~40% a year.

40%

Enterprise apps by 2026

Will embed task-specific AI agents, up from under 5% in 2025.

45:1

Non-human identities

Machine and agent identities now outnumber humans - each needs credential and execution control.

Differentiation

Others check if it's allowed. We check if it's right.

Owning execution is table stakes - access tools broker credentials inline too. Our wedge is the business-logic check against your system of record.

Traditional IAM

Okta, Entra

Grants access to systems. Whatever holds the credential can do anything it allows.

Agent access control

Oasis, Aembit

Brokers credentials inline and checks static policy - proves the agent is allowed. An in-scope action with the wrong values still passes.

kiss

The business-logic layer

Static policies

Limits, allowed operations, environments.

Dynamic business values

Does this action match the order, ticket, or PR that justifies it?

Identity tools prove the right agent is acting. kiss proves it's doing the right thing - verified against your records, before it runs.

Traction

Early momentum with design partners.

Design partners

Pre-revenue

Stage

Design partners

Business model

Usage-based SaaS with enterprise tiers.

Land with security teams, expand as agent volume grows. Revenue scales with governed actions.

Team

From $50K/yr

Up to 50 governed agents
Core connectors
Policy engine & approvals
Full audit trail
Email support

Business

From $150K/yr

Unlimited agents
All connectors
Advanced policy & SoD controls
SSO & RBAC
SOC 2 evidence export
Priority support

Enterprise

Custom

Dedicated infrastructure / VPC
On-prem & air-gapped option
Custom policy engine
SLA & dedicated support
Deployment services

The ask

Raising $10M to build the control plane.

A $10M seed gives us ~24 months of runway to take the platform to GA, hire the rare authorization and security talent the category demands, convert design partners into paying enterprise customers, and reach Series A metrics.

$5M

50%

Engineering

Take the control plane to GA - policy engine, connector library, and runtime authorization built by distributed-systems and authz talent.

$2.5M

25%

Go-to-market

Convert design partners to paying customers and build a repeatable enterprise security pipeline.

$1.5M

15%

Security & compliance

SOC 2 Type II, penetration testing, applied security research, and the certs enterprises require.

$1M

10%

Operations

Leadership hires, cloud infrastructure, legal, and finance to scale the team to ~30.

What this funding gets us

Ship the control plane to general availability
Land first paying enterprise customers from our design partners
Achieve SOC 2 Type II
Scale the team to ~30 across engineering, security, and GTM
Reach the metrics for a Series A

Round details

Raise: $10M seed
Instrument: SAFE (post-money)
Cap: $50M post-money
Runway: ~24 months

Use of funds

Every dollar buys a milestone.

$10M takes the control plane to GA, earns the trust signals enterprises demand, and proves the wedge with paying customers - in 24 months.

Control plane & policy engine

$3.2M

Harden the decision engine to production-grade reliability.

Connectors & runtime execution

$1.8M

Managed connectors for top enterprise systems.

Go-to-market

$2.5M

Convert design partners and build enterprise pipeline.

Security & compliance

$1.5M

SOC 2 Type II, pen testing, applied research.

Operations & leadership

$1.0M

Infra, finance, legal, and leadership hires.

24-month milestone path

Q1-Q2

Control plane to GA

Q2-Q3

First paying enterprises

Q3-Q4

SOC 2 Type II

Q4+

Series A metrics

Hiring plan

Scaling 3 to ~30 - product and pipeline in parallel.

We build the control plane to GA while standing up the commercial motion to convert design partners and land the first paying enterprise logos.

55%

Product

30%

GTM

15%

Security & compliance

Distributed systems

+5-6

Built low-latency, high-availability control planes that sit in the critical path.

Runtime authorization

+3-4

Shipped policy engines like OPA, Cedar, or Zanzibar.

Connectors & integrations

+2-3

Depth on the enterprise systems design partners need first.

Design-partner success

+2-3

Technical CSEs who embed with enterprises and drive conversion to paid.

Enterprise GTM

+4-5

Security-native AEs and SEs who sell to CISOs.

Security & compliance

+2-3

Applied research, SOC 2 Type II, and the certs enterprises require.

Comparable companies

Infra control planes earn early conviction.

The companies that owned access and identity raised big early rounds. The agent-security cohort is funded today - but none check whether an in-scope action is actually right.

Category-defining infra

HashiCorp (Vault)

$10M Series A

Owned the policy and credential layer to define a category.

Okta

$10M Series B

Became the system of record for who can access what.

Wiz

$100M+ early

Urgent security infra commands large early rounds.

The agent-security cohort

Aembit

$25M+

Workload IAM for non-human identities.

Oasis Security

$40M+

Non-human identity management at scale.

Astrix Security

$40M+

Securing app-to-app and agent connections.

They prove the agent is allowed. $10M lets us own the layer that proves it's right.

The team

Meet The Team

Maor Angel

CEO

Founder & CEO, PTaaS
Security Researcher
Penetration Tester
B.A Political Science

Raz Ego

CTO

IDF: Matzpen, Research Unit
Founder & CAIO, Alive
Founder & CTO, Voodoo
B.Sc Software Engineering
MBA, Corporate Finance

Snir Ego

CPO

Founder & CTO, Alive
Founder & CEO, Voodoo
AI & Big Data, Bynet & Refael
B.Sc Software Engineering

kiss.

Let's talk.

We'll walk you through the product, the vision, and the round.

Email us One pager

dev@kiss-security.com

Download one pager

kiss.

01 / 15