The list. Act Security made the 2026–2027 Fortune Cyber 60 in the early-stage group. Fortune’s profile lists it in Tel Aviv, founded in 2025, with 57 employees and CEO Jonathan Langer. Fortune reports $60 million in funding. Act’s July launch release breaks that into a $20 million seed led by Team8 and Bessemer Venture Partners and a $40 million Series A led by Notable Capital, with Hetz Ventures, Claltech, Startpoint Capital and SVCI joining. Act’s launch post also names Lux Capital. Valuation and revenue are Undisclosed. Lightspeed, which helps run the Cyber 60, is not listed as an investor.
Who built it. Langer and CTO Itay Kirshenbaum co-founded Medigate, the medical-device security company Claroty bought for about $400 million. Bessemer backed them then and backed them again, at both the seed and the A. Repeat founders with a repeat investor raised $60 million in roughly a year. That is the signal.
The problem, in plain words. Cloud security tools are very good at finding things. Misconfigured buckets, risky roles, attack paths. The result is a backlog of thousands of findings that nobody has time to fix. Every fix carries a fear: if I remove this permission, what breaks? So tickets age. Act says that, across its customers, close to 97% of cloud access sits dormant. That is a company claim, not an audited number. But anyone who has looked at an AWS account knows the shape is right. Now AI agents are inheriting those same broad human permissions and running around the clock.
The unique part: simulate first, then enforce with your own controls. Act reads identity, network and AI access together to model what each person, workload and agent can actually reach. Then it compares three things: what is configured, what is used, and what should be allowed. Next comes the step most tools skip. Act simulates each change against your real environment before it goes live, so the team sees what would break. Only then does it apply the fix through the cloud provider’s own native controls, which every identity has to obey. One policy change can close thousands of paths, Act says. Its open-source tools on GitHub, iam-collect and iam-lens, show the approach. They download your real AWS policies and answer “who can do this?” locally, without touching production.
Why it’s winning now. Two things changed this year. AI models now find exploitable bugs faster than teams can patch them, and attackers use AI to move through a network in minutes once inside. If you cannot patch fast enough, you shrink what an intruder can reach. Act calls this action-centric security. On October 28, the analyst firm SACR named a new category for it, Cloud Security Intent Enforcement, according to Act. Act is listed on the AWS, Google Cloud and Microsoft marketplaces. Its site carries quotes from CISOs at AlphaSense, Armis and Papaya. Those are company-published endorsements.
The risk: least privilege is an old promise. Identity tools have pitched “remove unused permissions” for years. Sonrai Security sells a Cloud Permissions Firewall it pitches as one-click least privilege. Wiz, Palo Alto and Microsoft can add automated fixes to platforms customers already own. And the reason teams don’t enforce least privilege was never a lack of data. It was fear of an outage. Act’s whole bet is that simulation removes that fear. One bad change that takes down production would undo it.
Our read. This is the right reframe. The industry measured cloud security by findings found. The buyer cares about paths closed. A $60 million round for a one-year-old company is rich, but these founders have sold before, and the category timing is good. What would change our view: proof that Act can enforce in large, messy multi-cloud estates without breaking things, and renewals that show customers kept the boundaries in place.
For practitioners. Pick one crown-jewel data store. Count how many identities can read it and how many actually did in the last 90 days. The gap is your blast radius.
What stops your team from removing unused cloud permissions today: the tooling, or the fear of breaking production?