Cisco’s strategic check into Arcade’s action layer answered one question: who owns tool-call authorization. A day later, a different graph problem got its own seed print. On September 29, 2026, Tel Aviv–based Rig Security emerged from stealth with a $12 million seed led by Ten Eleven Ventures and Brightmind Partners, with strategic participation from the CrowdStrike Falcon Fund and angel capital including Ami Luttwak (Wiz co-founder and CTO). Valuation: Undisclosed. Primary desk sources: SecurityWeek and Ctech (Calcalist) same day.
Round, as printed. SecurityWeek: $12M seed led by Ten Eleven and Brightmind, CrowdStrike Falcon Fund participation, angels including Luttwak. Ctech: same lead and Falcon Fund strategic line; round closed late 2025, company now exiting stealth; founded early 2025 by CEO Guy Kozliner (ex-Wiz CTO-team under Luttwak); CTO Nokky Goren (first engineer at Axis Security / HPE); Head of Product Michal Haikov (Unit 8200 / Flow Security → CrowdStrike). Headcount stated: 20, with Israel and U.S. hiring planned. Post-money / ARR: Undisclosed.
The identity problem they claim to own. Kozliner’s thesis, quoted in both SecurityWeek and Ctech: AI agents increasingly act under human names. Security teams can see that an account did something dangerous; they cannot see whether a person did it or an agent did — and they cannot stop the agent without blocking the person. Agents inherit the permissions of the developer or service that launched them. Traditional remediation (disable the account) breaks the employee. That is a different chokepoint than Arcade’s tool-call authorization plane. Arcade sits outside the model at the action boundary. Rig sits on the identity graph that decides whose session the agent is borrowing.
Product — company claims, attributed. Two engines: RICE (Rig Identity Correlation Engine) builds an identity dependencies graph across IdPs, cloud, on-prem, network edge, and endpoints — vendor-claimed >96% correlation accuracy (SecurityWeek / Ctech; patent process claimed, not validated here). Bifrost is a lightweight endpoint sensor that distinguishes an AI agent’s session from the user’s and enforces policy inline — block the agent action without necessarily blocking the person. Together: ISPM + ITDR across human, machine, and AI identities. Ctech adds: available on AWS Marketplace and CrowdStrike Marketplace; named a top-three startup in an AWS / CrowdStrike / NVIDIA accelerator; claims to analyze “hundreds of millions” of identity events monthly (company claims, not a CyberMerge census). Fortune 200 production use across financial services, insurance, healthcare, and technology: company-stated.
Why Falcon Fund and Luttwak matter as signals — not as valuations. CrowdStrike putting Falcon Fund capital into an identity-graph / endpoint-sensor play is a strategic adjacency bet: Falcon already owns endpoint; Rig claims the missing attribution layer when agents hide behind human sessions. Luttwak angel-checking a Wiz alum who is replaying graph security on identity is a founder-signal, not a Wiz product announcement. No strategic partnership beyond what the round language states.
POV — second strategic agent-identity bet after Cisco→Arcade. Boards should ask a sharper question than “is agent security hot?”: who owns the agent-versus-human identity graph when SIEMs cannot tell them apart? Action-layer control (Arcade-class) and identity-attribution graphs (Rig-class) are complementary theses, not the same product. Underwrite the $12M seed as disclosed. Treat valuation, ARR, and any “TAM” as Undisclosed. Watch: whether Bifrost becomes a Falcon Marketplace attach story, whether RICE’s >96% claim survives customer diligence, and whether enterprise buyers pay for ISPM/ITDR that separates agent sessions from people — or fold the problem into existing IdP and EDR renewals.
Underwrite sheet — sourced only: SecurityWeek Sep 29, 2026 (Kevin Townsend) — Rig out of stealth; $12M seed led by Ten Eleven Ventures + Brightmind Partners; CrowdStrike Falcon Fund participation; angels incl. Ami Luttwak; founded 2025 Guy Kozliner (ex-Wiz); RICE + Bifrost; >96% correlation claim; Fortune 200 production; funds → research/engineering, U.S. GTM, partners/channels. Ctech Sep 29, 2026 (Meir Orbach) — same $12M / leads / Falcon Fund strategic; closed late 2025, emerging from stealth; Goren CTO / Haikov HoP; 20 employees; AWS + CrowdStrike Marketplace; top-three AWS/CrowdStrike/NVIDIA accelerator claim; hundreds of millions of identity events/month (company). Valuation / ARR Undisclosed.