Act Security Aims to Tackle Cloud Vulnerability Challenges with $60 Million in Funding
Act Security steps out of stealth to shrink the window between vulnerability discovery and exploitation, backed by $60 million and a team that's done this before.
Key points
- Act Security raised $60 million in total funding by July 2026.
- The company limits exploitable cloud access rather than chasing every new patch.
- FIRST projects roughly 59,000 new vulnerabilities discovered in 2026, about 161 per day.
- The founding team previously built Medigate and sold it to Claroty for $400 million in January 2022.
What's happening with AI and vulnerabilities?
AI systems are finding software weaknesses far faster than vendors can fix them. Founded in 2025 and based in Tel Aviv, Act Security emerged from stealth this month to address that gap. FIRST, the Forum of Incident Response and Security Teams, projects roughly 59,000 new vulnerabilities in 2026, around 161 every single day. Threat Vectr's coverage of Claude Mythos on 20 July showed the same dynamic: faster discovery tools cut both ways.
How does Act Security plan to help?
Act Security doesn't patch vulnerabilities. It removes the conditions that make unpatched ones exploitable, by enforcing strict boundaries over what humans, workloads and AI agents can reach inside a cloud environment. Jonathan Langer, co-founder and CEO, puts it plainly: "Close to 97% of cloud access sits dormant and unused, and now AI agents are inheriting those same old human permissions, running around the clock, at machine speed, with none of the judgment a person would apply." That's the root problem the company is targeting.
How are vendors coping with the surge?
They're not keeping up. Oracle announced more than 1,400 patched vulnerabilities in its July 2026 update. Microsoft patched a record 622 in the same month. Google pushed 429 fixes in a single Chrome release in June 2026. The numbers keep climbing.
| Company | Vulnerabilities Patched | Date |
|---|---|---|
| Oracle | 1,400+ | July 2026 |
| Microsoft | 622 | July 2026 |
| 429 | June 2026 |
Why is this important for businesses?
Most organisations don't realise how much dormant cloud access they've accumulated. Our 17 July story on cloud app visibility traced three real breaches back to exactly this kind of misconfiguration. Act Security maps its controls to NIST 800-53, PCI DSS and HIPAA, so shrinking access sprawl also advances compliance. Watch whether the access-reduction approach earns traction with enterprises that are drowning in patch queues but can't yet reduce permissions at scale.
Common questions
How can businesses prepare for the surge in vulnerabilities?
Start by auditing cloud permissions and cutting anything that isn't actively needed. That's harder than it sounds, but it's cheaper than responding to a breach.
What role does AI play in cybersecurity now?
AI speeds up vulnerability discovery for both defenders and attackers. Platforms like Act Security try to shrink the window between discovery and exploitation so that gap can't be weaponised.
