Latest / The Series A Show with Fexingo: Early-Stage Funding, Pitch Decks, and Startup Milestones / Why Agent Security Is the New Must-Have in Every Series A Pitch
Transcript
- Lucas: There were two deals this week that tell you exactly where Series A money is flowing right now. Cyera, the cloud security company, agreed to buy Oasis Security for one billion dollars. And Spur, a bot-detection startup, raised two hundred million from Insight Partners. Both are about one thing: securing AI agents. Luna: So for founders who aren't specifically building security products — does this actually matter? Or is it just another niche heating up? Lucas: It matters for every AI startup that touches agents. And that's almost all of them now — customer service bots, sales outreach agents, internal workflow automators. If you're deploying any autonomous software, investors want to see how you're handling the security posture. That slide used to be optional. Now it's table stakes. Luna: I've been looking at term sheets from a few top-tier funds this quarter, and I've noticed a new section under 'product milestones' — it explicitly mentions agent security. Things like 'demonstrate protection against prompt injection' or 'prove data perimeter isolation.' Lucas: Exactly. And the Cyera-Oasis deal validates that this isn't just a feature — it's a standalone market. Oasis was building identity and access management specifically for AI agents. Cyera is paying a premium to own that stack. For Series A founders, that's a signal: if your product can be wrapped in a security narrative, your exit multiple goes up. Luna: What does that look like in practice? Say I'm a founder building an AI sales rep — how do I pitch security without pivoting to become a security company? Lucas: You don't need to build a firewall. You need to show that you've thought about the attack surface. For an AI sales rep, that means: how do you prevent the agent from being tricked into sharing customer data? How do you audit its decisions? Investors want to see a dedicated security slide in your deck — maybe two slides — that covers data boundaries, model access controls, and your red-teaming process. And you should name the framework you're using: OWASP for AI agents, or the NIST AI risk framework. Luna: So it's about showing awareness and a plan, not necessarily having a fully built solution. That's actually a lower bar than some founders assume. Lucas: Right. The bar is elevated, but it's not PhD-level. And here's the good news: the two hundred million that Spur raised from Insight tells you that VCs are willing to write big checks for point solutions in this space. So if you are building a pure agent security product, the market is wide open. You can pitch that directly. Luna: I want to push back a little — isn't there a risk that investors are overcorrecting? That every AI startup will be forced to spend precious engineering time on security theater instead of product differentiation? Lucas: That's a fair concern. But look at what happened with the Runlayer-Rippling lawsuit this week. Runlayer is an MCP startup — they make a platform for model context protocol. They're accusing Rippling of stealing their product idea. That case is about IP, but it's also about trust in how agents interact with data. If you're building a general-purpose AI platform and you ignore security, you're exposing yourself to those kinds of disputes. Investors see that as a liability. Luna: So the security slide is actually a risk mitigation slide for the investor. It says 'we won't blow up on regulatory or legal grounds.' Lucas: Exactly. And that's why the Cyera-Oasis deal at a billion dollars is so important. It proves there's a liquid exit market for agent security. For a Series A founder, that makes the asset class more attractive. You can tell your investors: 'Look, if we execute, there's a clear path to acquisition.' That wasn't true two years ago. Luna: Cyera itself was a late-stage company — they raised a huge round in 2024. They're not a startup. But the acquisition validates the thesis for earlier stage players. Lucas: Right. And Oasis was earlier — they raised a Series A in early 2025? I think. So that exit is within the time horizon of a fund. And Spur's round is also a strong signal: Insight paid up for a company that's essentially building the 'bot catcher' for AI agents. That's a classic cybersecurity angle applied to a new vector. Luna: Let's get practical. For a founder listening right now who has a Series A pitch coming up in the next three months — what should they change in their deck based on this news? Lucas: First, add a section on agent security. Even if you're a horizontal AI platform. Second, include a slide on your data architecture. Show how customer data flows through your models and where it's stored. Third, discuss your red-teaming process or your plans for it. Fourth, mention any compliance certifications you're pursuing, like SOC 2 or ISO 27001. And fifth, if you can, name a partner or advisor in the security space. That last one adds credibility instantly. Luna: Would you recommend showing a competitor landscape that includes Cyera or Oasis? Or is that too aspirational? Lucas: It depends on your product. If you're an agent security startup, absolutely — you want to show that your solution is differentiated from what Oasis did or what Cyera will do post-acquisition. If you're a general AI company, you don't need to compete with them; you just need to show you're aware of the ecosystem. But don't fake it. If you don't have a security background, say that you're hiring for a head of security post-Series A. Luna: I've seen some VCs recently add a 'security due diligence' clause as a condition for funding, not just a diligence item. So if a founder gets a term sheet, they should expect a deep dive into their agent security posture before the money hits the bank. Lucas: That's happening more and more. And honestly, this is the kind of intel that can save a founder months of pivoting. If you're building an AI startup in 2026 and you haven't considered your agent security narrative, you're already behind. Luna: Yeah, it's a shift. But it's also an opportunity to stand out. The founders who get this right will have an easier time closing their rounds. Lucas: Exactly. And if today's episode helped you think through your own pitch, that's exactly why we do this show. We keep it ad-free because listeners like you support it. If this was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. Every bit helps us keep digging into the details that matter. Luna: We really appreciate that. And it lets us stay independent, which means we can talk about deals like Cyera-Oasis without any spin. Lucas: So back to the practical side — let's talk about what that security slide should actually look like. I've seen decks that just have a bullet point saying 'security is important.' That doesn't cut it anymore. You need a specific architecture diagram showing data boundaries, encryption in transit and at rest, and access control layers. And you need to explain how you handle the 'agent context' problem — meaning, how does the agent know what data it's allowed to access? Luna: That's where Oasis's technology came in. They were building identity and access management for AI agents. So essentially, every agent gets a 'permission set' similar to a user in a company. Founders can borrow that metaphor. Lucas: Right. And you can implement that without buying Oasis. You just need to show you've thought about it. The best pitches I've seen recently include a slide titled 'Agent Governance' and they break it down into identity, data access, audit, and red teaming. That level of specificity signals maturity. Luna: I also wonder if we'll see a new standard emerge — like an 'AI agent SOC 2' type certification. That would make it easier for startups to prove compliance without building everything from scratch. Lucas: Some firms are already working on that. The Cloud Security Alliance has a working group on AI agent security. I imagine within a year, there will be a certification that Series A investors expect. For now, founders should focus on the fundamentals and be ready to talk about them convincingly. Luna: So to summarize: the Cyera-Oasis and Spur deals are not just cybersecurity news. They're a signal that agent security is now a critical part of any AI startup's go to market and fundraising strategy. Lucas: Exactly. And if you're raising a Series A in the next six months, take this seriously. The VCs who write those big checks are reading the same headlines we are. They're going to expect you to have answers.