Pluto Security has raised $42 million in a recent funding round, signaling a significant shift in how enterprises approach the integration of generative AI tools. The investment comes as security teams move away from blanket bans on AI platforms toward a model of active governance, attempting to resolve the “Shadow AI” dilemma where employees use unauthorized tools to process sensitive corporate data.
The funding round, announced in October, highlights the growing demand for AI Security Posture Management (AI-SPM). While many organizations initially responded to the rise of Large Language Models (LLMs) by blocking access to sites like ChatGPT, the rapid adoption of these tools for productivity—such as debugging proprietary source code or summarizing internal meeting transcripts—has made total prohibition increasingly untenable for modern businesses.
The Shift from Blocking to Governance
For Chief Information Security Officers (CISOs), the primary “headache” is no longer just the existence of AI, but the non-deterministic nature of how these tools are used. Traditional Data Loss Prevention (DLP) tools often struggle to identify sensitive information when it is embedded in complex prompts or when employees use AI to “obfuscate” data by asking for a rewrite.
Pluto Security’s platform aims to provide visibility into these interactions, moving the enterprise toward a governance-first approach. By monitoring how employees engage with both sanctioned and unsanctioned AI applications, the company enables security teams to set granular policies that prevent the leakage of intellectual property without stifling the efficiency gains promised by generative AI.
The company recently emerged from stealth with a total of $42 million in funding, positioning its technology as a layer of protection that sits between the user and the AI model. This governance layer is designed to catch “Shadow AI”—the unauthorized use of AI tools—by identifying when proprietary source code is fed into public models for debugging without proper de-identification.
Mitigating the ‘Shadow AI’ Risk
The rise of AI-SPM as a category reflects a broader industry trend identified by analysts as a critical high-growth area. Unlike traditional security tools that focus on static vulnerabilities, AI-SPM addresses the dynamic risks of “prompt injection” and data exfiltration through natural language.
Enterprise security teams are currently facing a gap where wide access to AI tools has outpaced the development of internal security controls. Common scenarios that create these gaps include:
- Employees inputting customer data into LLMs to generate personalized marketing copy.
- Developers using AI assistants to refactor internal code, inadvertently training public models on private repositories.
- Administrative staff using AI-powered transcription services that store sensitive executive discussions on third-party servers.
Pluto Security’s approach focuses on providing the observability required to track these events in real-time. By categorizing the unexpected ways employees interact with AI, the platform allows for the creation of guardrails that can redact sensitive information before it ever reaches the cloud-based AI provider.
As more enterprises integrate AI into their core workflows, the focus is expected to remain on these governance platforms. The $42 million investment in Pluto Security underscores a market consensus that the “AI Ban” era is ending, replaced by a requirement for sophisticated oversight that can distinguish between productive AI use and high-risk data exposure. According to reporting from Ctech, this funding will likely support the expansion of Pluto’s engineering teams to handle the increasingly complex landscape of LLM-based threats.
