Bloom Security Emerges from Stealth with $20M to Secure the AI-Native Endpoint

Funding Bloom Security Emerges from Stealth with $20M to Secure the AI-Native Endpoint Published July 30, 2026 By Antoine Tardif, CEO & Founder of Unite.AI Add Unite.AI to your preferred sources on Google Bloom Security has emerged from stealth with $20 million in seed funding to address a growing blind spot in enterprise cybersecurity: the expanding collection of AI agents, browser extensions, plugins, code packages, and local automation operating on employee devices.The round was led by Glilot Capital Partners, with participation from Ten Eleven Ventures, Okta Ventures, and Runtime Ventures. Angel investors include founders of cybersecurity companies Dig Security, Demisto, Snyk, and Talon. Bloom is launching with a 30-person team and says its platform is already deployed at dozens of large enterprises in the United States and Europe.The Enterprise Endpoint Is Becoming Harder to DefineTraditional endpoint security was built for managed devices running approved software, with endpoint detection and response tools focused primarily on malware and suspicious processes.Generative AI has disrupted that model. Employees can now add coding assistants, AI agents, browser extensions, open-source packages, and local automation outside traditional procurement channels. Browsers and development environments have become software marketplaces, while agents can install dependencies independently.As a result, endpoints are evolving into constantly changing software ecosystems. Security teams must now assess not only whether a tool is malicious, but whether a legitimate tool is appropriate for a particular user, device, and data environment.A browser extension may be low risk on one laptop but dangerous on an executive’s device. Similarly, an approved AI agent may become overprivileged if it can access production credentials, customer data, or financial records.Building an Inventory of What Is Actually RunningBloom’s platform maintains a continuously updated inventory of software across an organization’s endpoint fleet, including applications, browser extensions, development environment plugins, AI tools, Model Context Protocol servers, and local code libraries.Model Context Protocol, or MCP, allows AI agents to connect with external tools, data sources, and business systems. While these connections expand what agents can do, they may also expose sensitive information or enable actions on a user’s behalf.Bloom analyzes each component’s developer, origin, permissions, configuration, and access to corporate resources. It also tracks changes over time, helping security teams identify software introduced through marketplaces, package managers, background updates, or automated agent activity.This is particularly relevant in software development, where a coding agent may select frameworks and install multiple dependencies before a developer reviews the resulting application.Evaluating Risk in ContextBeyond identifying software, Bloom evaluates the context in which each component operates. The platform combines marketplace intelligence, static analysis, and behavioral sandboxing to assess configurations, permissions, data access, vulnerable packages, policy bypasses, and interactions between tools.Risk is measured according to factors such a