AI-era endpoint security is the practice of monitoring, controlling, and protecting employee devices from risks created by AI agents, AI-generated code, and AI-assisted attacks — not just traditional malware. Israeli-American startup Glow just raised $180 million at a $1.2 billion valuation to build exactly this kind of platform, betting that the old rules of endpoint protection no longer apply.
Glow’s stealth-to-unicorn launch is more than another funding headline. It signals that some of the industry’s most disciplined investors — Sequoia Capital, Cyberstarts, Greenoaks, and Redpoint Ventures — believe enterprise security is entering a genuinely new phase, one where AI agents running on laptops and servers are as much a risk surface as the humans using them. The Palo Alto-headquartered startup raised its $180 million round entirely in equity, a structure that itself signals investor conviction rather than debt-fueled growth pressure.
This article breaks down what Glow does, why this emerging category matters right now, how the platform actually works under the hood, and how it stacks up against the endpoint detection and response tools most companies already rely on. Along the way, we’ll look at the broader forces — from AI-assisted malware to autonomous coding agents — that are pushing enterprise security teams to rethink assumptions that have held for more than a decade.
What Is AI-Era Endpoint Security?
AI-era endpoint security refers to a category of tools designed to secure devices — laptops, servers, and other connected endpoints — against risks introduced specifically by AI adoption inside the enterprise. This includes AI coding agents pulling in malicious software packages, employees using unsanctioned AI tools, and attackers using generative AI to automate phishing and malware development.
Unlike conventional endpoint protection, which focuses on detecting known malware signatures or unusual behavior after a breach occurs, this new approach is built to anticipate a much wider and faster-moving set of threats. AI agents can write, install, and execute code autonomously, which means a single compromised or careless agent can introduce risk at a scale no individual employee could match manually working alone.
In short: this category expands the definition of “endpoint risk” beyond malware and phishing to include the software, agents, and developer tools that AI systems are now installing and running on their own, often without a human reviewing each step.
Why the Definition Keeps Expanding
A decade ago, “endpoint” meant a laptop or desktop running a fixed set of applications that IT had approved and imaged. Today, that same laptop might be running a local AI coding assistant, a browser-based agent capable of clicking through internal systems, and a handful of command-line tools an engineer installed that morning to test a new library. Each of those additions widens what security teams have to account for, and none of them show up cleanly in a traditional asset inventory. That’s the practical reason vendors like Glow argue the category needs its own name, its own tooling, and its own risk model rather than being bolted onto legacy EDR dashboards as an afterthought.
Why This Category Is Emerging Now
Two forces are colliding at once. First, enterprises are rapidly deploying AI coding assistants and autonomous agents to boost productivity. Second, attackers are using those same generative AI capabilities to scale their own operations. Enterprises are rethinking endpoint security as attackers increasingly use generative AI to automate phishing, develop malware, and launch more sophisticated cyberattacks. That two-sided shift is precisely the gap Glow and its backers are trying to fill.
It also explains the funding math. A $1.2 billion valuation for a company that only just emerged from stealth is unusual even by cybersecurity standards, where investors have grown accustomed to writing large early checks for category-defining bets. Sequoia, Cyberstarts, Greenoaks, and Redpoint were joined by Index Ventures, Swish Ventures, Lux Capital, Operator Collective, and Holly Ventures — a syndicate broad enough to suggest more than one firm independently concluded that endpoint protection is being rebuilt from the ground up rather than incrementally patched.
Why Traditional Endpoint Security Is Failing in the Age of AI
The Shift from Cloud/SaaS to the AI-Native Endpoint
For the past decade, enterprise security teams focused their attention on the cloud and SaaS applications, since that’s where most workloads and data migrated. Glow co-founder and CEO Roi Tiger explained that while the last decade was defined by everything moving to the cloud and SaaS, AI is now landing on the endpoint in a way the industry has never seen before. That reversal matters because most endpoint tools were architected for a world of static software, not autonomous agents capable of independently fetching and executing new code.
How Attackers Are Weaponizing Generative AI
Concerns about AI-assisted attacks aren’t hypothetical anymore. Worries have intensified since Anthropic unveiled a preview of its Mythos AI model, which the company said showed advanced capabilities for identifying and exploiting software vulnerabilities, fueling broader debate over AI-assisted cyberattacks. When the same techniques that make AI useful for defenders — fast vulnerability discovery, automated code review — become available to attackers, the calculus for endpoint defense changes completely.
This is the environment in which endpoint protection has moved from a routine IT line item to a boardroom priority.
The Software Supply Chain Angle
There’s a second, quieter driver behind this shift: the software supply chain. Modern applications are built from hundreds or thousands of open-source packages, and AI coding agents now routinely search for, download, and install those packages with minimal human review. That convenience is also an opening. A malicious or typo-squatted package that a human developer might catch on a second glance can slip past an agent optimizing purely for “does this compile.” Glow’s own product findings — blocking malicious npm packages before installation — point directly at this risk, and it’s a big part of why prevention-first platforms are gaining traction over purely reactive tools.
Inside Glow: A Case Study in AI-Era Endpoint Security
Who’s Behind Glow
Glow was founded in 2025 by CEO Roi Tiger, a former Meta vice president of engineering, alongside former Snowflake cybersecurity strategy head Omer Singer, former Claroty vice president of research and development Ophir Arie, and former Meta engineering leader Arnon Joseph. The leadership team also includes chief operating officer Emily Heath, a former chief information security officer at United Airlines and DocuSign who served on Wiz’s board through its $32 billion acquisition by Google and previously worked as a partner at Cyberstarts.
That pedigree — spanning Meta, Snowflake, Claroty, and a front-row seat to one of cybersecurity’s biggest exits — gives Glow unusually deep credibility for a company barely a year old. It also mirrors a pattern seen across the last few cybersecurity unicorns: teams that combine hands-on operator experience at hyperscale tech companies with deep security-specific domain expertise tend to raise faster and at higher valuations, because investors are betting on execution speed as much as the underlying idea.
The company is still small by headcount, with nearly 100 employees, roughly 70% of them based in Israel and the rest in the United States. That distribution reflects a familiar cybersecurity startup blueprint: R&D concentrated in Israel’s dense security talent pool, paired with a go-to-market presence closer to U.S. enterprise customers.
How Glow’s Platform Actually Works
Glow is building an endpoint security platform that helps enterprises monitor and control the software, AI agents, and developer tools running on employee devices, using specialized AI agents to continuously map enterprise environments, assess risk in real time, and enforce security policies. Rather than waiting for a threat to trigger an alert, the platform is designed to intervene before risky software or agents ever enter the environment.
To power the platform, Glow uses AI models from Anthropic and Google’s Gemini through Amazon Bedrock, while building its own software layer to give those models enterprise context and improve their reliability for security-specific tasks. This “bring your own foundation model, wrap it in proprietary context” approach is becoming a common pattern among AI-native security startups, since it lets young companies focus engineering resources on the workflow and data layer rather than trying to out-train the foundation model labs themselves.
In practice, that means Glow’s specialized agents aren’t just scanning files — they’re reasoning over enterprise context: which employee owns which device, what that employee’s normal software footprint looks like, and whether a newly detected AI agent or package request fits an established pattern or represents an anomaly worth flagging. That contextual layer is what separates a genuinely AI-native security product from a legacy tool that simply added a chatbot on top of an existing dashboard.
Early Results and Customer Traction
Despite only just emerging from stealth, Glow said it already has paying customers across healthcare, retail, and financial services, though it declined to disclose customer names or exact numbers, with typical deployments spanning tens of thousands of employee devices across global organizations.
Glow said its platform has already prevented malicious npm packages — third-party software components used to build applications — from being installed in customer environments, flagged AI agents attempting to pull in such packages, and identified employee devices where endpoint detection and response tools were missing or running with reduced functionality.
AI-Era Endpoint Security vs. Traditional EDR
Understanding how this new approach differs from conventional endpoint detection and response (EDR) tools clarifies why investors are treating it as a distinct category rather than a feature update.
| Dimension | Traditional EDR | AI-Era Endpoint Security |
|---|---|---|
| Primary focus | Detecting malware and threats after they appear | Preventing risky software, agents, and tools from entering the environment |
| Threat model | Human-driven attacks, known malware signatures | AI-generated malware, autonomous agent behavior, AI-assisted phishing |
| Detection timing | Largely reactive, post-compromise | Proactive, pre-execution risk assessment |
| Scope of monitoring | Files, processes, network activity | Files, processes, plus AI agents, developer tools, and package installs |
| Representative vendors | CrowdStrike, SentinelOne, Microsoft Defender | Glow and other emerging AI-native entrants |
| Underlying technology | Signature and behavioral analytics | Foundation models (e.g., Anthropic, Gemini) plus proprietary enterprise context |
Tiger has said existing endpoint detection and response products focus primarily on detecting threats after they emerge, whereas Glow is designed to prevent risky software, AI agents, and developer tools from entering enterprise environments in the first place. Glow enters a market already dominated by established players including CrowdStrike, Microsoft, SentinelOne, and Palo Alto Networks, meaning it will need to prove out this prevention-first approach against deeply entrenched incumbents.
That competitive reality shouldn’t be underestimated. CrowdStrike, Microsoft, and Palo Alto Networks all have enormous existing customer bases, mature detection engines built over more than a decade, and the balance sheets to acquire smaller AI-native challengers rather than compete with them head-on. Glow’s bet is that prevention-first architecture is different enough — and the AI-driven risk surface growing fast enough — that incumbents retrofitting old products won’t be able to match a platform purpose-built for this problem from day one. History in cybersecurity is mixed on this question: some category creators (like CrowdStrike itself, relative to legacy antivirus) went on to dominate, while others were eventually absorbed by the very incumbents they set out to disrupt.
How Enterprises Can Prepare for This Shift
Security leaders don’t need to wait for a formal category to form before acting. Here’s a practical starting checklist:
- Inventory AI agents and developer tools currently running across employee devices, not just sanctioned SaaS apps.
- Audit package installation policies to catch malicious or unvetted dependencies (like npm packages) before they reach production.
- Verify EDR coverage across the fleet — Glow’s own findings show devices frequently run with missing or degraded endpoint protection.
- Establish AI usage policies that define which AI tools and agents employees are permitted to run locally.
- Evaluate prevention-first platforms alongside existing detection-based EDR tools rather than assuming legacy coverage is sufficient.
- Track vendor AI dependencies — know which foundation models your security tools rely on and how enterprise context is layered on top.
What Glow’s Funding Round Signals for the Broader Market
Glow’s $180 million Series A is a useful data point for anyone tracking where cybersecurity capital is flowing in 2026. A handful of patterns stand out:
- Unicorn status pre-revenue disclosure. Glow reached a $1.2 billion valuation without publicly sharing revenue figures, joining a growing list of cybersecurity startups that investors are pricing on team quality and category timing rather than trailing financials alone.
- All-equity structure. The round was raised entirely in equity rather than a mix of equity and debt, a structure often associated with investor confidence in long-term upside over near-term capital efficiency.
- A broad, high-conviction syndicate. Nine separate investment firms participated, spanning early-stage specialists like Cyberstarts and growth-stage generalists like Sequoia and Greenoaks — a spread that suggests conviction across multiple stages of the investment lifecycle, not just one firm’s contrarian bet.
- Geographic concentration in Israeli security talent. With the majority of its workforce based in Israel, Glow continues a well-established pattern of cybersecurity innovation clustering around that talent pool, alongside companies like Wiz, Claroty, and SentinelOne.
For enterprise buyers, the practical takeaway is less about the funding headline and more about what it predicts: expect a wave of well-capitalized competitors racing to define this space over the next 12 to 24 months, which typically means faster product iteration, more aggressive pricing to win early logos, and consolidation once the category matures.
Is AI-Era Endpoint Security a New Category?
Question: Will AI-native endpoint security become its own distinct product category, separate from traditional EDR?
Direct Answer: It’s not settled yet, but the market signals point toward yes. Whether AI-native endpoint security platforms become a distinct category remains to be seen, as enterprises are only beginning to grapple with the security implications of increasingly capable AI models. What is clear is that a $1.2 billion valuation for a company barely a year removed from founding — backed by some of venture capital’s most selective firms — suggests investors aren’t waiting for certainty to place their bets.
FAQs About AI-Era Endpoint Security
What makes AI-era endpoint security different from antivirus software? Antivirus software primarily scans for known malware signatures. AI-era endpoint security additionally monitors AI agents, autonomous code execution, and developer tool activity that traditional antivirus was never designed to see.
Is Glow the only company building this kind of platform? No. Glow is a prominent new entrant, but it competes in a broader endpoint security market that includes CrowdStrike, Microsoft, SentinelOne, and Palo Alto Networks, all of whom are adapting their platforms to address AI-related risks.
Do companies need this kind of protection if they already use EDR? Not necessarily as a replacement, but as a complement. Traditional EDR excels at post-compromise detection, while AI-native prevention tools focus on stopping risky AI agents and software from entering the environment in the first place.
Why did investors value Glow at $1.2 billion so early? The valuation reflects investor confidence in the founding team’s pedigree (Meta, Snowflake, Claroty, and the Wiz board), early paying customers across multiple industries, and a broader belief that AI is creating a genuinely new class of endpoint risk.
The Bottom Line
Glow’s stealth launch is a useful signal for any enterprise security leader trying to make sense of where AI is taking their risk landscape. This isn’t just a rebrand of old EDR marketing — it’s a response to a real shift in how software gets installed, executed, and exploited when AI agents are doing much of the work. Whether Glow or one of its larger, more established competitors ends up owning this category, the underlying problem it’s solving isn’t going away anytime soon.