Rig Security launches with $12m for agentic AI identity risks

A new security company, Rig Security, came out of stealth on 29 September 2026 with $12 million in funding and a product aimed at the identity problems created by AI agents, according to SecurityWeek.

The company's pitch is an "identity dependencies graph" — a map of how accounts, credentials and permissions in an organisation relate to one another. SecurityWeek reports that Rig uses the graph to distinguish between legitimate users and rogue AI agents, meaning software agents acting outside what an organisation intended.

That framing reflects a wider shift in how identity is treated inside enterprises. Traditional access control assumes a person behind every login. An AI agent, by contrast, may hold its own credentials, borrow a human's session, or chain calls through several services and tools on a user's behalf. When something goes wrong, working out which identity actually took the action, and on whose authority, becomes the hard part. A dependency graph is one answer to that: rather than treating each account in isolation, it records the links between them so that a chain of delegated access can be followed.

Beyond the funding figure, the graph-based approach and the stated goal of telling legitimate users apart from rogue agents, the SecurityWeek report does not detail the company's investors, its technical architecture, its customers or its pricing. Rig has not published claims about detection rates through the source reviewed here, and there is no indication of independent testing of the product.

The launch adds to a growing group of vendors selling tools for what the industry calls non-human identity — the credentials and permissions held by software rather than people. Buyers evaluating this category face the usual early-market problem: the products are new, the threat models are still being written, and much of the evidence for effectiveness comes from the vendors themselves.

For security teams, the practical questions are narrower than the marketing. Does the tool discover agent identities that existing identity systems miss? Can it show, after an incident, which agent used which credential and which human approved it? Does it work with the agent frameworks already in use, or does it require agents to be re-plumbed through a new control point? None of those questions is answered by a funding announcement.

The Agentic Times has not independently verified Rig Security's claims. The company's own description of the product, as reported by SecurityWeek, is the only source for the details above.