Unit 8200 alumni raise $50 million to police enterprise AI agent actions

Bay, founded in February 2026 by Yuval Zacharia, Boris Danilovich, and Aner Morag, all IDF Unit 8200 alumni, says it inventories agents, coding assistants, MCP servers, skills, extensions, and local models, then follows each session from prompt to action. Its Enforcer is supposed to allow, refer, redirect, or deny every proposed action in milliseconds. An embedded system, Lighthouse, writes the policy from the customer’s own activity history. The round funds engineering and U.S. and European go-to-market, not a disclosed deployment.

The evidence trail is the founders’ briefing to SecurityWeek. No named production customers, no third-party assessment, and no published miss rate support claims of fleet rollout in under five minutes, a proof of value in under 14 days, or millisecond enforcement. The 30-day log replay is a sales instrument: show what Bay would have blocked. That is demonstration, not measured prevention. Lighthouse learns “normal” from the same history it must police. If injected or drifted sessions are already in those logs, the baseline is the failure.

Coverage reads Unit 8200 service as product credibility. The record shows a talent pipeline and an investor pattern, not a tested control. YL Ventures has long backed Israeli cyber founders out of that unit; pedigree predicts distribution, not block rates. The announcement skips the collection problem. Replaying 30 days of sessions means holding prompts, tool arguments, and permissioned actions — the material agents leak. OWASP’s LLM Top 10 already separates prompt injection from excessive agency. NIST’s AI Risk Management Framework still does not mandate runtime tool controls.

Split the claims. Bay says action-level control stops dangerous activity whether the cause is human-directed prompt injection or organic purpose drift. Independent confirmation of that split is absent from the funding record. Adjacent capital is the clearer signal: SecurityWeek has reported Sentra’s $150 million for agentic data security and Sysdig’s move into runtime governance for agents. The category is being capitalized before it is measured. The next signal is an external evaluation of deny decisions, and whether enterprises surrender agent logs before that evaluation exists.