When browsers began supporting extensions, when smartphones opened app stores, and when modern software became packed with open-source packages, security had to learn a recurring lesson: risk doesn’t just come from the core program, but from everything connected to it. Artificial intelligence agents are recreating the same pattern at an even faster pace. Skills, plugins, MCP servers, add-ons, and connectors allow a model to access the internet, databases, enterprise tools, and applications. AIR, a startup founded by veterans of Israel's Unit 8200, has emerged from stealth announcing $50 million raised across two seed rounds to build a platform designed to monitor this very supply chain.
The concept is simple to explain and complex to implement: discover which agents are running inside an organization, understand what components they use, continuously assess their trustworthiness, and prevent connections to software or sources that fail to comply with policies. In practice, AIR aims to treat the agent ecosystem the way software supply chain security platforms treat libraries, dependencies, and packages.
Agents are becoming compositions of components
An enterprise AI assistant is rarely just a model. It may use a provider’s LLM, a retrieval system, an MCP server to access the CRM, a skill to send emails, a plugin to query the web, and credentials for other services. Each element increases the system’s capability, but also the number of connections that need to be monitored.
The Model Context Protocol has accelerated this trend by offering a standardized way to connect models to tools and data sources. It is useful precisely because it reduces the cost of integration. The inevitable consequence is that it also becomes easier to add components that the security team has not vetted. An employee can install an AI tool and connect it to enterprise documents just as naturally as they once installed a browser extension.
Shadow AI is the new shadow IT
Enterprises are already familiar with the shadow IT phenomenon: SaaS services adopted by employees without formal IT approval. With agents, the problem shifts in scale because a single tool can connect to multiple applications and act through the user’s own permissions.
AIR therefore focuses primarily on discovery. You cannot protect what you do not know exists. Identifying agents and components allows the security team to build an inventory, assign owners, and evaluate permissions. It is a seemingly administrative yet fundamental function: many breaches stem from forgotten assets, legacy integrations, and credentials that no one remembers using.
A skill can be as powerful as an application
The word “skill” might suggest a small, harmless function. In reality, a skill that allows an agent to read files, modify code, or send payments is a piece of software with real capabilities. If it is malicious, compromised, or misconfigured, it can turn the agent into an exfiltration channel or an unwitting executor of dangerous operations.
This makes one-off checks insufficient. A component considered secure today can change tomorrow, update dependencies, or alter its endpoint. AIR emphasizes continuous evaluation, a concept already familiar in cloud security but still new in the world of agents.
The trust problem spans multiple companies
An enterprise may have a contract and in-depth audits with the model provider, but not necessarily with every connected MCP server or plugin. It is the same weakness that made software supply chains dangerous: an organization can invest heavily in its own security and still depend on a much smaller vendor.
Standardization makes the problem more visible. When tools become interoperable, security cannot rely on the reputation of a single platform. It requires attestations, granular permissions, logging, and mechanisms to swiftly revoke a compromised component.
Why 50 million already at the seed stage
The size of the funding round shows how urgent investors consider the category to be. AIR is not selling a product for a consolidated market with already defined budgets; it is trying to become infrastructure before most enterprises have formalized an “agent supply chain security” line item.
The risk for the startup is clear: major identity security, endpoint, and cloud vendors can incorporate similar capabilities. The advantage of a specialized company is the speed with which it can adapt to new protocols and patterns. The advantage of the tech giants is distribution. In the coming years, the market will decide whether agent security remains a standalone category or gets absorbed by existing platforms.
Security must follow permissions, not the brand
One of the most crucial lessons is to avoid the mental shortcut that “this agent uses a trusted model, therefore it is secure.” A system is only as secure as the sum of its permissions and dependencies. Even a thoroughly evaluated model can be linked to a vulnerable skill or receive manipulated inputs from an external source.
For CISOs, this demands a new approach to cataloging risk. They need to know which agent can see which data, what tools it can call, who approved those capabilities, and how actions are logged. In other words, agents must be brought into the same governance processes that already exist for identities and applications.
The AI supply chain will emerge anyway
Companies are unlikely to abandon integrations. The value of agents lies precisely in their ability to step outside the chat and get things done. The more connectors multiply, the more AIR's challenge becomes structural. The question, then, is not whether an agentic component supply chain will emerge, but how quickly we can make it observable.
The paradox is that the open standards accelerating adoption are the very same ones enabling a massive market of extensions. It happened with the web, with smartphones, and with the cloud. It will happen with AI. AIR is betting that this time around, enterprises will try to build controls before the new supply chain grows too large to govern.
