After one enterprise connected ChatGPT to its internal SharePoint system, it discovered that every intern could ask the AI for highly sensitive litigation files. The immediate cause was not a model jailbreak. A legal intern had accidentally set the wrong permissions. Cymphony founder Shy Dekel later used the incident to explain the job his company wants to own: find who can use AI to read files they should not see, then help the organization take that access back. Dekel described the case in a company release.
The uncomfortable part of the story is that the customer was not short on security software.
Dekel said the customer’s security stack was already mature. What the company did not want was another scanner that only detected a problem. It wanted someone to fix the problem. That demand later shaped Cymphony’s product direction. The company release frames this as a customer requirement.
For builders trying to sell AI into enterprises, that detail matters more than the funding headline. The customer had already bought tools, yet one cross-system job was still unfinished.
What Was Hard To Find Still Had Permission
Cymphony was founded in 2024, according to public company database records and recent reporting. The team began with employee security: mapping people, identities, and access so a company could understand what each person was allowed to do. As AI tools entered more enterprise workflows, that access map became more urgent. Calcalist interviewed Dekel about the company’s founding and direction.
The shift is easy to understand without memorizing security vocabulary.
An employee may technically have access to a folder without knowing what is inside it. Before AI, the material might remain buried because nobody knew what to search for. After an AI assistant is connected, the same hidden file can become an answer to a plain-language question. Cymphony’s AI governance page emphasizes this risk: it checks what new AI tools can access, instead of merely listing which AI tools the enterprise has purchased. The product page describes AI access assessment.
That is what makes the litigation-file example useful. The AI did not break into the system. The wrong permission already existed. AI made the permission mistake easier to exploit and harder to ignore.
The buyer’s question changes with that workflow. Business teams ask whether a new AI system can be connected. Security teams have to answer a different question: once connected, what documents will the system make discoverable? Until that question is handled, the business rollout remains fragile.
Finding The File Is Not The Same As Fixing The Access
Cymphony turns the work into a chain of steps.
First, it connects to enterprise document and identity systems so files, accounts, and access behavior can be related to one another. Then it evaluates which sensitive materials are exposed to which people or AI tools. Finally, it helps revoke access or route the issue to the file owner. The company’s data security page also says remediation should consider whether the material is still being used for legitimate work, so tightening access does not break normal operations. Cymphony describes this data-security workflow on its product page.
The most easily underestimated part comes after the alert.
Sending a warning is not hard. The harder task is making the right person understand which file is risky, why it is their problem, and what action is needed now. Cymphony says its AI assistant, Maestro, can contact affected employees, point to exposed files, and guide the remediation process. Security teams can also ask natural-language questions about accounts, access paths, and activity. The homepage describes Maestro and the investigation interface.
That means the company is not only selling visibility. Who should be notified, what they should do, and whether the work was completed are part of the product. A separate company announcement says the platform tracks progress and coordinates employees through security actions. The launch announcement describes employee coordination and remediation tracking.
This is closer to the customer’s complaint than another alert dashboard would be. The tools existed, but the work was not done.
First-Year Selling Already Produced Revenue Signals
According to TechCrunch, Cymphony said it reached seven-figure annual recurring revenue in its first year of sales and signed a double-digit number of enterprise customers. Those are company-disclosed figures reported by a media outlet, not independently audited financial statements. TechCrunch reported the ARR and customer-count claims.
The company has publicly named Syngenta, KKR, Cass Information Systems, and Athennian as users. Those customer names appear in the company announcement. The list does not reveal contract size or deployment depth, but it does show the kind of enterprise account Cymphony wants to reach.
The more revealing procurement detail comes from another source. In Calcalist’s interview, Dekel said one paying public-company customer replaced two existing products with Cymphony. Calcalist reported that founder statement.
That matters because the sale was not only an additive AI budget experiment. At least for that customer, Cymphony entered the comparison set against existing security software. A young company rarely wins that way by sounding generically more intelligent. It needs to take responsibility for a job that older tools leave split across dashboards, tickets, file owners, and security operations.
For founders, the path is concrete. Find the work that cuts across several systems but still lands on a human team at the end. Package not just detection, but the handoff, decision context, employee coordination, and repair. Then the buyer can compare the product against real operational cost, not only against a feature checklist.
In September 2026, Cymphony announced a $25 million Series A. Together with an earlier $5 million seed round, the company said it had raised $30 million. Dekel told Calcalist he planned to move to the United States, open an office, build out sales, and expand the large-customer base. Calcalist covered the financing and US sales plan.
The purchase path on Cymphony’s site is not a public self-serve price. It is a demo request and a free AI risk assessment. That fits the problem. A prospective customer does not need to understand the full architecture first. It can begin with one uncomfortable question: if the company’s AI tools go live, what can they read?
Cymphony’s commercial lesson is therefore sharper than “AI creates new security risks.” The risk already lived inside permissions, documents, employee roles, and old collaboration systems. AI changed the surface area by making those permissions queryable. Cymphony’s product tries to monetize the next step: take the exposed access graph and turn it into a finished remediation workflow.