What the week of July 13–19 revealed about identity, credentials, runtime control, and enterprise context.
Last week was the week agentic security stopped looking like a niche and started looking like a stack.
The week brought major launches across identity, inline control, credential brokerage, security operations, enterprise MCP, and defensive agents.
The announcements looked different on the surface. Underneath, they were converging on four questions:
- Who or what is this agent?
- What authority should it receive, for which task, and for how long?
- What may it do while it is running?
- Which enterprise systems and context may cross the connection?
That is the emerging agentic-security stack: identity, credentials, runtime action, and context.
Identity is being rebuilt for a world of machines that act
Oak stepped out of stealth with $60 million in seed funding and an AI-native identity platform spanning humans, machines, and agents. Its connector framework maps access to actual application usage and removes unnecessary permissions continuously, rather than waiting for the next periodic review.
That is a large round for a clear reason. Agents multiply identities, entitlements, and access paths faster than legacy IAM teams can review them manually. The old model assumed relatively stable employees, roles, and applications. Agentic systems create short-lived workers, delegated tasks, tool chains, and machine-speed changes.
An analyst post from Software Analyst Cyber Research described the same shift as “agentic ISPM.” In this model, an identity finding does not end on a posture dashboard. It moves through a governed loop: detect, decide, remediate, verify, and preserve evidence.
That is progress, but identity alone is not the full answer. Naming an agent and calculating its posture do not control what happens when it begins acting across live systems.
Credentials are becoming ephemeral and brokered
The week’s most concrete credential development came from 1Password’s integration with Claude. A user can approve a credential for a task, and 1Password injects it into the destination without the password or one-time code entering the model’s context or memory. Access is scoped to the task instead of becoming standing access.
That distinction matters. An agent often needs the authority represented by a secret, but it rarely needs to see or retain the secret itself.
Keycard pushed the architectural argument further through GitHub Actions. Long-lived API keys are increasingly the wrong primitive for both agents and conventional automation. Software should receive a runtime identity, narrowly scoped authority, and credentials that disappear when the task ends.
This is bigger than password management. It is a move from “who possesses the key?” to “who is authorized to perform this exact action, in this context, right now?”
Credential brokerage still leaves an important boundary. Once authentication succeeds, the agent is operating inside a privileged session. Keeping the password out of the model is necessary; controlling the actions performed with the resulting session is the next layer.
Runtime control is becoming the center of gravity
Matrix Security emerged from stealth around an “Inline Agentic Control Platform.” Its central argument is that agents are neither users nor conventional code. They reason, plan, and act, so visibility after the fact is not enough.
Runlayer framed the operating choice more explicitly. In a post based on work with large enterprises, CEO Andrew Berman described two viable models:
- A broad path with strong alerting for high-trust, low-regulation teams.
- A narrow, fully governed path with enforcement for banks, healthcare companies, and other regulated organizations.
The dangerous default is the third option: broad access with no meaningful alerting or enforcement.
Beacon Security brought the same runtime thesis into security operations. The company raised a $13 million seed round led by Notable Capital to help security teams run agents with the context and guardrails required for autonomous work. Beacon says its annual recurring revenue grew more than 300% in the first half of 2026.
The common thread is not another dashboard. It is a decision point between intent and action: allow, block, narrow, escalate for approval, or record the evidence.
Context is both the prize and the risk
Agents become useful when they can reach the systems where work and institutional knowledge live. That makes context the economic prize—and one of the largest new concentrations of risk.
Willow’s Wix case study is a useful picture of the destination. Willow says Wix uses its enterprise MCP layer across nearly 5,000 users, almost 600 tools, and more than 300,000 weekly tool calls. Employees can discover approved capabilities, while the platform integrates identity, authorization, auditing, shadow-MCP detection, prompt-injection monitoring, and sensitive-data controls.
Adapter approaches the context problem from another direction. The $17.8 million GV-backed startup calls its product “Cognition as a Service”: a continuously updated knowledge graph that connects personal and work data and supplies relevant context to agents through an API and MCP. Adapter emphasizes evidence, data sovereignty, scoped ingestion, and auditability.
The value proposition is compelling. Instead of beginning every session from zero, an agent can understand relationships across Slack, documents, tickets, code, and history.
The security question is equally compelling: who becomes the custodian of that graph, and what governs the context sent across each interaction?
That concern moved well beyond security startups last week. Microsoft CEO Satya Nadella warned that enterprises can effectively pay for AI twice: once in money, and again in proprietary knowledge revealed through prompts, tools, corrections, and workflows.
Meanwhile, Databricks’ new strategic funding at a reported $188 billion valuation is aimed partly at Unity AI Gateway, Genie, and Lakebase—governance, enterprise context, and an operational database for agent-built applications. The data platform is becoming an agent platform because governed data is what makes agents valuable.
Incidents make the control gap concrete
The production-database incident discussed by Keycard did not occur last week. But its continued circulation is instructive. A coding agent reportedly found a broadly privileged API token and deleted a production database and its backups in seconds. The important lesson is not that one model made a bad decision. It is that a credential unrelated to the task exposed an irreversible capability without a sufficiently narrow runtime boundary.
Defenders are also turning agents back on the problem. On July 16, Capital One open-sourced VulnHunter, an agentic code-security tool that reasons from an attacker’s perspective, maps possible exploit paths, and proposes targeted remediations.
Agentic security therefore has two sides: securing the agents enterprises deploy and using agents to improve security itself. Both depend on evidence, bounded authority, and verifiable actions.
The winning layer will govern the wire
The market is filling quickly with identity platforms, credential brokers, gateways, context engines, posture products, and agent runtimes. Each solves a real part of the problem. None is sufficient alone.
Identity without runtime control can tell you who an agent is but not stop a dangerous action. Credential protection can keep a secret out of the model while leaving the authenticated session too powerful. Context infrastructure can make agents dramatically more useful while creating a new aggregation point for sensitive enterprise knowledge. Observability can explain an incident that enforcement should have prevented.
The enduring control point is the live connection—the wire—between an agent or human and the enterprise system it is trying to use.
That is where identity becomes a decision, policy becomes enforcement, credentials become short-lived authority, context can be filtered, and every action can produce evidence.
The companies that win this category will not force enterprises to choose between security and useful agents. They will make governed access the mechanism that safely unlocks the context agents need to work.