Glow exits stealth at $1.2B to rebuild endpoint security for the age of AI agents on employee laptops

Glow Exits Stealth With $1.2B for AI-Era Endpoint Security

Every endpoint security tool on the market shares a foundational assumption: a person is sitting at the keyboard. CrowdStrike, Microsoft, and SentinelOne, the dominant players in endpoint security, designed their products to spot malicious activity after it surfaces on a worker's laptop 1. That logic holds when the danger is a human clicking a bad link. It collapses when the operator is an AI agent that installs code libraries, reaches into databases, and executes chained actions without waiting for approval.

That collapse is the opening Glow is targeting. The cybersecurity startup launched publicly on Wednesday with $180 million in Series A funding and a $1.2 billion valuation 1. The round's lead backers are Sequoia, Greenoaks, Redpoint, and Cyberstarts, with five additional firms participating, including Index Ventures and Lux Capital 1.

The thesis driving that valuation is prevention over detection. Endpoint detection and response products, the backbone of enterprise security for a decade, focus on flagging threats that have already begun executing 1. Glow's argument is that detection is too slow for an environment where an autonomous agent can complete dozens of operations in the time it takes a security analyst to triage a single alert. You do not chase someone through your hallway. You lock the front door.

Founded in 2025 and based in Palo Alto, Glow runs its own AI agents across enterprise device fleets to build and maintain a continuously updated inventory of every application, code library, and AI tool present on each machine 2. That inventory feeds into policy enforcement: high-risk or unauthorized software can be blocked before it ever runs 2. To power its analysis, Glow routes large language models from Anthropic and Google through Amazon's Bedrock platform, then wraps them with a proprietary software layer that supplies enterprise-specific context to improve the models' reliability for security work 1. Glow's own published figures underscore the scale of the visibility problem: the average organization runs more than 5,000 distinct software titles, two-thirds of which escape detection by existing tools, and 30 percent of AI agents on employee machines operate without any oversight controls 2.

The founding team carries credentials from the categories Glow is challenging. CEO Roi Tiger was a vice president of engineering at Meta 1. He started the company with Omer Singer, who shaped security strategy at Snowflake, and Ophir Arie, who ran research and development at Claroty 1. Glow also brought in Emily Heath as chief operating officer. Heath served as chief information security officer at United Airlines and DocuSign, held a board seat at Wiz during its $32 billion acquisition by Google, and previously invested as a partner at Cyberstarts 1. The startup employs close to 100 people, primarily in Israel 1.

For Tiger, the shift comes down to where computation now happens. The past decade moved compute to the cloud. Now, he argues, it has landed back on the endpoint in a form nobody anticipated. "If you think of the past decade, everything was moving to the cloud and SaaS. Suddenly, AI lands on the endpoint in a way we've never seen," he said 1.

Glow claims paying customers in healthcare, retail, and financial services, with deployments covering tens of thousands of devices at large enterprises 1. Its website lists endorsements from security leaders at Fanatics, CAVA, BMC Software, and Antares Capital 2.

The operational details Glow has disclosed point to a deeper structural weakness in how enterprises secure devices today. Glow says its platform has blocked malicious npm packages from being installed in customer environments and caught AI agents attempting to pull in those same components 1. But the more telling finding is that Glow also discovered employee machines where endpoint detection tools were either missing or running with reduced functionality 1. When an EDR agent fails quietly on a laptop, the entire detection framework that relies on it loses visibility of that device. The machine drops off the map. The system tasked with protecting it cannot see it. This is not a rare malfunction. It is an inherent limitation of a model that depends on software running correctly on every single device it is supposed to monitor. Glow's prevention approach sidesteps this failure mode entirely by maintaining an independent inventory rather than trusting the EDR layer to report its own health.

Glow steps into a market where CrowdStrike, Microsoft, SentinelOne, and Palo Alto Networks hold the established positions 1. Those companies were built in an era when the endpoint was a workstation operated by a person, not a runtime environment for autonomous agents that install software, access data stores, and chain workflows without prompt-by-prompt human review. The incumbents have enormous customer bases and the resources to ship AI features quickly. But Glow's wager is that bolting an agent-monitoring module onto a detection-first architecture cannot solve a problem that originates in the architecture itself.