New Security Platform 'Act' Addresses AI-Accelerated Access Exploitation in Cloud Environments

Bessemer Venture Partners has announced its backing of Act Security, a new cloud security platform emerging from stealth with $60 million in total funding. Founded by the team behind Medigate, Act Security aims to redefine cloud security by focusing on proactive measures to eliminate exploitable access paths. The company's platform is designed to prevent AI-driven exploitation of cloud environments by enforcing deterministic boundaries across human, workload, and AI agent access, integrating with existing cloud-native and traditional controls. This announcement signifies a major investment in addressing the evolving threat landscape where AI agents can autonomously discover and exploit vulnerabilities at machine speed. This development is highly significant for any organization operating in the cloud, particularly those grappling with the complexities of multi-cloud environments and the accelerating pace of AI-driven attacks. The core insight from Act Security is that "access—not any single vulnerability—has become the primary attack surface in the AI era, exploitable at machine speed." This directly impacts cloud security architects, DevOps engineers, and compliance officers. Traditional security approaches, which often involve triaging endless lists of misconfigurations and vulnerabilities, are proving inadequate against AI agents that can find and exploit access paths faster than human teams can respond. The shift from reactive vulnerability patching to proactive access elimination is a fundamental change in strategy that practitioners must adopt to stay ahead of sophisticated threats. The emergence of Act Security fits squarely within the broader trend of cloud security evolving to address the challenges posed by cloud-native complexity and the rise of advanced AI capabilities. For years, the industry has wrestled with identity and access management (IAM) sprawl, misconfigurations, and the shared responsibility model, where customers often bear the burden of securing their configurations atop the cloud provider's infrastructure. The increasing sophistication of AI, now capable of accelerating exploitation timelines from weeks to hours, has amplified these existing vulnerabilities. This has driven a push towards more proactive, preventative security measures, often termed "shift-left" in DevSecOps, where security is integrated earlier into the development lifecycle. The focus on eliminating access paths at the architectural level, rather than just detecting post-compromise, aligns with the growing recognition that security needs to be built in, not bolted on. Furthermore, the need for continuous compliance and governance, as highlighted in discussions around PCI DSS in the cloud, underscores the importance of platforms that can map access controls directly to regulatory frameworks, making compliance a continuous byproduct rather than a periodic scramble. For practitioners, the launch of Act Security signals a critical need to re-evaluate current cloud security postures, particularly concerning identity and access management. Organizations should prioritize initiatives aimed at cleaning up accumulated access sprawl and preventing its reaccumulation by extending enforcement into CI/CD pipelines. This means implementing robust least-privilege principles, regularly auditing access policies, and leveraging tools that can provide a unified view of access across multi-cloud and hybrid environments. The trade-off might involve a higher initial investment in architectural redesign and automation, but the long-term benefit is a significantly reduced attack surface against AI-accelerated threats. Practitioners should watch for solutions that offer deterministic boundary enforcement for all entities, including AI agents, and those that can translate security posture into continuous compliance. The ability to deploy AI agents safely with tightly scoped access boundaries will be crucial. Ultimately, the message is clear: move beyond reactive vulnerability management and embrace a proactive, access-centric security strategy to counter the machine-speed exploitation capabilities of modern AI.