Palo Alto Networks is in talks to buy AI agent security startup Clutch for $500 million

What does Clutch Security do?

Clutch Security builds software that helps organizations track and secure the credentials that AI agents and other automated systems use to reach corporate data. The company focuses on what the industry calls non-human identities: API keys, service accounts, tokens and passwords that let software call other software, according to CTech.

Founded in late 2023, the startup was established by chief executive Ofir Har-Chen, chief technology officer Sagi Haas and vice president of research and development Tal Kimhi, CTech reported. The company operates in Israel and the United States.

Clutch has raised roughly $28.5 million across two disclosed funding rounds. An $8.5 million seed in July 2024 was led by Lightspeed Venture Partners, with participation from Merlin Ventures and private investors including Shlomo Kramer, Exabeam co-founder Nir Polak and HashiCorp co-founder Armon Dadgar, CTech reported. A $20 million Series A in January 2025 was led by SignalFire, with existing investors Lightspeed and Merlin Ventures also participating. TechCrunch reported that Clutch was valued at $85 million at that Series A.

The platform lets organizations map non-human identities across their environment, identify excessive or exposed permissions, manage credentials through their lifecycle and detect suspicious activity, CTech reported. As AI agents take on more autonomous work, those capabilities are moving from hygiene to core security infrastructure.

What deal is Palo Alto Networks negotiating?

The cybersecurity giant is in talks to buy Clutch for about $500 million in cash plus additional milestone-based payouts, according to a person familiar with the discussions cited by TechCrunch. CTech independently reported the $500 million figure, crediting The Information with the original report.

With the company approaching $10 million in annual recurring revenue, a $500 million price would be about 50 times ARR, a multiple TechCrunch noted is a standard way of pricing software companies and not unusual in the current AI security market.

The negotiations are ongoing and may not result in a deal, CTech reported. Palo Alto Networks told The Information that it does not comment on rumors or speculation, and Clutch did not respond to a request for comment, according to TechCrunch.

The reported deal at a glance

The numbers under discussion, as reported by TechCrunch and CTech, show how quickly the market is pricing AI agent security.

Why are AI agent credentials suddenly valuable?

As companies deploy AI agents that can access internal systems, handle sensitive information and carry out tasks autonomously, the number of digital identities and permissions those agents use is growing, CTech reported. Organizations now have to know which agents can reach which systems, what they are authorized to do and whether their credentials are being misused.

That problem has already produced a wave of consolidation. Cyera, a cybersecurity startup valued at $12 billion earlier this year, acquired Oasis Security, a Clutch competitor focused on managing AI agents' access to systems, for $1 billion, according to TechCrunch. Cisco bought Menlo Ventures-backed Astrix for roughly $400 million, Calcalist reported.

Upwind, a startup using AI to secure cloud infrastructure, recently turned down an acquisition offer from DataDog that valued it at roughly 40 times ARR, TechCrunch reported last week. Startups are now choosing between premium acquisition offers and staying independent in a category buyers clearly want.

How does this fit Palo Alto Networks' AI security push?

A Clutch deal would add to a busy acquisition year under chief executive Nikesh Arora. Earlier this year Palo Alto Networks completed its $25 billion acquisition of CyberArk, the identity security company known for managing human access, CTech reported. Clutch targets the machine side of that same problem: the credentials and permissions used by AI agents, not people.

TechCrunch lists other acquisitions this year including Console, a startup using AI agents to automate IT help desk tasks, valued at $500 million; NEA-backed Embrace for $325 million; Chronosphere, an observability platform bought for $2.95 billion; and Koi, a cyber startup backed by Battery and Team8, for $231 million.

The company has a history of buying innovation rather than building it in-house, and it has ramped up dealmaking in response to rising AI-driven cyberattacks, TechCrunch reported. Security is also where the model makers are heading: OpenAI released its own cybersecurity model, which we covered in GPT-6 Cyber, and Google shipped a frontier model honed for cybersecurity in Gemini 4 Carbon.

The pattern is consistent: the threat from agents is being answered with security products built for agents, whether that security comes from an acquisition spree at Palo Alto Networks or from frontier labs shipping dedicated models.

What does the reported multiple say about the market?

A price of about 50 times ARR for a company just approaching $10 million in revenue is the clearest sign yet that security buyers are pricing AI agent risk as a core enterprise threat rather than a niche. TechCrunch made the same comparison with Upwind's rejected DataDog offer at roughly 40 times ARR: multiples in the 40 to 50 times range are becoming the going rate for early-stage AI security companies.

For startups, the flurry of near-term acquisitions also raises the opportunity cost of staying independent. Clutch's investors, including Lightspeed and SignalFire, are taking a different kind of risk: the reported $500 million figure is still a negotiation, not a signed term sheet, and the final terms remain unclear, CTech reported. A deal that fails to close would still reset expectations for every company selling AI agent security.

None of this means the transaction will happen at the reported number. Milestone payouts, deal structure and the usual run of diligence can change the final price, and neither company has commented beyond Palo Alto Networks' standard line about rumors and speculation. What is already visible is the direction: security buyers are treating AI agents as an identity and access problem worth paying 50 times revenue to solve.