About Act Security
Act Security sells a cloud security platform that eliminates unnecessary access at the infrastructure layer.[2][3]
Act describes the problem as AI-assisted development creating services, identities and agents faster than governance can review, while autonomous agents operate in production with real authority. Act Security is a Tel Aviv startup whose cloud security platform targets AI agents inheriting bloated cloud permissions. Act Security maps the full identity-to-agent-to-downstream chain across a customer's cloud and applies preventative controls.[7]
Act maps every cloud construct into boundaries that reflect how a business operates, by organization, environment, application or data. Act brings identity, network and AI access controls together into one unified access map. Act analyzes and enforces identity, network and AI access as a single model. Act examines access as configured and as observed. Configured access is everything current configuration allows to be reached and acted on, and observed access is what is actually being used to keep the business running.[2][5]
One campaign type uses broad explicit-deny policies that block entire attack categories, including unauthorized cross-environment movement, data exfiltration and external overexposure. Act simulates each recommended change before enforcement to show what it would block. Act lets teams test changes against a digital twin before enforcing them, and run changes in audit mode as long as needed to confirm no legitimate access is revoked. Act gives automated exception recommendations based on observed access and intent.[2]
Act enforces boundaries through a cloud's own native controls, using Infrastructure-as-Code, with no agents and no new infrastructure to maintain. Act deploys changes as pull requests to a customer's existing Infrastructure-as-Code, Terraform and CloudFormation, using the cloud-native controls the customer already owns. Act manages violations and exceptions directly in a customer's own tools. Act lets users request blocked access within their existing tools, so security can approve or deny it in one click. Act shows every policy change with the investigation already done, and supports rollback when needed.[2]
Act places six contextual boundaries across a cloud, continuously reducing attack paths as the environment evolves. Act rightsizes human access and removes standing privileged access. Act locks down access to production and management environments and keeps sandbox environments isolated from everything else. Act ring-fences each application, secures its data and compute, and blocks attackers from moving laterally between applications. Act contains endpoint AI agents, governs the infrastructure they run on, and ring-fences cloud AI agents so they cannot reach beyond their intended scope. Act isolates tenants to protect customer data, enforces geo-fencing for regulations like GDPR, and restricts access to regulated data. Act closes off unintended inbound access from outside an environment and eliminates the paths attackers use to exfiltrate data. Act enforces tightly defined access boundaries around every AI workload.[1][2][5]
Act Security's founders have years inside critical infrastructure and healthcare. Act Security's research team found that Azure's object replication, a normal feature for copying blobs between storage accounts, can be turned into a quiet data exfiltration or poisoning channel.[3][5]
Act Security released Amphi in September 2026, a free and open-source suite for managing cloud access policies. Amphi builds on Cloud Copilot, an open-source AWS IAM tool that Act acquired earlier in the year. Amphi integrates with a team's existing workflows and requires no account or login.[1][2][8]
Act Security on the record