Sweet Security Runtime CNAPP

Sweet Security Ltd. is a cloud and AI runtime security company whose announcements are datelined Tel Aviv and whose terms apply Israeli law. It was founded by a team led by the former CISO of the Israel Defense Forces, with co-founders Dror Kashti, Eyal Fisher and Orel Ben Ishay, and has raised 120 million USD in total, including a 75 million USD Series B led by Evolution Equity Partners in November 2025.

The Sweet platform is a runtime CNAPP that learns how each application, workload and AI agent should behave and uses that context to detect and stop attacks. It combines cloud application detection and response, CSPM, vulnerability management, identity threat detection, API security and AI security in one platform covering Linux and Windows workloads. Its approach is to attack, fix and defend: continuous attack testing finds attack paths, prioritized fixes are proposed, and runtime guardrails and virtual patches block repeat threats. Customers include Fireblocks, Kaltura, ShipStation and SafeBreach.

• Cloud application detection and response: Detects and stops attacks on cloud workloads in real time.
• Runtime CSPM: Prioritizes misconfigurations using live runtime context.
• Vulnerability management: Focuses remediation on vulnerabilities that are loaded and reachable.
• Identity threat detection: Spots abuse of human and machine identities in the cloud.
• AI security: Traces attack paths from prompt to data and blocks rogue agents.
• Virtual patching: Shields production workloads until permanent fixes are deployed.

A crypto or payments company can detect intrusions into its Kubernetes workloads and stop them in real time. A game publisher can shield vulnerable services with virtual patches while developers prepare fixes. An enterprise deploying AI agents can trace and block agents that access data outside their intended scope.

The vendor reports securing an entire organization within about 2 hours of deployment. Runtime context and an LLM-powered detection engine reduce noise, with the vendor citing detection noise of 0.04% and more than 99% accuracy for AI-verified findings. Virtual patching protects production workloads before permanent fixes are released. AI guardrails can block a rogue agent inline in under 100 milliseconds.

Cloud attacks now move from initial access to impact within minutes, which is pushing CNAPP buyers from static posture scanning toward runtime detection and response. The spread of AI agents in production adds behavior that static tools cannot assess. Fintech, gaming and digital service companies in Southeast Asia running on public clouds increasingly need real-time protection rather than periodic scans.

Sweet Security Ltd. operates under Israeli law with announcements datelined Tel Aviv. Raised a 75 million USD Series B in November 2025 led by Evolution Equity Partners with Munich Re Ventures, Glilot Capital Partners and Key1 Capital, bringing total funding to 120 million USD; CyberArk Ventures is also an investor. In 2026 it announced entry into the US federal market and pursuit of FedRAMP Moderate.