Palo Alto Networks is reportedly in talks to acquire Clutch Security, a startup that secures the access AI agents have to company systems, for about $500 million. The price would be paid in cash plus milestone-based payments, according to TechCrunch, which cites a person familiar with the discussions, and to Calcalist and Globes. The Information was first to report the talks.
What Clutch does. Clutch is about three years old and builds tools for managing the credentials, API keys and service accounts that AI agents use to reach corporate systems, according to the reports. The idea is that an agent needs the same kind of controlled access as an employee, and that someone must track and limit it.
The numbers. Clutch was last valued at $85 million when it raised a $20 million Series A in January 2025, led by Lightspeed and SignalFire, according to TechCrunch. It is reportedly approaching $10 million in annual recurring revenue, which TechCrunch calculates would put the price at about 50 times that figure. The talks are early and no deal has been signed. Palo Alto Networks and Clutch did not respond to requests for comment.
How it compares. TechCrunch lists other recent security deals: Palo Alto Networks bought Console, a two-year-old startup, in September for $500 million in stock and cash, and the week before, Upwind reportedly turned down a Datadog offer of roughly 40 times annual recurring revenue. Cyera bought Oasis Security for $1 billion, and Cisco bought Astrix for roughly $400 million, according to the same article.
Counting the deals. Reports disagree on how the purchase would rank. TechCrunch, citing PitchBook, says it would be Palo Alto Networks’ seventh acquisition this year, while Calcalist and Globes call it the fifth. Another report says Palo Alto Networks is also negotiating to buy Beacon Security, without a price, a detail from a single source.
Why it matters. Companies are giving AI agents access to email, files and cloud systems, which makes the keys those agents hold a new target. If an attacker steals an agent’s credentials, the attacker may act with all of the agent’s access. Security vendors are racing to buy specialists in this area, and a price of about 50 times revenue shows how much they are willing to pay.
What to watch. Look for confirmation of the deal and its final terms, the Beacon talks, and whether other large security firms make similar purchases.
Sources: TechCrunch, Calcalist and Globes, citing The Information. Details are as reported from an unnamed source and not confirmed by the companies.
Cybersecurity illustration (representative image), Wikimedia Commons, CC0
