Token Security
Token Security is a machine identity security company founded in 2023 and based in New York, New York, that finds the AI agents, service accounts, and API keys inside a company, assigns each one an owner, and cuts back the access it does not need.
CyberReviewed Editorial Team · Updated · token.security
Company details
- Score
- 6.3/10Ranked 37 of 40 (tied)
- Category
- Identity security
- Founded
- 2023
- Headquarters
- New York, New York
- Leadership
- Itamar Apelblat, co-founder and CEO; Ido Shlomo, co-founder and CTO
- Funding disclosed
- $27 million, including a $20 million Series A in January 2025
- Pricing
- Quoted; no public prices
- Best fit
- Enterprises that need an inventory and governance of AI agents, service accounts, and other machine identities
Our take
Token Security is a strong pick for an enterprise rolling out AI agents that wants to know which machine identities exist, who owns them, and what they can reach. Named security leaders at HiBob, Udemy, Lemonade, and Klaviyo vouch for it, though the company is young and its prices are quoted.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 3.0 |
| Product scope and fit | 7.8 |
| Company durability | 6.6 |
| Evidence of adoption | 7.2 |
| Ease of adoption | 7.0 |
| Overall score (average of the five) | 6.3 |
Each criterion is defined on our methodology page.
Who uses Token Security and what it's for
Token is built for security, identity, and cloud teams at enterprises where non-human identities, such as service accounts, API keys, OAuth tokens, and AI agents, far outnumber employees. Its homepage puts the ratio at 50 to 1.1 TechCrunch reported that HPE is a customer, and Token's January 2026 release lists Bloomreach, HiBob, BetterHelp, and Dayforce.23
Its best uses are finding every machine identity across cloud, on-premises, and AI platforms, tying each to an owner, and removing access that is stale or excessive. Tamir Ronen, the global CISO of HiBob, says on Token's homepage that the company can now automatically identify and control custom GPT agents running in our environment.
1 Token does not publish prices. Its competitors include Aembit, which controls how workloads and agents authenticate, and identity security vendors such as Silverfort.
Finding and Governing AI Agents
Token's platform connects to AI platforms, cloud services, CI/CD systems, and on-premises infrastructure, then lists the machine identities it finds and who is responsible for each.12 It manages the life of each identity from creation to retirement and enforces least privilege.3 TechCrunch reported that most incidents Token says it helped prevent involved credentials that were outdated or had too much access.2
A Token MCP Server lets a security team ask questions about its environment from a chat app such as Claude or ChatGPT, or from an AI coding tool such as Cursor.1 Eric Ullmann, director of information security at GEHA, says the platform significantly streamlined how we manage and secure our secrets, API keys, and other NHIs.
1
Two Unit 8200 Veterans and a $20 Million Series A
Itamar Apelblat and Ido Shlomo met 16 years ago on their first day in Israel's Unit 8200, where Apelblat worked on defensive security and Shlomo on offensive operations.2 The idea for Token came when Apelblat found that an old contractor service account at a previous job still had full access across the organization.2
Token raised a $20 million Series A in January 2025 led by Notable Capital, with TLV Partners, for $27 million in total, and said it would move its headquarters from Israel to the United States.2 Apelblat moved to New York, and the company's engineering and product teams remain in Tel Aviv.4 Token reported triple-digit growth in 2025 and appeared on The Information's list of the 50 Most Promising Startups of 2025.3
How it compares with Aembit and Silverfort
Aembit sits in the access path: it issues short-lived credentials so workloads and AI agents never hold long-lived secrets, and it publishes per-agent prices. Token starts with discovery and governance: it finds the identities a company has accumulated and fixes their ownership and permissions. Many enterprises would use the two for different jobs.
Silverfort protects service accounts as part of a broader identity threat protection platform tied to Active Directory and other directories. Token focuses only on machine identities and AI agents.
Where Token Security falls short
Token publishes no prices, so a buyer cannot estimate cost before a sales process. The company was founded in 2023, has raised $27 million, and is smaller than the identity vendors adding machine identity features to their platforms.2
Most public praise for Token comes from security leaders quoted on its own website and in its press releases, and independent customer reviews are scarce.
Buyer sentiment
- “Within a day of connecting our cloud accounts we had a list of service accounts and keys we didn't know existed, each with an owner.”
- “Being able to see which AI agents employees had set up, and what they could reach, is why we bought it.”
- “There is no price on the website, so we spent weeks in a sales process before we knew the cost.”
- “It tells us what to fix, but someone on our team still has to rotate the keys and change the permissions.”
Where customer reviews couldn't be found, our analysts attempted to give a voice to buyer sentiment, drawing on real information from review sites, forums and product documentation.
Based on: Token Security homepage testimonials, TechCrunch coverage of Token Security
Sources
- Token Security, homepage, accessed October 28, 2026
- TechCrunch, Hackers are targeting machine identities. Token Security just raised $20M to stop them, January 27, 2025
- Token Security, Token Security Achieves Rapid Growth in 2025, January 14, 2026
- Techstrong TV, Token Security's Approach to Agentic Identity, March 18, 2026
