Sweet Security
Runtime protection for cloud workloads and AI agents
Overview
Sweet Security is a Tel Aviv company whose eBPF-based runtime sensor delivers cloud detection and response, vulnerability and posture management, identity threat detection and API security in one platform. Since 2025 it has extended the same runtime view to AI agents, adding agent discovery, prompt-injection detection, the Sweet Attack red-team agent and live blocking of rogue agent actions.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Secure 100 workloads
- Log-based cloud runtime protection
- Secure 100 workloads
- Comprehensive cloud runtime protection
- Demo and risk assessment on request
What you can produce with Sweet Security
- Real-time cloud detection and response from an eBPF runtime sensor, with incidents labelled malicious, suspicious or bad practice
- Vulnerability and posture management prioritised by what is actually running
- Identity threat detection and API security from the same sensor
- A map of AI agents, LLM servers and AI-using services, with over-permissioned access flagged
- Live blocking of unauthorised agent tool calls, sensitive-data leaks and prompt injections
- Validated, reproducible attack paths from the Sweet Attack red-team agent
- Runtime sensor coverage extended to Windows workloads (October 2025)
Sweet's runtime-first sensor gives it context that configuration scanners lack, and in 2026 it turned that into action: Sweet Attack tests real attack paths in production, and agent blocking stops unauthorised tool calls and data leaks as they happen. Customer quotes on its site credit it with cutting noise without slowing workloads.
It is an enterprise purchase, about $50,000 a year for 100 workloads on AWS Marketplace, and it needs a sensor in your cloud. Strong for cloud-native teams running AI agents in production; ASEAN buyers should check support and data residency first.
What we found
Sweet Security is a Tel Aviv cloud-security company that bets on runtime: rather than scanning configurations, it runs a lightweight eBPF-based sensor that watches what workloads, identities and now AI agents actually do. Dror Kashti, a former chief information security officer of the Israel Defense Forces, co-founded it with Eyal Fisher and Orel Ben Ishay. Sweet left stealth in 2023 with a $12 million seed, raised a $33 million Series A led by Evolution Equity Partners six months later, and in November 2025 a $75 million Series B, also led by Evolution, for total funding of $120 million. With that round Sweet reported sixfold ARR growth and ten times as many enterprise customers; those are its own figures.
The core product is what Sweet calls a runtime CNAPP: cloud detection and response, vulnerability management, posture management, identity threat detection and API security from one sensor. Sweet says its LLM-based detection engine, covered by a US patent it announced in 2025, cuts alert noise to 0.04%. Windows support arrived in October 2025.
Since then the platform has moved into AI. Its AI Security Platform maps agents, LLM servers and services using AI, flags over-permissioned access and detects prompt injection. In May 2026 Sweet launched Sweet Attack, an agent that probes production environments for exploitable attack paths, and in July added blocking that ends unauthorised agent tool calls, stops sensitive data leaving through an agent and halts prompt injections live. In June it said it was pursuing FedRAMP Moderate authorisation.
Pricing is less opaque than the website suggests. Sweet's AWS Marketplace listing offers 12-month contracts at $50,000 for 100 workloads of log-based runtime protection and $60,000 for its comprehensive tier; larger estates are quoted. It suits cloud-native teams running Kubernetes and AI agents in production. No Asian office is named, so ASEAN buyers should confirm support hours and data residency.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Sweet Security's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Sweet Security unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Sweet Security directly →
Spotted something out of date? Suggest an update →
Alternatives to Sweet Security
More in Security & Safety
