It’s 2:14 a.m. and an automation you set up three weeks ago is quietly working through a vendor portal. It logs in with credentials pulled from a password manager, clicks through to an invoice page, downloads a PDF, and pastes a chunk of that document into a summarizer running on someone else’s servers. You are asleep. Your security team has no log of it. The agent did exactly what you told it to do.
That scenario is the reason Island just raised $400 million at a $6.4 billion valuation, in a Series F round led by Evolution Equity Partners. The company has more than doubled its valuation since 2024, and it’s pushing out from enterprise browser security into broader corporate systems. Reuters filed the story on September 24, 2026, and the framing was blunt: AI agents are reshaping enterprise security.
I review agent toolkits for a living. My honest reaction to this news wasn’t excitement about Island. It was recognition that the thing I’ve been complaining about in review after review finally has a price tag attached to it.
The permission model in most agent tools is a joke
When I test a browser-driving agent, the setup flow usually looks like this: install an extension or a local runtime, log into your accounts once, grant the agent access to the session, done. That’s the whole security story. The agent inherits everything you can reach. Every SaaS dashboard, every internal wiki, every admin panel you happen to be signed into.
Ask most of these tools basic questions and they get uncomfortable:
- Which specific domains can this agent reach, and can I restrict that list?
- What did it actually do in the last session, action by action, with timestamps?
- If a page contains text instructing the agent to exfiltrate data, what stops it?
- When the agent copies data out of a page, where does that data land?
- Can a second person on my team review the session without also inheriting my credentials?
The number of tools I’ve tested that answer all five well is very small. The number that answer none of them is uncomfortably large. Vendors treat the browser session as a solved primitive, something they borrow rather than secure, and the audit trail is often just a screenshot folder.
Why the browser became the choke point
Island started by securing the enterprise browser, which used to sound like a narrow bet. It doesn’t anymore. The browser is where agents do their work, because the browser is where the work already lives. Most business software has no usable API for the specific thing you want automated. So the agent clicks, types, and scrolls like a person, which means every control you’d normally apply at the API layer gets bypassed by design.
That’s what makes the expansion into broader corporate systems interesting rather than just an upsell. If the browser is the layer where human identity, agent identity, and sensitive data all collide, then whoever owns that layer gets to decide what an agent is allowed to touch. It’s a strong position to hold, and investors clearly agree.
What a $6.4 billion valuation actually tells you
Not much about product quality. I want to be straight about that. Funding rounds measure investor conviction, not whether a tool works on a Tuesday afternoon with a flaky SSO redirect. I haven’t run Island through a hands-on test, and I’m not going to pretend otherwise based on a Reuters headline.
What the number does tell you is where the money thinks the gap is. A doubling of valuation in roughly two years, on a $400 million round, is the market pricing in a problem enterprises have not solved. Agent security isn’t an edge case anymore. It’s a budget line.
Expect the usual follow-on effects. Every agent platform will ship a security page within six months. Some of those pages will describe real controls. Others will describe a settings toggle with a lock icon next to it. Telling those apart is going to be a bigger part of my job.
What I’d check before your next agent deployment
You don’t need a $6.4 billion vendor to close the worst gaps. You need to stop giving agents your own session. Run them under a dedicated account with the narrowest access that still lets the task finish. Keep a real action log you can read later, not just a video replay. Treat any page content the agent reads as untrusted input, because a malicious instruction buried in a web page is a live attack path, not a thought experiment.
And test the failure cases before you trust the happy path. I’ve watched agents confidently complete tasks against the wrong tenant, the wrong customer record, the wrong environment. The tooling almost never tells you. You find out later, usually from someone annoyed.
Island’s round is a signal that the rest of the industry is finally catching up to something agent users have been living with for a while. The security story around these tools has been thin. A very large check just made that thinness expensive.
🕒 Published: