Zenity's raise: operator checklist for visibility, enforcement, response

You are choosing controls for agents that already run in your stack. Zenity announced a $125 million Series C on August 3, 2026, with Norwest leading. Cumulative funding reached $185 million after the round. The raise matters because it points to larger spend on controlling agent surfaces. It does not prove that any one vendor has the right controls. The buyer should use the round to pressure-test the vendor, not to accept its category label.

The raise signals demand, not product fit

Zenity tripled revenue in each of the two years before 2026 and expected to triple revenue again in 2026. Zenity's customer base includes Fortune 500 and Global 2000 organizations, and SoftBank Corp. is a named customer. Gartner published an April 2026 report titled AI Vendor Race: Zenity Is the Company to Beat in AI Agent Governance. Treat the report as positioning evidence, not product evidence. A vendor can win a category title and still miss the controls your team needs. The raise tells you where the market is moving. It does not tell you which control fits your stack.

Score visibility before enforcement

Ask what the vendor can see before you ask what it claims to prevent. Zenity's platform supports monitoring agents in environments including Google Gemini, OpenAI ChatGPT Enterprise, Microsoft Copilot, Anthropic Claude, and Cursor. A coverage list is a starting point, not a guarantee. The buyer needs to know whether the vendor can show the same view in the buyer's stack. If it cannot, the coverage claim is incomplete.

A useful view is not a dashboard with a green status. It shows the model, the prompt, the tool calls, and the output. It also shows which agent initiated the action and which user or service account was involved. The record preserves enough detail to reconstruct a sequence after an incident. Without a full view, the operator cannot verify enforcement.

Test enforcement and response in the live stack

Enforcement means the vendor can stop an action, not just flag it. Response means it can contain the issue after the fact. Zenity Labs disclosed vulnerabilities in Microsoft Copilot Studio and Perplexity AI's Comet browser. The disclosures show why enforcement and response matter. They do not prove a buyer's deployment is safe. The operator needs controls that work in the buyer's environment, not only in the vendor's lab.

Check whether a policy can block a tool call before it runs. Confirm a human can approve a high-risk action. Verify the vendor can revoke access or pause an agent when a pattern looks wrong. Determine what happens when the agent has already sent data, created a record, or changed a system. The answer should name a step, an owner, and a time frame.

Use this checklist in a vendor demo. Each item should be answerable in a minute. Run it against the vendor's demo, not its marketing page. Ask for the same demo in your environment, with your tools and accounts.

• Show a live agent session with model, prompt, tool calls, and output.
• Identify which agent actions can be blocked before execution.
• Prove a rollback or containment step after a bad action.
• List the agent environments it monitors, including any new tools in your stack.
• State who receives alerts and what evidence is attached to each alert.
• Explain how it handles a vendor model update that changes agent behavior.

Score the vendor on three questions: what can it see, what can it stop, and what can it do when something goes wrong. Coverage, ownership, and change management round out the answer. If a vendor cannot answer all six, the gap is a procurement risk. A vendor that can answer all six is easier to defend in a security review. A vendor that cannot should be treated as a partial control. Put the answer in the contract before signature, not just the slide deck.