Noma Joins Fortune Cyber 60 as CISO Survey Shows AI Agents Outpacing Security

What the Fortune Cyber 60 covers

The Fortune Cyber 60 is presented by Lightspeed Venture Partners and Amazon Web Services in partnership with Fortune. The organizers describe it as a list of 60 of the most important venture-backed cybersecurity companies. Now in its fourth year, it spans the enterprise security stack, from AI security and identity to cloud and data protection.

Twenty companies are named in each of three stage categories: early stage, early growth and growth. Only startups that have not had an IPO, acquisition or other significant exit are eligible. Noma was named in the early growth category.

For the 2026-27 edition, Lightspeed evaluated more than 300 cybersecurity startups. It weighed annual recurring revenue, growth over the current and prior year, and business operations. Lightspeed combined validation of company-reported data with its own research, input from its CISO network and analysis of the broader market. Fortune reviewed and validated the final list.

Survey: adoption is moving faster than controls

The accompanying Lightspeed Cyber 60 CISO Survey was conducted by Wakefield Research among 200 U.S. CISOs at companies with at least $500 million in annual revenue. Fieldwork ran from September 4 to 14, 2026. According to the survey, enterprise AI adoption is advancing faster than the controls needed to secure it.

• AI agents are in production at 77% of surveyed companies.
• Only 20% of companies using or exploring agents report having a complete agent inventory.
• Confidence in teams' ability to assess and mitigate AI-specific risks fell from 71% last year to 55%.
• Agent identity, authorization and access governance is the top category CISOs plan to evaluate over the next year, at 55%.

Noma's approach to agent security

Noma describes its product as an agent security and governance platform for enterprises running AI agents at scale. According to the company, it brings discovery, access control, red teaming and runtime protection into one agent control plane across endpoint, SaaS and cloud environments. Its Runtime Context Engine connects identity, intent, blast radius and behavior over time to detect when permitted actions become dangerous.

The company says it covers homegrown applications built on Amazon Bedrock, Microsoft Foundry and Databricks, SaaS agent platforms such as Microsoft Copilot Studio and Salesforce Agentforce, and prebuilt agents like Claude Code, Cursor and GitHub Copilot running on developer machines.

"Agents now have access to company data, tools, and production systems, and even permitted actions can combine into dangerous behavior," said Niv Braun, CEO and Co-Founder of Noma. He added that the recognition "reflects our focus on giving security one control plane to stop rogue agents without slowing the business down."

What it means for enterprises

The survey figures point to a gap between how quickly companies deploy agents and how well they can see and govern them. With only 20% reporting a complete agent inventory and confidence in handling AI-specific risks down to 55%, identity and access governance for agents is where CISOs say they will focus their evaluations next.

Noma says it is backed by Evolution Equity Partners, Ballistic Ventures, Glilot Capital, Cyber Club London, Databricks Ventures and SVCI. It also states that it is widely adopted by Fortune 500 customers and has been recognized by Gartner as a leader in AI trust, risk, and security management (AI TRiSM).