The $435M Agent Security Race Has a Crypto Problem It Can't Price

Eighty-five percent of organizations are running AI agents in some form. Five percent have one in production. That eighty-point gap is the most expensive silence in enterprise tech right now — and crypto is running the same experiment without a control group. On October 1, a company called Classie shipped a product it calls Supervise. The pitch is blunt: watch every AI agent in your environment, record what it does at runtime, and block it the moment it crosses a line you drew. Ninety-nine dollars per user, per month. Five-day deployment. Built on Open Policy Agent, the CNCF-graduated rules engine most security teams already run somewhere. I read the spec twice. The architecture isn't new. The pricing is the interesting part — and it's broken in a way that should make every on-chain operator stop and look. Here's the market Classie is selling into. Agent security pulled in roughly $435 million across 12 rounds in a six-month window. Two names — Zenity and Alice — took $265 million of that, or 61 percent. Classie's own raise is undisclosed. That's the first tell. Undisclosed usually means small. The product line arrived fast. Discover in April. Analyze in July. Supervise in October. Three SKUs in six months. Modular stacking like that reads as "thin product, fast matrix fill," not "deep platform." I've built trading systems on the same instinct — ship the shape before you ship the substance. It works, right up until someone stress-tests it. The competitive frame splits clean. Outside-in: Classie watches everything running in the environment, including agents nobody authorized. Inside-out: Oracle's Fusion Claw embeds orchestration and governance straight into the ERP stack, so the guardrail ships with the software. Neutral layer versus embedded layer. I've watched this exact fight for a decade. It's crypto's oldest argument. Neutral monitoring — Forta, Hypernative, the whole read-only sentinel class — against protocol-native guardrails: Safe modules, ERC-4337 session keys, allow-lists baked into the account. Neither side has won. Both are still spending. So when a traditional AI vendor shows up with the same architecture, my first question isn't "does it work." It's "what does this look like the day the agents are holding private keys." Let me be precise about what Supervise actually is. Strip the marketing and you have two mature primitives stitched together. The runtime transcript is a trace-and-span mechanism. Anyone who has touched OpenTelemetry knows the shape — instrument the agent, emit events, reconstruct the decision path. That's engineering, not invention. The only novel thing is that the agent is doing work that costs money, so the trace has teeth. The second primitive is Open Policy Agent. OPA is graduated, mature, well understood. Rego policies have been written by security teams for years. Integrating it is standard practice. But here's the part the launch copy slides past: OPA doesn't ship policies. You write them. Classie hands you the engine and asks you to define your own boundaries. That's a responsibility transfer dressed up as a feature. There's no out-of-the-box policy library, no curated ruleset for "agent tried to exfiltrate the customer table." You configure the edge yourself. Based on my audit experience with wallet and key infrastructure, that systematically understates the deployment cost — because the hard part of agent security was never the engine. It was knowing which lines to draw. Crypto solved this problem badly once already. ERC-4337 gave every wallet the same superpower — session keys, spending caps, allow-lists — and almost nobody uses it. The engine shipped. The policies didn't. Same failure mode, different stack. Now the question that decides everything. Is the intervention inline or out-of-band? Does Supervise block the action synchronously, or alert after the fact? The material says nothing about latency, nothing about false-positive rates, nothing about whether a misfire halts the business process. In crypto, this distinction is the entire game. Pre-trade simulation blocks the malicious transaction. Post-trade monitoring tells you it already settled. One of those saves your position. The other writes your post-mortem. I learned that the hard way. In 2022, when Terra started to wobble, the tell wasn't the price. It was the on-chain transaction logs — liquidity draining from pools while the marketing still said "algorithmic stability." The spread wasn't wide enough to scream, but the flow was. I didn't wait for the audit report or the foundation's statement. I read the logs and I positioned. By the time the public alerts fired, the exit was gone. That's the gap Supervise is selling into, and it's the gap nobody has measured. "Real-time intervention" is a claim. It isn't a number. Without a latency figure, without a false-positive rate, "real-time" is a word, not a capability. The technical difficulty lives exactly where the data is absent. That's not a coincidence. That's a marketing department choosing its silences. Then there's the pricing. Ninety-nine dollars per seat, per month. The unit is a human. But the thing being governed is an agent, and agent count has nothing to do with headcount. One engineer can spin up four hundred agents. One agent can move nine figures. Pricing on seats means your bill tracks your org chart, not your risk surface. Those two numbers decouple the moment agents get productive. In crypto, the mismatch is sharper still. A single autonomous trading agent can custody a nine-figure book with zero employees behind it. Per-seat pricing can't see that exposure at all. It's a model that gets forcibly rewritten — probably to per-agent or per-event — the first time an enterprise is burned by an agent that was cheap on paper and expensive in reality. Notice the sales motion too. No pricing page. Pricing inquiries routed to a generic contact address. For a product promising five-day enterprise deployment, the absence of a self-serve tier or a published rate card is a signal about maturity, not confidence. Early-stage companies route you to a human because they're still figuring out the number. Five-day deployment deserves its own warning. Against traditional enterprise security — weeks to months — five days is a real differentiator. It's also, by definition, a sign of shallow integration. Shallow integration means low switching cost. Low switching cost means churn. The same feature that wins the deal can lose the renewal. Here's the on-chain forensic angle, and it's where I think the whole category underestimates its own problem. The launch leans on a striking stat: two-thirds of American employees use AI tools their employers don't know about. Ninety percent of executives believe they can monitor it. More than half of employees run outside that monitoring. Translate that to crypto and "shadow AI" becomes "shadow agents." Unauthorized bots executing against your treasury. Rogue vault managers quietly rebalancing. A leaked key wired to an agent nobody documented. The detection mechanism matters enormously here — endpoint agent, browser extension, network interception. Each has a different blind spot. A monitoring tool that can't see the wallet layer is watching the wrong room, and a single misfire in that stack threatens the whole system's structural integrity. I've done this forensics work by hand. In early 2021, I clustered BAYC wallets looking for insider accumulation — the same wallet-graph technique you'd use to trace a rogue agent's funding. The pattern was in the on-chain data before it was in the price. That's the promise of agent observability too. But only if you're actually reading the layer where the money moves. Finally, the route war. Classie is betting a neutral, cross-platform layer beats governance embedded inside the software. Oracle is betting the opposite — that governance belongs inside the stack, shipped by default. Crypto already ran this experiment. Neutral sentinels versus native account guardrails. The neutral layer wins on coverage and loses on adoption friction. The embedded layer wins on defaults and loses on trust. Nobody has resolved it, because it isn't resolvable. It's a market-structure question, not a technical one. Here's where I'll push against the crowd. Everyone is modeling this as a detection race — who spots the bad agent first. That's the wrong axis. Detection is commoditizing fast. The moat is the policy library and the institutional trust to auto-block. And auto-blocking is a much harder sell than monitoring. A read-only tool that's wrong wastes an alert. A blocking tool that's wrong kills a transaction. In enterprise, that's an interrupted workflow. In crypto, that's a rejected liquidation-protection order and a real, irreversible loss. The trust curve for a blocking product is measured in years, not sprints. Which is why the five-day deployment promise sits in quiet tension with the entire value proposition. The deeper contrarian point is cyclical. Security spend is counter-cyclical. It spikes after the incident, not before it. Right now we're deploying $435 million at peak euphoria — exactly the moment when security looks like overhead and every agent looks like a ticket to the moon. That money will look genius after the first nine-figure agent incident and wasteful before it. I've shorted that exact complacency before. The market always pays for risk management late. One more thing, and it's the part the grant-funded crowd won't like. The missing piece — an open, shared library of agent policies — is a public good. Public goods need funding. Most committees that claim to fund them run on relationships, not merit. The one mechanism I've actually watched work is RetroPGF, where you pay for what already shipped instead of what someone promised. If agent policy libraries are going to exist, that's the model to copy. Everything else is a grant committee picking favorites. So watch three things. Watch whether per-seat pricing survives contact with agents that have no headcount. Watch whether the neutral layer or the embedded layer wins the enterprise — and which one crypto copies next. And watch for the first on-chain agent exploit big enough to make security spending pro-cyclical again. Because the firewalls are coming either way. The only question is whether they arrive before the fire or after the audit. You don't get to pick the timing. You only get to pick which side of the transcript you're standing on.