Obsidian Security

1.1 Identity, Headquarters, and Category Positioning

Obsidian Security is best anchored as a Palo Alto, California-based private cybersecurity company founded in 2017 and currently positioned around runtime governance for AI agents and non-human identities inside enterprise third-party SaaS applications. The Palo Alto headquarters should be treated as the current canonical field because the freshest August 2026 financing coverage repeatedly uses California/Palo Alto framing; legacy profile surfaces that imply Newport Beach are not ignored, but they are weaker and stale enough to become an explicit evidence gap rather than the primary identity. The business model has also moved beyond its earlier SSPM narrative. Current official and independent coverage presents Obsidian as helping security teams inventory AI agents, MCP servers, models, non-human identities, and policy violations before actions take effect. That makes the company a late-stage AI-agent governance vendor, not merely an older SaaS posture-management tool.[CO001, CO002, CO003, CO009, CO010, CO028]

1.2 Founders, Leadership, and Governance Disclosure

The founder set is Glenn Chisholm, Ben Johnson, and Matt Wolff; Hasan Imam should not be described as a founder. The distinction matters because the diligence story is founder-heavy in product and technical credibility but operator-led in the CEO seat. Chisholm remains visible as Co-Founder, Chairman, and Chief Product Officer, while Johnson and Wolff supply the CTO and chief-scientist lineage tied to Carbon Black and Cylance experience. Imam brings go-to-market and customer-leadership background from Shape Security, which Norwest connects to a roughly $1 billion F5 exit, and he is the executive quoted in the latest Series D narrative. Public leadership directories support the current CEO field but do not resolve board composition, observer rights, committee structure, or investor control. That leaves governance diligence centered on board materials, succession planning, and whether founder product authority and non-founder CEO authority are cleanly allocated.[CO004, CO005, CO006, CO007, CO008, CO029]

1.3 Funding History, Investor Base, and Scale Metrics

The capital-formation record is strong but still disclosure-limited. Greylock led the earliest Series A, Norwest led the June 2021 Series B-1, and Menlo Ventures, Norwest, and IVP led the April 2022 $90 million Series C, when total funding reached $119.5 million. The August 4, 2026 Series D added $85 million at a $1.1 billion valuation, was led by Crescent Cove Advisors, and included existing investors Greylock, Menlo, Norwest, IVP, Wing, and GV. Post-round, Obsidian reports more than $200 million raised across five rounds. The scale evidence is similarly impressive but company-reported: more than 100 customers spend over $100,000 per year, more than 14 spend over $1 million, and 60 Fortune 500 companies are customers. Those thresholds are useful because they establish a real enterprise-spend floor, yet they still do not reveal logo concentration, discounting, renewal quality, expansion cohorts, or gross retention. Revenue, ARR, NRR, gross margin, burn, runway, and headcount remain undisclosed, so the only ARR figure here is a deliberately narrow estimated floor of roughly $24 million from disclosed spend thresholds.[CO011, CO012, CO013, CO014, CO015, CO016]

1.4 Milestone Chronology and Competitive Context

The chronology shows a company that used SSPM-era investor validation to reach the AI-agent governance moment quickly. The durable foundation is the 2017 founding, followed by a June 2021 Norwest-led Series B-1 and an April 2022 $90 million Series C that still described the company as an SSPM leader. The 2026 evidence resets the narrative around AI agents, MCP inventory, runtime controls, Fortune 500 penetration, and a unicorn Series D. The adverse caveat is not an internal scandal; it is competitive timing. Zenity, a direct AI-agent security competitor, announced a larger $125 million round one day before Obsidian disclosed its own $85 million raise. That does not negate Obsidian's customer and syndicate signals, but it means the milestone record should be read as participation in an intensifying category land-grab rather than as solitary category ownership. That distinction should carry into later market, product, customer, financial, risk, and valuation chapters as shared ground truth.[CO031, CO032, CO034, CO045, CO046, CO047]

1.5 Exhibits

2.1 Market Boundary and Included Spend

Obsidian should not be sized against every cybersecurity or posture-management dollar that can be labeled AI. The working boundary is enterprise third-party SaaS and AI-agent governance: runtime controls for autonomous agents, non-human identity security, SSPM, SaaS-to-SaaS integration risk, and selected ITDR-like identity-detection workflows. Included spend is therefore the budget used to discover agents and integrations, map permissions, monitor behavior, block excessive data access, and prove policy compliance across SaaS applications. Excluded spend is broad cloud posture management, endpoint security, generic data posture management, and native platform controls that never touch third-party SaaS agents. Status quo matters because many enterprises still use manual SaaS reviews, IdP-native controls, spreadsheet approvals, or the built-in settings of Microsoft, Salesforce, and other application platforms. The market is attractive because Obsidian can point to 144 non-human identities for every human identity and more than 35,000 third-party apps, but the same breadth requires discipline in not counting every adjacent SPM dollar as serviceable market.[CM005, CM006, CM007, CM021, CM022, CM023]

2.2 TAM, SAM, and SOM Sizing Lenses

The most defensible top-of-funnel TAM is the 2026 AI Agent Security estimate of roughly $26 billion, because Obsidian is explicitly selling security and runtime governance for AI agents. That number should not flow directly into revenue assumptions. A narrower SAM should be anchored in NHI Security and SSPM, because those categories map to identities, SaaS permissions, third-party integrations, and governance workflows. Using NHI Security at about $8.22 billion and SSPM at about $3.69 billion, while discounting overlap, produces a practical 2026 SAM range of approximately $8 billion to $12 billion. The narrow Agentic AI Security estimate of $1.65 billion is a useful lower-bound lens for nascent agent-specific controls, while ITDR at $3.42 billion is an adjacency rather than a direct add-on. SOM is far smaller: disclosed customers imply an ARR floor of about $24 million and a plausible current ARR range of roughly $40 million to $70 million, so near-term obtainable market should be framed as approximately $50 million to $150 million until management provides ARR, NRR, segment mix, and pipeline conversion.[CM001, CM002, CM003, CM008, CM009, CM010]

2.3 Buyer Segments, Budget Owners, and Adoption Path

The buying center is cross-functional because the operational problem crosses AI, identity, SaaS administration, and security operations. CISOs and security operations teams care about attack surface and policy enforcement; identity teams care about NHI sprawl and privileged grants; SaaS application owners care about business-process continuity; and AI platform or transformation teams care about deploying agents without losing control of tools and data. Obsidian's disclosed 60 Fortune 500 customers and 100-plus six-figure customers support enterprise budget capacity, but they do not identify budget owner or product-line split. Adoption likely starts with inventory of SaaS apps, integrations, agents, and MCP servers; moves into risk scoring and policy design; and then becomes runtime blocking when agents attempt privilege escalation, excessive data access, or unsanctioned tool use. The 70% customer agent-adoption figure makes this a current 2026 purchasing problem rather than a long-dated scenario, although procurement will still require proof that runtime controls avoid false positives and integrate with SOC workflows.[CM002, CM003, CM004, CM024, CM025, CM026]

2.4 Growth Drivers, Constraints, and Sizing Gaps

The demand case is driven by enterprise agent adoption, the extreme 144-to-1 NHI ratio, SaaS application sprawl, and the need to block agent actions before data exposure occurs. The constraint case is equally important. First, the SSPM market-size evidence conflicts: Research and Markets reports a $3.69 billion 2026 SSPM market with 12.6% CAGR, while Frost starts from only $484.4 million in 2025 and reaches $3.53 billion by 2030 at 48.7% CAGR. That disagreement is an adverse market-sizing signal, not a rounding error. Second, direct competitor Zenity raised $125 million one day before Obsidian's Series D, implying category validation but also a capitalized rival fighting for the same enterprise agent-security budgets. Third, broad SPM at $26.35 billion can inflate the story if CSPM, DSPM, or generic posture products are counted as addressable without a SaaS-agent workflow. The diligence answer is to preserve the funnel, ask management for ARR and revenue mix, and test customer budgets by buyer persona instead of underwriting the headline TAM.[CM012, CM013, CM020, CM031, CM032, CM036]

2.5 Exhibits

3.1 Landscape Shape and Competitive Peer Set

The competitive landscape is no longer a simple SSPM shortlist. Obsidian now competes for the enterprise job of governing AI agents, non-human identities, and SaaS-to-SaaS activity inside third-party applications. That puts it against direct AI-agent governance vendors such as Zenity, SaaS and shadow-IT control vendors such as Grip, Nudge, and Push, SaaS-to-SaaS mesh specialists such as Valence, established SSPM platforms such as AppOmni, status quo controls from IdP/SaaS administrators, and internal governance builds. Zenity is the most important direct rival because it raised $125 million one day before Obsidian's Series D and publicly frames itself around securing AI agents across enterprise agent-building surfaces. Obsidian's counter-positioning is different: runtime governance that can detect and block risky actions before execution, paired with an NHI graph and enterprise SaaS context. The category therefore looks attractive but contested, with buyers likely to segment by where they want controls inserted: agent development, browser telemetry, shadow-SaaS discovery, SaaS mesh governance, or runtime enforcement.[CP001, CP002, CP003, CP006, CP007, CP011]

3.2 Zenity and Direct AI-Agent Governance Pressure

Zenity is the closest like-for-like threat, but the rivalry is not identical feature for feature. Public coverage describes Zenity as a fast-scaling AI-agent security company with 230-plus staff, New York headquarters, Tel Aviv R&D, founders Ben Kliger and Michael Bargury, and a $125 million Series C led by Norwest on August 3, 2026. That matters because the round was larger than Obsidian's $85 million Series D and arrived one day earlier, giving Zenity a strong narrative in the same news cycle. Its public pitch emphasizes securing AI agents everywhere and agent-development ecosystems such as Microsoft Copilot Studio and Salesforce Agentforce. Obsidian, by contrast, should not overclaim parity on Zenity's build-time/developer workflow. Its more honest differentiation is runtime SaaS governance: mapping non-human identities, watching the third-party application context, and blocking policy violations before an agent action takes effect. That runtime posture is valuable precisely because agent permissions, connected MCP servers, and model substitutions can change after design-time review.[CP004, CP005, CP007, CP008, CP009, CP010]

3.3 Pricing, Packaging, Distribution, and Switching Friction

Public pricing is the weakest evidence surface in this chapter. The retained competitor sources show product packaging and positioning, but not standardized list prices, realized ASPs, discounting, renewal rates, or win/loss data. For underwriting, that means competitive pricing power has to be inferred from packaging breadth, procurement trust, and operational lock-in rather than observed quotes. Obsidian's public proof points are stronger than many younger peers: more than 100 customers spending at least $100,000 annually, more than 14 customers spending at least $1 million annually, and 60 Fortune 500 customers. Those disclosures suggest the product can reach enterprise ACVs and procurement trust. Still, switching friction is not absolute. Buyers can multi-home: deploy Obsidian for runtime SaaS governance, Zenity for agent-development review, Push for browser telemetry, Grip or Nudge for shadow SaaS, and AppOmni for conventional SSPM. The decisive question is whether Obsidian becomes the operating control plane for agents and NHIs rather than a point module around SaaS posture.[CP003, CP012, CP013, CP014, CP015, CP016]

3.4 Moat Durability, Commoditization Risk, and Obsidian Differentiation

Obsidian's competitive defense has four pillars: runtime blocking, the non-human identity graph, disclosed enterprise traction, and breadth of agent-platform coverage. The strongest of these is runtime governance because it addresses the moment when an agent, integration, or MCP-connected workflow tries to act in SaaS. That is a clearer wedge than generic SSPM posture and more differentiated from Zenity's agent-build focus. The NHI graph also benefits from the 144:1 ratio Obsidian cites for non-human to human identities inside third-party applications. Enterprise proof matters too: 60 Fortune 500 customers and many high-ACV accounts can shorten buyer trust cycles. The risk is that this moat is still proving durability in a nascent market. Zenity has fresh capital and headcount, Grip attacks with an adverse comparison page, and incumbents or internal teams can commoditize pieces of discovery, posture, and policy. Obsidian should therefore be diligence-underwritten on runtime efficacy, integration breadth, customer expansion, and competitive-loss evidence, not on category momentum alone.[CP001, CP002, CP003, CP004, CP006, CP011]

3.5 Exhibits

4.1 Disclosure Baseline and Capital Capacity

Obsidian’s financial record is unusually strong on financing and customer-spend thresholds, but thin on operating statements. The company and several independent outlets converge on the same current anchor: an $85 million Series D announced August 4, 2026, a $1.1 billion valuation, Crescent Cove as lead, and participation by the existing syndicate. The same evidence says lifetime capital raised now exceeds $200 million across five rounds, while historical sources identify the Series C, Series B-1, and earliest Series A backers. That is enough to build a local financing chronology and a capital-adequacy view, but not enough to model cash. Cash on hand before the round, monthly burn, runway months, debt, and project-finance obligations are not publicly disclosed. The right interpretation is therefore capacity-with-unknown-consumption: the new round clearly extends strategic options, yet no public source can verify how many months it buys or which operating milestones would trigger another financing.[CI001, CI002, CI005, CI006, CI007, CI008]

4.2 Revenue Signals and ARR Inference

Revenue and ARR are not publicly disclosed, so this chapter treats every revenue number as either a disclosed spend threshold or a clearly labeled estimate. The cleanest hard signal is customer spend: more than 100 customers over $100,000 annually and more than 14 over $1 million. Following the chapter instruction, the implied ARR floor is calculated as 100 times $100,000 plus 14 times $1 million, or approximately $24 million. That is not reported ARR, and it may not capture overlap or discounting perfectly; it is a floor derived from public statements. A plausible analyst estimate of $40 million to $70 million ARR is used only for sensitivity work, with $50 million as the base case. The commercial quality appears enterprise-skewed because the company cites 60 Fortune 500 customers and many seven-figure accounts, but the revenue mix, net retention, expansion rate, and customer concentration remain private.[CI003, CI004, CI009, CI010, CI011, CI022]

4.3 Pricing, GTM, and Unit Economics

Public pricing evidence is directional rather than underwritable. Cyberse cites a free tier to 1,000 users and an AWS Marketplace reference price near $100 per user per year, while third-party profiles also point to free trials or custom enterprise pricing above the entry tier. This supports a headcount-based subscription model, but it is list-price evidence, not realized ACV, discounting, renewal, or margin evidence. The GTM motion appears enterprise-led: the company talks about Global 2000 expansion, seven-figure customers, and custom governance for complex SaaS estates rather than transactional self-serve revenue. Unit economics are therefore the core diligence gap. CAC payback, sales cycle, gross margin, cloud cost, support burden, implementation services, NRR, logo retention, and churn are all undisclosed. The most defensible model treats these cells as null, then asks management for cohort and margin cuts before assigning software-like economics.[CI019, CI020, CI021, CI025, CI026, CI027]

4.4 Valuation Sensitivity and Financial Verdict

The valuation risk is a function of the ARR denominator. At the approximately $24 million disclosed-spend floor, the $1.1 billion valuation implies roughly 46 times ARR. At the $50 million base estimate, it implies about 22 times. At the $70 million high estimate, it falls to roughly 16 times, near the private-cyber benchmark range cited by Finro and SaaS Mag. The adverse read is that Finro’s private median around 15.4 times ARR and down-round compression range of roughly 10 to 13 times imply Obsidian’s true ARR must be very high, or revenue quality must be unusually strong, to justify the mark. Competitive funding from Zenity reinforces the need to invest aggressively, while broader cyber funding data show a supportive but selective market. The verdict is track, not underwrite blindly: Obsidian has better public traction than most private companies, but retention, margin, burn, and concentration evidence must arrive before the valuation can be treated as fair. This sensitivity should be refreshed immediately if management provides ARR, NRR, cash, or cohort data.[CI012, CI013, CI014, CI015, CI016, CI017]

4.5 Exhibits

5.1 Runtime Governance Product Map

Obsidian Security is best understood as an SSPM company that has rebuilt its product narrative around runtime governance for AI agents and non-human identities inside third-party SaaS. The customer job is not merely to find an excessive permission after a quarterly posture scan; it is to discover which agents, MCP servers, integrations, service accounts, and models can touch sensitive SaaS data, then stop an unsafe action before it happens. That is a technically sharper value proposition because it requires inventory, identity context, behavioral baselines, policy evaluation, and enforcement in the transaction path. The same foundation also explains why legacy Salesforce, Workday, and Microsoft 365 SSPM experience matters: those systems are where new Copilot Studio, Agentforce, Workday, n8n, Claude Code, Cowork, and SaaS-to-SaaS automation risks show up in production.[CE001, CE003, CE004, CE006, CE008, CE013]

5.2 Architecture and Runtime Data Path

The architecture implied by public sources is a graph-backed control plane. API-based or agentless onboarding discovers SaaS applications, non-human identities, integrations, MCP servers, models, and agent relationships. A knowledge graph then correlates entitlements, data sensitivity, normal behavior, and tool invocation context. At runtime, an agent request is evaluated for privilege escalation, excessive data access, policy violations, model switching, and unsanctioned MCP or tool usage; the control decision can block before the action takes effect. That is materially different from a passive audit dashboard. The core diligence question is whether Obsidian can keep enough context in the decision loop without creating unacceptable latency, false positives, or connector fragility across many SaaS APIs and agent platforms.[CE005, CE009, CE010, CE011, CE012, CE018]

5.3 Standards, Trust, and Risk Controls

The strongest external validation for the product thesis comes from standards bodies rather than independent product benchmarks. OWASP and CSA describe an MCP threat model dominated by prompt injection, tool poisoning, least-privilege failures, OAuth and authorization mistakes, and unsafe server or tool design. Obsidian's public claims map well to that control language because inventory, model registry, and pre-action policy enforcement are exactly the primitives that a runtime guardrail needs. The adverse read is equally important: PipeLab's 2026 MCP-security assessment describes thousands of MCP CVEs, which means Obsidian is building into an immature and volatile protocol ecosystem. The opportunity is large, but so is the product-efficacy burden; security buyers will need proof that controls work against advanced agent attacks, not only marketing claims about governance coverage.[CE023, CE024, CE025, CE026, CE027, CE028]

5.4 Roadmap, Maturity, and Diligence Gaps

Product maturity looks credible but incomplete from public evidence. The January 2026 SaaS supply-chain security launch shows Obsidian extending from posture into integration risk. The August 2026 Series D announcement then tied fresh capital to R&D, Fortune 500 expansion, and native governance for Claude Code and Cowork. Those milestones are consistent with the market shift toward agentic SaaS workflows. However, the source set does not expose enough hard engineering evidence: there is no public block-rate benchmark, false-positive rate, model-registry schema, uptime history, connector coverage list by application, or detailed support SLA. Developer-signal is also weak; a vendor wiki is only a proxy, not a substitute for an open SDK, public changelog, or active community. Diligence should therefore test runtime efficacy, SaaS-connector reliability, and policy-governance operations before treating the architecture as fully proven. A final product diligence track should therefore test the control plane in adversarial, production-like scenarios: sanctioned versus unsanctioned MCP servers, a model substitution attempt, an agent requesting sensitive HR or sales records, a service account with stale OAuth scope, and a developer agent touching production data. Those tests would convert the public architecture from a plausible graph-and-policy thesis into measurable security evidence and would also reveal whether Obsidian's SSPM heritage creates enough context to avoid noisy runtime blocks. The remaining diligence should be evidence-led, not roadmap-led. Management should also show policy-change audit trails, exception approval records, and customer support escalations for blocked agent actions.[CE019, CE020, CE029, CE030, CE031, CE032]

5.5 Exhibits

6.1 Enterprise Traction and Segmentation

Obsidian’s customer proof starts with scale disclosures that are unusually concrete for a private cybersecurity vendor. The company-reported 2026 Series D corpus says it has 100+ customers spending more than $100,000 per year, 14+ customers spending more than $1,000,000 per year, and 60 Fortune 500 customers across major financial institutions, social media networks, and telecom providers. Those facts support real enterprise adoption, not just pilots, because the disclosed spend thresholds imply production-budget ownership and at least some multi-stakeholder procurement. The segmentation still needs care: finance has the strongest external proof because an anonymous Fortune 500 bank director appears in a customer-reference corpus; telecom has a named logo in T-Mobile through CB Insights; social media is disclosed only as a category; Snowflake supplies a high-quality data-platform case. Obsidian’s product positioning around AI agents, non-human identities, and third-party SaaS applications explains why security, identity, and SaaS owners are likely buyers, users, and payers, but the public record does not yet map every disclosed segment to contract size, renewal status, or production scope.[CU001, CU002, CU003, CU017, CU018, CU019]

6.2 Named Customer Proof and Value Outcomes

The best named proof is Snowflake because it combines a recognizable enterprise, named senior security stakeholders, a concrete deployment context, and measurable operational impact. Obsidian says Snowflake uses the platform across 3,000 integrations and saves more than 800 engineering hours per month; Security MEA separately covered the integration, making the story stronger than a single vendor page. CB Insights adds T-Mobile, Upwork, Trade Me, and BigCommerce to the public logo set, while FeaturedCustomers adds an unnamed Fortune 500 bank director and a CSO describing discovery of hundreds of SaaS apps in days. These references widen the customer map across telecom, marketplaces, commerce, banking, and large SaaS estates. The limitation is that most logos outside Snowflake are not tied to published deployment depth, outcome metrics, retention, or contract economics. For diligence, that means the customer list should be treated as adoption proof and pipeline evidence, not as proof of durability or account-level expansion until management provides reference calls, renewal history, and top-account economics.[CU004, CU005, CU006, CU007, CU008, CU009]

6.3 Satisfaction, ROI, and Durability Signals

The satisfaction and value evidence is positive, but it is not the same as retention evidence. Gartner Peer Insights shows roughly 4.9 out of 5 from about 22 reviews, and PeerSpot supplies another enterprise review surface. Forrester’s TEI calculator reports up to 192% ROI for a composite organization with $9 billion in revenue and 10,000 employees. Those signals matter because they triangulate buyer-perceived value outside Obsidian’s own customer pages, and the Forrester model is directionally consistent with Snowflake’s engineering-hours savings. The caveat is that none of these sources discloses Obsidian’s NRR, GRR, churn, renewal rate, contract length, or true customer cohort behavior. The planned retention cohort therefore has to be displayed as a disclosure map rather than an actual retention curve: public sources can identify a current spend cohort and a current named deployment, but they do not reveal whether the same accounts renew after six or twelve months. This is the central unresolved customer-quality gap.[CU012, CU013, CU014, CU023, CU030, CU036]

6.4 Expansion, Concentration, and Fit Risks

Obsidian’s expansion story is credible because the 2026 financing narrative explicitly says the company will fund R&D and extend deeper into the Fortune 500 and Global 2000, while product surfaces such as MCP security, breach clarity, SaaS supply-chain security, and AI-agent identity management create multiple cross-sell paths. The same evidence also creates underwriting risk. Fourteen-plus $1M customers indicate real account expansion, but they also raise concentration questions if those accounts dominate revenue. The 60 Fortune 500 claim proves enterprise reach, yet specific named Fortune 500 logos are mostly undisclosed, so investors cannot independently assess renewal quality, deployment breadth, or reference diversity. Adverse review evidence from Work-Management.org adds a customer-fit boundary: buyers looking for one platform across SaaS, IaaS, and PaaS posture may view Obsidian as incomplete, and dashboard flexibility limitations may matter to teams with customized reporting needs. The bottom line is strong adoption proof with material disclosure gaps, not a clean retention-underwriting package.[CU015, CU016, CU020, CU021, CU022, CU025]

6.5 Exhibits

7.1 Competition, Platform Risk, and Market Timing

Obsidian is raising into a market that looks urgent but not yet settled. The strongest competitive warning is Zenity: it raised $125 million on 2026-08-03, one day before Obsidian announced its $85 million Series D, and it is explicitly positioned around securing autonomous AI agents. The broader field is also crowded, with Grip, Push, Nudge, Valence, AppOmni, and identity/security-platform incumbents competing for overlapping SSPM, SaaS discovery, browser identity, and agent-governance budgets. That crowding matters because Obsidian’s pivot is not a clean greenfield move from SSPM into a monopoly category; it is a bet that runtime AI-agent governance becomes a budget line large enough to support a unicorn valuation. Microsoft’s native agent-security work is the sharper platform risk. If Copilot, Defender, Salesforce, Google, or SaaS platforms embed enough governance controls directly into enterprise suites, Obsidian could remain technically useful but lose pricing power and strategic urgency. Market timing is the linked risk: 70%+ customer agent exposure and a 144:1 NHI ratio support the problem statement, but public sources do not yet prove renewal durability, standalone AI-governance willingness to pay, or how quickly budgets shift from SSPM to agent runtime controls. A further diligence concern is buyer education: security teams may agree that agents are risky while still postponing a new platform purchase until internal pilots create a breach, audit finding, or board-level mandate.[CR001, CR002, CR003, CR010, CR015, CR020]

7.2 Technical, Legal, and Threat-Landscape Risk

The same threat environment that validates Obsidian also raises the risk that the product under-delivers in high-stakes settings. Prompt injection is repeatedly framed by 2026 adverse sources as the leading enterprise AI-agent risk, and Microsoft’s RCE research shows how agent-framework behavior can turn prompt manipulation into shell-level consequences. The Salesloft/Drift OAuth incident is particularly relevant because it shows how an AI-chat-agent or OAuth/NHI compromise can cascade through Salesforce, AWS, and Snowflake surfaces—the exact kind of SaaS environment where Obsidian says it can govern identities and actions. MCP vulnerability coverage and OWASP MCP guidance add another layer: inventory, least privilege, model registry, and runtime blocking are necessary, but they are becoming expected baseline controls. Legal and regulatory exposure is therefore indirect but material. Public sources do not show a current Obsidian lawsuit or enforcement action, yet enterprise buyers will treat false negatives, over-permissioned agents, and SaaS data exposure as contractual, privacy, and incident-response risks. The burden is to prove that Obsidian blocks advanced attacks before actions execute, not merely that it monitors a scary category. The risk is asymmetrical because one missed exploit in a flagship customer can weaken trust faster than many quiet blocks can build it, especially when incident narratives spread through security communities.[CR004, CR005, CR006, CR007, CR008, CR009]

7.3 Valuation, Financial, People, and Execution Risk

Valuation risk is high because the $1.1 billion post-money price is attached to undisclosed ARR, gross margin, NRR, burn, runway, and headcount. The disclosed spend metrics are meaningful—100+ customers above $100,000 annually, 14+ above $1 million, and 60 Fortune 500 customers—but they only establish a floor. Using the canonical fact-sheet method, ARR is at least about $24 million and plausibly $40 million to $70 million, which puts the valuation in a wide estimated 15x to 45x revenue band. That band can be acceptable for a category leader with durable expansion, but public sources do not prove renewal quality or revenue concentration. Execution risk is therefore central. Obsidian has strong founder and technical credentials and a non-founder CEO with Shape Security go-to-market experience, yet it must manage a category pivot, enterprise platform partnerships, advanced threat research, and intense competition simultaneously. The right investment posture is not to dismiss the company; it is to make price, disclosure, and proof-of-blocking gates explicit. If private diligence cannot connect product-specific expansion to the latest disclosed customer thresholds, investors should treat the Series D as strategic validation rather than full proof of durable economics.[CR012, CR013, CR014, CR016, CR017, CR021]

7.4 Exhibits

8.1 Series D Price and Implied Multiple

Obsidian’s August 4, 2026 Series D gives the valuation chapter a clear headline and an unclear denominator. The numerator is well supported: the company announced an $85 million raise led by Crescent Cove Advisors at a $1.1 billion post-money valuation, with existing investors returning and total capital raised now above $200 million. The denominator is the hard part. Obsidian discloses 100+ customers spending at least $100,000 annually, 14+ spending at least $1 million, and 60 Fortune 500 customers, but it does not disclose ARR, growth, margins, retention, burn, runway, or headcount. Using the canonical public-floor method from the financial chapter, the disclosed spend tiers imply about $24 million of ARR, while the plausible underwriting range remains roughly $40-70 million. That range makes the $1.1 billion price highly sensitive: about 46x at the floor, 22x at $50 million, and 15.7x at $70 million. The valuation is therefore not nonsensical, but it is explicitly price-sensitive and evidence-sensitive.[CV001, CV002, CV003, CV004, CV007, CV008]

8.2 Comparable Multiple Frame

The comparable frame argues for a split verdict. Windsor Drake’s 2026 cyber work puts ordinary public cybersecurity nearer 6-8x NTM revenue, cloud or AI-native leaders around 14-22x, private cyber around 15.2x, and top cloud M&A as high as 35x. Public comps show dispersion rather than a single answer: CrowdStrike sits at about 25.1x on $4.81 billion of FY26 revenue and $5.25 billion of ARR, Zscaler at about 11.7x on roughly $3.17 billion of TTM revenue and about $25 billion of market capitalization, Palo Alto around 15x, Cloudflare around 31.5x, Fortinet around 8.7x, and Okta around 5x. Private and M&A references are even more volatile. Wiz supports a strategic scarcity premium at $32 billion and $1 billion-plus ARR, while Cyera’s 80x ARR discussion despite operating losses is an adverse froth warning. NinjaOne shows investors will still pay up when fast growth comes with profitability. Obsidian deserves to be compared to the premium set only if diligence verifies high ARR and durable growth.[CV013, CV014, CV015, CV016, CV017, CV018]

8.3 Scenario Recommendation and KPIs

The recommendation is to track, not buy unconditionally, because the Series D price is rich while public evidence is incomplete. The thesis is attractive: a large AI-agent/NHI security market, Fortune 500 proof, strong syndicate support, and runtime governance capabilities that align with a new enterprise control plane. The anti-thesis is equally important: category timing is young, Zenity raised $125 million one day earlier, Microsoft and other platforms can absorb pieces of the workflow, and the revenue denominator is private. The bull case needs ARR near $70 million, high growth, and premium public-comparable tolerance; the base case assumes $40-50 million ARR and an opacity discount; the bear case uses the $24 million floor and compressed multiples. Those cases translate to a stretched valuation stance with medium confidence and high risk. The IC should monitor market size, customer proof, moat, economics, competition, valuation, and evidence quality rather than treating the unicorn headline as its own proof.[CV023, CV024, CV025, CV026, CV027, CV028]

8.4 Exit Readiness and Final Diligence

Exit optionality is real but not yet enough to erase valuation risk. Cybersecurity M&A activity, Google/Wiz, and Palo Alto/CyberArk all support strategic appetite for scarce security control planes, and Obsidian’s move into AI-agent governance gives it a plausible strategic narrative. However, a $1.1 billion entry price requires diligence evidence that public sources do not provide. The buyer or investor needs audited ARR, an ARR bridge from customer tiers, gross margin, burn, NRR, GRR, cohort retention, customer concentration, headcount, and clear cap-table terms. The most important kill triggers are ARR below about $40 million, evidence that the $24 million floor is close to reality, concentration inside the 14 million-dollar accounts, platform-vendor budget capture, or broad cyber multiple compression. If management proves high ARR and clean preferences, the valuation can be defended as a growth-premium cyber round. If not, the Series D looks stretched on estimated ARR and should be approached only with price protection.[CV021, CV037, CV038, CV039, CV040, CV041]

8.5 Exhibits