Secrets management firm Infisical has announced a $40 million Series B funding round, with reports valuing the company at $600 million. According to the announcement referenced by SecurityWeek, the company plans to use the new funding to expand its platform for securing AI agents’ access to sensitive systems.

While the funding itself does not create a new requirement for businesses, it points to a wider market shift: companies are increasingly treating machine identities, application credentials and AI-driven workflows as a core cybersecurity issue rather than only a developer tooling problem.

What happened

Infisical, a company focused on secrets management, has raised $40 million in fresh funding. SecurityWeek reports that a key use of the investment will be expanding capabilities aimed at securing how AI agents access sensitive systems.

Secrets management tools are designed to protect items such as API keys, database passwords, tokens, certificates and other credentials used by applications, cloud services, scripts and automated workflows. In practice, these tools help businesses avoid storing sensitive credentials in code repositories, chat tools, spreadsheets or unsecured configuration files.

The specific commercial significance of the announcement is the emphasis on AI agents. As businesses deploy AI-powered assistants, workflow automation and autonomous software actions, those systems often need access to business applications, customer data, internal APIs or cloud resources. That access can create a new attack surface if credentials are handled poorly.

Why it matters for European businesses

For many SMEs and digital teams, AI adoption is moving from experimentation to operational use. AI assistants are being connected to CRMs, support systems, marketing tools, e-commerce platforms, internal databases and developer environments. Each connection usually involves credentials or tokens that must be stored, rotated and monitored securely.

This matters because a compromised secret can provide attackers with direct access to systems without needing to break in through a traditional user account. If API keys or tokens are exposed in source code, CI/CD pipelines, browser-based admin tools or automation platforms, the result can be data exposure, service disruption or abuse of cloud resources.

For European companies, the business issue is not only technical security but also governance. If AI agents or automated systems are given broad or poorly controlled access to customer records, financial data or production systems, the risks may extend to compliance, incident response and supplier risk management.

The announcement also reflects a broader cybersecurity trend: machine identity is becoming as important as human identity. Many organisations have stronger controls for employee logins than for the secrets used by applications, integrations and bots, even though those non-human identities often hold extensive permissions.

Who may be affected

• SMEs adopting AI tools and automation that connect to internal or customer-facing systems
• Software and IT teams managing cloud applications, containers, CI/CD pipelines and infrastructure credentials
• E-commerce businesses using integrations across payment, inventory, analytics and customer support platforms
• Marketing teams relying on martech automation, APIs and third-party data flows
• Regulated businesses that need stronger controls over access to sensitive data and critical systems

Even companies that do not build their own AI agents may still be affected if they use SaaS products that introduce autonomous features or deeper workflow automation behind the scenes.

What companies should consider

• Review where secrets are stored: identify whether API keys, passwords, access tokens or certificates are stored in code, spreadsheets, shared documents or messaging tools
• Apply least-privilege access: ensure AI tools, scripts and automations only receive the minimum permissions needed for their tasks
• Separate human and machine identities: treat service accounts, application tokens and bot credentials as assets that need dedicated controls and visibility
• Rotate and revoke credentials regularly: shorten exposure windows for compromised secrets and remove unused access promptly
• Audit AI and automation connections: map which systems AI assistants and workflow tools can access, and whether those access paths are monitored
• Assess supplier security: when adopting third-party AI or automation tools, ask how credentials are stored, encrypted, rotated and logged

The Infisical funding announcement is mainly a market signal rather than a direct change in policy or law. However, it underlines a practical issue for European businesses: as AI agents and automated workflows gain access to more systems, secrets management is becoming a board-level security consideration, not just a back-end engineering detail.