Kyvvu raises €1M to keep AI agents from breaking their own rules
What's the deal? Dutch startup KyvvuDealroom has a profile for this one. Try Dealroom → has raised €1 million in a pre-seed round to fix a security gap that emerges when AI agents combine permitted actions in the wrong order. Volta Ventures and the Brabant Development Agency (BOM)Dealroom has a profile for this one. Try Dealroom → backed the round.
Why now? Companies are shifting from using AI to suggest actions to letting it perform them — updating records, moving data, issuing refunds — without a human in the loop. A wrong suggestion is a minor inconvenience; an incorrect autonomous action is an incident that, in banking, insurance, or healthcare, must often be reported to a regulator.
What's the endgame? Based in Den Bosch, Kyvvu builds a security layer called the Agent Security Kernel (ASK) that sits inside the agent. In under a millisecond, it checks each action — reading data, calling a tool, sending a message — against everything the agent has already done, then allows, warns, or blocks it.
The rules are fixed, version-controlled policies a compliance officer can inspect, not judgments from a second AI model, and they never leave the customer's systems. The engine is deterministic, so the same input always produces the same verdict.
The kernel is framework-agnostic, available as source code, and already running at financial services, insurance, and healthcare organisations in the Netherlands. Because every action passes one checkpoint, it also logs what each agent did — record-keeping Kyvvu says aligns with the EU AI Act and GDPR.
What could go wrong? The risk isn't in what an agent is permitted to do, but the order it chooses. An agent allowed to read a customer record and, separately, to email outside the organisation can combine both into a data leak — a sequence that slips past tools checking one action at a time.
"They will only be trusted with work that matters once something inside them is checking each action before it happens," said Jeroen Ghijsen, co-founder and chief executive officer of Kyvvu.
The signal: The €1 million round sits in the 27th percentile by amount, modest even for pre-seed — but investors frame it as early positioning in a category they expect to become standard. "We think a runtime control point becomes a hard requirement for running agents at scale, the way endpoint security did before it," said Sander Vonk, managing partner at Volta Ventures.
Read more: IO+
Image credit: Generated with Gemini
