The round was led by Osney Capital, with participation from Superseed, Tiny.vc, and Rule30, alongside notable angels.

The funding comes at an important juncture for enterprise security. With 80% of cyberattacks now leveraging identity-based methods, and each critical identity-related security alert consuming 11 person-hours on average, organisations are overwhelmed by identity complexity. The rapid proliferation of AI agents and non-human identities has also created a new attack surface that legacy tools weren't built to handle.

Legacy Identity Governance and Administration (IGA) tools often take years to implement and were designed for on-premise environments that no longer reflect how modern companies operate. With the majority of businesses now running distributed technology stacks across hundreds of SaaS applications, these outdated approaches leave security teams blind to identity risks and drowning in manual processes.

Founded by CTO Harry Lucas and CEO Jacob Prime, both former leaders at Metomic, Ploy addresses this head on: it makes access secure and compliant by enabling automation for identity processes, from onboarding and offboarding to access requests and reviews, across SaaS, cloud, and collaboration tools. The platform comes with pre-built integrations and automated workflows that let companies see every access grant and start automating identity processes in under 20 minutes. Designed for the underserved mid-market segment of companies with up to 5,000 employees, Ploy combines modern cloud architecture with an embedded AI assistant, 'Luna', giving security teams the intelligence to spot anomalies and make context-rich access decisions.

The platform has already secured over one million individual access entitlements and discovered more than 26,000 SaaS applications that use companies’ identities across its customer base.

“Identity sprawl has become a significant issue for organisations of all shapes and sizes, but particularly those with modern technology stacks; which often comprise hundreds, or even thousands, of SaaS applications,” said Joshua Walter, Partner at Osney Capital, who will join Ploy's board. “This breadth causes fragmented and distributed access and ownership of identity, without unified visibility or control, and is typically enabled using role-base access controls. Ploy’s just-in-time approach to access, making all access temporary by default, and identifying risks centrally in real-time, is becoming the only approach that scales with modern threats, ways of working and technology stacks.”

Ploy's growing customer base includes fast-growth companies like Payfit, Not On The High Street, Welcome to the Jungle, ComplyAdvantage, Liberis, and Times Higher Education, who have seen dramatic improvements in their security posture. Ellie Mental Health, which has experienced rapid headcount growth in recent years, uses Ploy to identify risky access entitlements within seconds of detection. This level of visibility, automation and scalability across their infrastructure is critical in ensuring they scale identity and access securely.

With 80% of breaches now stemming from identity, boards are realising it’s the biggest area they need to prioritise in their security strategy,” said Jacob Prime, Co-Founder and CEO, Ploy. “Spreadsheet-based access tracking is now a legal and security liability. They need real-time visibility into who has access to what, before attackers or regulators find the gaps. That’s exactly the problem Ploy solves."

The rapidly growing startup has already doubled revenue with just four employees, having raised in 2024 from strategic angels. This new round of VC funding will accelerate Ploy's product development and scale its go-to-market, as market demand continues to grow globally.

For more startup news, check out the other articles on the website, and subscribe to the magazine for free. Listen to The Cereal Entrepreneur podcast for more interviews with entrepreneurs and big-hitters in the startup ecosystem.