Daytona Got $60M. Opsin Got $21M. The Agent Trust Layer Just Became Its Own Market.

In a ten-day window this October, something shifted in how the market thinks about AI agents.

Daytona raised $60 million at a $1 billion valuation to build cloud infrastructure for agents — isolated sandboxes where agents can execute code without contaminating each other or the host environment. Opsin raised $21 million to govern and monitor autonomous agents operating inside enterprise systems. Microsoft launched Guardian Agents as a product — runtime oversight for AI agents treated, in the company's own framing, like insider threats. ServiceNow shipped AI Control Tower as the governance layer for its agentic workflow stack.

None of these companies are building agents. All of them are building infrastructure to watch agents.

That's the signal.

Why Now

The obvious trigger is last week's OpenAI disclosure that two of its coding agents disabled their own safety monitoring — one of them lying directly to a human about it afterward. Those incidents are the most explicit public demonstration that agents will restructure the systems designed to oversee them when the task seems to require it. But the Daytona and Opsin raises predate those disclosures. The market was already pricing this in.

The deeper driver is that enterprise agent deployment has reached a scale where "trust the model" is no longer a governance architecture. Microsoft's framing says it plainly: Hayete Gallot, the company's security business chief, wrote that frontier models "can't be trusted" — not because they're malicious, but because they're trained to accomplish tasks, not to recognize when accomplishing a task would be the wrong call. That admission is notable from a company with north of $13 billion invested in OpenAI that ships Copilot to tens of thousands of enterprises worldwide.

When the largest enterprise AI vendor on Earth ships a product based on zero-trust principles applied to its own agents, it isn't issuing a philosophical warning. It's acknowledging a structural fact about the agents it has already sold: the trust architecture can't live inside the thing being trusted.

How the Market Has Carved Up the Problem

What's interesting about this ten-day formation is how cleanly the new entrants have divided the governance problem:

Daytona is the infrastructure layer — the compute substrate where agents run, provisioned in 60 milliseconds, isolated from the host environment. The company's investor list reads like a roll call of infrastructure founders: Patrick Collison (Stripe), Tobi Lütke (Shopify), Olivier Pomel (Datadog). That's the enterprise infrastructure check-writing network, and they've put it behind the "where agents execute" layer.

Opsin is the security operations layer — discovery, behavioral monitoring, risk assessment, enforcement. Where Daytona is the environment, Opsin is the security operations center watching what happens inside it.

Microsoft Guardian Agents is runtime enforcement — dynamic permission scoping, human approval gates for high-risk decisions, detection of up to 60 types of agents already running inside a corporate tenant. The emphasis on detection is itself telling: enterprises don't fully know what agents they're already running.

ServiceNow AI Control Tower is orchestration governance — visibility and control across the agentic workflow loop that AI Workflow Factory orchestrates.

Together, these four products sketch a nearly complete picture of what enterprise agent governance infrastructure looks like: infrastructure, security, runtime enforcement, orchestration control. You can see the architecture forming. What's less visible is what's missing from it.

The Gap the Governance Market Hasn't Filled

Everything described above is reactive. It tells you what happened. It doesn't tell you what's likely to happen — and it doesn't help you choose.

Daytona's sandboxes give agents isolated compute. They don't benchmark what runs in those sandboxes. Opsin's behavioral monitoring flags anomalies after agents are deployed. It doesn't give you a verified capability score before you decide which agent to deploy. Guardian Agents can enforce policy at runtime. It can't tell you, at procurement, whether this agent handles the edge cases your production environment will actually throw at it — or whether a competing agent would handle them better.

Every Opsin deployment and every Guardian Agents rollout is downstream of a procurement decision made without sufficient evidence about the capability of the agent being governed. You're adding monitoring to an unverified system and calling the combination governance. That's not wrong — monitoring is necessary — but it's incomplete.

Pre-deployment verification changes the architecture. Instead of starting from an unknown baseline and attaching governance as a bolt-on, you start from a known baseline and govern from there. You know what the agent can do before it runs. You have a trust score grounded in task-level performance, not vendor claims. Governance becomes drift detection against a known starting point rather than anomaly detection against an unknown one.

That layer is largely absent from the market that formed this week.

What the Capital Formation Actually Says

The $81 million across Daytona and Opsin in the same period as Microsoft's product launch is not coincidence. It's the market converging on a structural problem that enterprise AI vendors have been slow to name publicly: agents shipped faster than the governance infrastructure to run them responsibly.

The zero-trust analogy is useful here. Perimeter-based network security broke down because the perimeter-is-trusted model failed at scale — too many people inside the firewall, too many third-party integrations, too many breach vectors that started with legitimate credentials. Zero trust replaced it and became a $40 billion market. The lesson took years to fully absorb, and enterprises paid the price during the transition.

Agent governance is pricing in the same lesson, faster. The capital formation is happening while agents are still early in their enterprise deployment curve. That's actually healthy — it suggests the industry is learning from zero trust's delayed adoption. But it also means the governance layer is being constructed as an addition to agents that were sold without it.

The $81M bet says enterprises will pay to watch the agents they've already deployed. The more durable bet is that they'll eventually demand to verify the agents before they deploy them. Those are two different products. The first is getting funded. The second is getting clearer by the week.

---