Act Security Makes First Acquisition One Month After Emerging From Stealth

The cybersecurity company acquired Cloud Copilot and is using its technology to launch Amphi, a free, open-source toolkit designed to help cloud engineers test and manage access policies before they reach production

Act Security has acquired Cloud Copilot, open-source AWS IAM tooling created by David Kerber, marking its first acquisition just one month after emerging from stealth. Kerber will join Act, and Cloud Copilot will serve as the foundation for Amphi, a free, open-source toolkit of seven tools for cloud access management.

Access is the foundation of cloud security: if permissions are misconfigured, other controls can be bypassed. Yet the developer tooling for getting access policies right has lagged behind, leaving engineers with slow, manual processes and making basic questions about who can access what harder to answer than they should be.

“Every CISO we speak with wants to solve access sprawl, but infrastructure and platform teams are the ones actually managing the access behind those decisions,” said Jonathan Langer, co-founder and CEO of Act Security. “Cloud Copilot had already earned trust with those engineers, policy by policy, without asking them to log in. We acquired it to support the community operating the cloud, because that is where the real access decisions are made.”

Amphi is designed to take the guesswork out of managing cloud access policies by giving engineers clearer answers before changes reach production. Its tools can expand broad or wildcard permissions into the exact actions they allow, simulate how a policy will evaluate a specific request without touching a live account, and analyze the policies already running across an AWS environment to determine whether a particular role can reach a specific resource. The suite also includes tools for examining how guardrails such as SCPs and RCPs will behave under different conditions, shrinking oversized policies without changing the permissions they grant, and converting policies into infrastructure-as-code formats.

“I built the Cloud Copilot tools because I wanted straight answers that I could not get from the AWS documentation,” said Kerber. “They were created to help engineers understand effective permissions across principals, resources and accounts. As part of Act, Amphi continues that same approach as a free, open-source toolkit for the engineers securing cloud environments every day.”

Amphi will remain free and open source, with no account or email address required. Each tool is available through a client-side browser experience, an offline-capable CLI and full source code on GitHub, where the projects will remain open to issues and pull requests from the community.

The acquisition fits Act’s broader approach to cloud security. Rather than surfacing findings, Act eliminates the conditions that make risk exploitable in the first place. The company eliminates access paths, scopes down what applications, workloads and AI agents can reach, and enforces those limits through cloud-native controls at the infrastructure layer.

Act Security emerged from stealth in July with $60 million in total funding. The company was founded in 2025 by Jonathan Langer, CEO; Itay Kirshenbaum, CTO; Stephan Goldberg, CPO; and Ilai Fallach, VP R&D. Langer and Kirshenbaum previously co-founded medical device security company Medigate, which was acquired by Claroty for $400 million, while Goldberg was one of Medigate’s early employees. Act’s investors include Team8, Bessemer Venture Partners, Notable Capital, Hetz Ventures, Claltech, Startpoint Capital and SVCI.

Photo: Tammy Bar-Shay