- The AI agent security market is not a wall of similar startups. It resolves into six distinct control planes: discovery, identity, runtime enforcement, guardrails, governance, and red teaming. Most vendors credibly own one or two of those planes, not all six.
- Three major acquisitions have already reshaped independent vendor options: SentinelOne announced an agreement to acquire Prompt Security, Palo Alto Networks acquired Protect AI, and Cisco acquired Robust Intelligence. Each acquisition folded a specialist into a platform; the standalone capability still exists, but the roadmap now answers to a platform team.
- The discovery and inventory control plane is the least mature and the most urgent. Most organizations do not have a complete count of which agents are running, what tools they can call, or what data they can reach.
- Platform consolidation is advancing fastest in the guardrails and governance segments. Teams buying standalone point tools in those segments today should expect acquisition pressure on their vendors within the next 18 months.
- A team planning this budget cycle should map which two or three control planes have no coverage today, then buy to close those gaps rather than buying broad platforms that duplicate controls already in the stack.
The ai agent security companies market covers six functional control planes: agent discovery and inventory, agent identity and access, runtime enforcement and session control, guardrail and prompt-layer protection, governance and policy management, and red teaming and adversarial testing. Vendors in this market range from pre-revenue startups to features inside platforms from Palo Alto Networks, Microsoft, and SentinelOne. No single vendor currently provides production-ready coverage across all six planes.
Why Most “AI Security” Lists Miss the Point Entirely
The typical list article on this topic mixes endpoint AI detection tools, AI-assisted SIEM features, and actual agent security products into one undifferentiated pile. Those are different problems. A tool that uses machine learning to detect malware is not doing the same job as a tool that enforces least-privilege access for an autonomous agent that can call APIs, write files, and spawn sub-agents.
The confusion matters operationally. A CISO who buys an “AI security” platform expecting runtime enforcement for their Salesforce Agentforce deployment and gets a model scanning tool instead has spent budget on the wrong control plane. The six-control-plane model below is SecurityOpsWire’s editorial framework for categorizing this market. It is not borrowed from a vendor’s product page.
The SecurityOpsWire Six-Plane Control Map for AI Agent Security
Each control plane addresses a different attack surface in an agentic AI deployment. The planes are roughly sequential in the agent lifecycle: you cannot enforce policy on an agent you have not discovered, and you cannot red-team an agent you have not built identity controls around. That sequencing also maps to a reasonable budget prioritization order for teams starting from zero coverage.
| Control Plane | What It Secures | Primary Buyer | Market Maturity |
|---|---|---|---|
| Discovery and Inventory | Agent enumeration, tool mapping, shadow agent detection | Security Engineering | Early |
| Agent Identity and Access | Non-human identities, API keys, OAuth grants, service accounts | IAM / Security Engineering | Emerging |
| Runtime Enforcement | Session-level monitoring, tool-call interception, anomaly detection | SOC / Platform Security | Early |
| Guardrails and Prompt Layer | Input/output filtering, jailbreak detection, data leakage at the model boundary | AppSec / AI Platform | Moderate |
| Governance and Policy | Build-time scanning, policy-as-code, compliance reporting for AI workloads | CISO / GRC | Emerging |
| Red Teaming and Adversarial Testing | Automated adversarial probing, prompt injection testing, agentic workflow simulation | AppSec / Red Team | Developing |
Control Plane 1: Which Vendors Are Solving AI Agent Discovery and Inventory?
Discovery is the unglamorous foundation. Before any other control matters, a security team needs to know which agents exist, which model providers they connect to, which tools they are authorized to call, and what data stores they can reach. Most enterprises currently answer this question with a spreadsheet, if at all.
Zenity is one of the earliest companies to focus specifically on this problem, with a platform designed to inventory agents built on Microsoft Copilot Studio, Power Platform, and other low-code agent builders. The platform spans what Zenity describes as the build-time-to-runtime window. Straiker combines discovery with adversarial testing, positioning visibility as the entry point to broader agent security. AccuroAI approaches the problem from a governance angle, with inventory serving its compliance reporting function rather than as a pure detection capability.
For teams evaluating this segment, the critical question is whether the vendor’s discovery scope covers the agent frameworks in use. A tool that enumerates Microsoft Copilot agents but cannot see LangChain or CrewAI-based agents running in AWS Lambda provides false confidence. Coverage of shadow agents, meaning agents spun up by business users outside IT’s provisioning process, is the hardest and most important capability in this plane. SecurityOpsWire’s comparison of AI agent discovery and monitoring tools covers the coverage scope differences across the major vendors in this segment.
Control Plane 2: Who Owns the AI Agent Identity Problem?
Agents authenticate to downstream services using non-human identities: API keys, OAuth tokens, service account credentials, and increasingly, model-context-protocol (MCP) sessions. The attack surface here is well-understood from traditional non-human identity (NHI) security work, but agentic systems add two complications. First, agents often create credentials dynamically at runtime rather than through provisioned accounts. Second, an agent’s effective permission scope is a product of both its explicit credentials and the implicit permissions granted by the tools it can call.
Astrix Security covers non-human identity broadly, including agent service accounts and API key management. Entro Security focuses on secrets sprawl and machine identity lifecycle, which overlaps directly with how agent credentials are created, rotated, and revoked. Clutch Security addresses NHI governance with a scope that includes AI agent credentials.
The MCP-specific identity problem is a newer and distinct sub-segment. MCP servers function as a tool-access broker for agents, and their authorization model is immature compared to established OAuth patterns. The choice between an MCP gateway and a traditional AI gateway carries real architectural implications for which identity controls apply at the tool-call layer. SecurityOpsWire has a dedicated analysis of the MCP gateway versus AI gateway decision for security teams working through that choice.
Control Plane 3: Which Vendors Enforce Policy at Agent Runtime?
Runtime enforcement means intercepting, inspecting, and potentially blocking agent actions as they happen: tool calls, file writes, API requests, sub-agent spawns, and memory reads. This is the closest analog in the agentic world to what EDR does at the endpoint, and it is correspondingly difficult to do without introducing latency that breaks agent workflows.
Protect AI built out runtime visibility for ML models and AI pipelines before its acquisition by Palo Alto Networks. The Protect AI product line is now part of Palo Alto’s AI security portfolio, which means buyers get platform integration but should verify which specific runtime capabilities transferred into the Prisma AI product line versus what remains as standalone tooling. Lasso Security focuses on runtime data leakage prevention for LLM-connected applications and agents. Prompt Security, which SentinelOne announced an agreement to acquire on August 5, 2025, addressed prompt-layer interception that functions at runtime.
The operational cost most teams underestimate in this plane is tuning debt. Runtime enforcement tools generate a high volume of alerts during initial deployment, particularly false positives around legitimate but unusual agent behavior. A team without a dedicated detection engineer to tune policies for each agent workflow will either turn off enforcement or drown in noise within weeks of deployment.
Control Plane 4: Who Provides Guardrails at the Model Boundary?
Guardrails operate between the model and the rest of the system, filtering inputs before they reach the model and filtering outputs before they reach the user or the next tool in an agentic chain. This segment attracted the most startup formation between 2023 and 2024, and it is also the segment where capability overlap is the most severe.
Lakera is one of the more established pure-play guardrail vendors, with a prompt injection detection capability that works across major LLM providers. Guardrails AI is an open-source framework with a commercial offering layered on top, making it a common starting point for teams that prefer to run guardrail logic in their own infrastructure. Arthur AI addresses model monitoring and guardrails from a model observability angle. Nyckel, WhyLabs, and Rebuff occupy adjacent positions in this space with varying degrees of production adoption.
Robust Intelligence, acquired by Cisco, focused on AI model testing and validation, which overlaps with both guardrails and red teaming. The Cisco integration positions this capability inside the Cisco AI Defense product. For teams in a Cisco-heavy environment, that acquisition may simplify procurement; for teams that are not, the standalone path is gone.
The decision a security team actually needs to make here is not which guardrail vendor to choose but whether to run guardrails as infrastructure the security team operates or as a capability embedded in the AI platform team’s pipeline. That organizational question determines whether the buyer is AppSec, the AI platform team, or the SOC, and each has different requirements for how alerts surface and how policies are managed. SecurityOpsWire’s full breakdown of the leading AI guardrail platforms covers the deployment model and ownership questions in detail.
Control Plane 5: Which Vendors Cover AI Agent Governance and Policy?
Governance in the agent context means build-time scanning of agent configurations, policy-as-code for what agents are permitted to do, audit trails that satisfy compliance requirements, and reporting for risk and board conversations. This is where the AI-SPM (AI Security Posture Management) category label appears most often, though vendors apply that label inconsistently.
Wiz has extended its CSPM and CNAPP platform to cover AI workload posture, including scanning for misconfigured model endpoints and exposed training data. Orca Security has similarly extended cloud posture coverage to AI assets. These are not AI agent governance specialists; they are cloud security platforms adding AI coverage, which matters because their governance controls are strongest where agent workloads run in cloud environments and weakest for agents running inside SaaS platforms or low-code builders.
Noma Security focuses specifically on AI governance and posture management for enterprise AI programs, covering both the model pipeline and the agent layer. Mindgard approaches governance from a continuous security testing angle, with compliance reporting as an output of its testing pipeline rather than a standalone governance product.
The distinction between AI-SPM and actual agent security is a real one that vendors frequently blur. SecurityOpsWire’s analysis of where AI-SPM stops and AI agent security starts draws that boundary clearly, which matters before you sign a contract with a vendor that does one but describes itself as doing both.
Control Plane 6: Who Red Teams AI Agents Before Attackers Do?
Red teaming for AI agents is distinct from red teaming for traditional applications. The threat models include prompt injection attacks that hijack agent reasoning, indirect prompt injection delivered through tool outputs or retrieved documents, goal hijacking via memory manipulation, and multi-agent compromise where a compromised sub-agent propagates malicious instructions up a chain. Standard application penetration testing methodologies do not cover these attack patterns adequately.
Straiker tests agentic workflows specifically, including multi-hop attacks across agent chains. Mindgard runs automated adversarial probing against deployed models and agent endpoints. Giskard provides LLM testing with a focus on reliability and safety that overlaps with adversarial testing. Adversa AI focuses on adversarial robustness testing for AI systems including agents. CalypsoAI spans red teaming and deployment-time enforcement.
The operationally important question for this segment is whether the vendor can simulate attacks against the specific agent framework in use. A tool that tests OpenAI Assistants API behavior may not accurately simulate attacks against a LangGraph agent with custom tool implementations. Verify framework coverage before running an evaluation. SecurityOpsWire’s evaluation of AI agent red teaming platforms for enterprise teams covers framework compatibility in each vendor entry.
Which Companies Span Multiple Control Planes?
A handful of vendors have built or acquired their way into multi-plane coverage. The table below maps the major players to the planes where they have production-ready capability, as opposed to roadmap features or marketing positioning.
| Vendor | Status | Discovery | Identity | Runtime | Guardrails | Governance | Red Team |
|---|---|---|---|---|---|---|---|
| Zenity | Independent | Yes | Partial | Yes | No | Yes | No |
| Straiker | Independent | Yes | No | Partial | No | No | Yes |
| Protect AI (Palo Alto) | Acquired | Partial | Yes | Yes | No | Yes | Partial |
| Prompt Security (SentinelOne) | Acquisition announced | No | No | Yes | Yes | Partial | No |
| Robust Intelligence (Cisco) | Acquired | No | No | No | Yes | Partial | Yes |
| Noma Security | Independent | Yes | Partial | No | No | Yes | No |
| Lakera | Independent | No | No | Partial | Yes | No | Partial |
| Mindgard | Independent | No | No | No | Partial | Partial | Yes |
| Wiz | Independent | Partial | No | No | No | Yes | No |
| CalypsoAI | Independent | No | No | Yes | Yes | Partial | Yes |
| Astrix Security (Cisco) | Acquired by Cisco; standalone sales ended June 30, 2026 | No | Yes | No | No | Partial | No |
The “Partial” designations above reflect cases where a vendor has a product in the category but it is narrower in scope than purpose-built alternatives. Mapping built from vendor documentation and product pages reviewed for this article. We have not conducted hands-on testing of each product.
Where Are the Significant Overlaps and Coverage Gaps?
Three overlaps create real buying confusion. Runtime enforcement and guardrails overlap at the prompt-interception layer: both claim to stop prompt injection, but runtime tools intercept tool calls and agent actions while guardrail tools intercept model inputs and outputs. They are not substitutes. Discovery and governance overlap at the asset inventory layer: governance platforms need an inventory to scan, so some governance tools include lightweight discovery rather than integrating with a dedicated discovery product. Red teaming and runtime enforcement overlap conceptually but not operationally: red teaming is a pre-production testing activity while runtime enforcement runs in production.
The most significant coverage gap in the market as it currently stands is in agent-to-agent communication security. When an orchestrator agent spawns sub-agents, and those sub-agents call tools and return results, there is currently no widely adopted standard for authenticating and authorizing that inter-agent communication. Most vendors either ignore this attack surface or address it through policy controls that assume the orchestrator is trustworthy. For a deeper look at how MCP-specific tooling addresses the tool-access layer of this problem, SecurityOpsWire’s guide to MCP security tools covers the current state of that segment.
Which Segments Are Consolidating Into Platforms?
Platform consolidation is most advanced in the guardrails and governance segments. The Palo Alto, SentinelOne, and Cisco acquisitions all brought guardrail or governance capabilities into existing security platforms, and the pattern will continue. The discovery and runtime enforcement segments are less consolidated, partly because the technical problems are harder and partly because the market for those segments is younger.
Teams evaluating independent vendors in the guardrails segment should weigh the acquisition risk directly. Several of the remaining independent guardrail companies are well-funded startups in a segment where the large platforms have shown they are willing to acquire rather than build. A two-year contract with a guardrail vendor that gets acquired 18 months in puts the security team in a renegotiation they did not plan for.
The red teaming segment is consolidating more slowly. Red teaming requires deep specialization in adversarial AI techniques that is difficult to acquire at scale, and the buyer for red teaming services is usually a security team with enough sophistication to evaluate technical claims. That buyer profile is harder for a general platform to serve with a checkbox feature.
A Practical Prioritization Scenario for Teams Starting From Zero
Consider a company with 600 employees running a mixed SaaS and AWS environment. The security team has three people. The company has deployed Microsoft Copilot enterprise-wide, has two internal teams building LangChain agents that access internal APIs, and has a third-party vendor with an agent that connects to the CRM. No agent security controls are in place.
In this environment, the first-priority control plane is discovery. The security team cannot state with confidence how many agents are running, what permissions they hold, or whether the third-party CRM agent has been granted excessive OAuth scopes. A discovery tool that covers Microsoft Copilot Studio and can enumerate API OAuth grants addresses the most immediate visibility gap. The second-priority plane is agent identity. The LangChain agents are almost certainly authenticating to internal APIs with long-lived credentials rather than dynamically scoped tokens. Addressing secrets sprawl in those agents closes a blast-radius risk before it is exploited. The third-priority plane depends on the risk conversation with the business: if the CRM agent is handling sensitive customer data, guardrails at the model output boundary are the next control. If the primary concern is operational disruption from prompt injection against the internal API agents, runtime enforcement moves ahead of guardrails.
That ordering is not universal. A company in financial services with a public-facing agent in production will prioritize runtime enforcement and guardrails over internal discovery. The control plane map is a navigation tool, not a sequential checklist. SecurityOpsWire’s broader review of AI agent security platforms provides vendor-level detail for teams that have completed the prioritization exercise and are ready to evaluate specific products.
Frequently Asked Questions
What is the difference between AI agent security and traditional application security?
Traditional application security focuses on code vulnerabilities, dependency risks, and API exposure. AI agent security adds a layer that traditional AppSec tools cannot see: the agent’s reasoning process, its runtime tool-call behavior, the instructions it receives through retrieved context, and its ability to take autonomous actions with downstream consequences. An agent can be built on secure code and still be compromised through a prompt injection attack embedded in a document it retrieves. That attack class has no analog in SAST or DAST tooling.
Which AI agent security companies are still independent versus acquired?
As of mid-2025, Zenity, Straiker, Noma Security, Lakera, Mindgard, Entro Security, Clutch Security, CalypsoAI, and Guardrails AI remain independent. Protect AI was acquired by Palo Alto Networks. SentinelOne announced an agreement to acquire Prompt Security on August 5, 2025. Robust Intelligence was acquired by Cisco. Astrix Security is now part of Cisco, with standalone sales ended as of June 30, 2026. Acquisition status changes; verify current ownership before signing a multi-year contract with any vendor in this market.
How does MCP security fit into the AI agent security control planes?
MCP (Model Context Protocol) is a transport and tool-access standard that agents use to call external tools and data sources. MCP security sits primarily in the agent identity and runtime enforcement planes. Securing MCP means controlling which tools an agent can register, authenticating those tool calls, and monitoring what the agent requests from MCP servers at runtime. It is a specific implementation of broader agent access control rather than a separate control plane.
Should security teams buy an AI agent security platform or point tools by control plane?
Buy point tools if the team has clear gaps in one or two specific control planes, has the engineering capacity to integrate them, and is willing to accept a future consolidation event. Buy a platform if the team is starting from zero coverage, wants a single vendor relationship for support and accountability, and operates in a vendor environment where one of the major platform vendors has already built relevant coverage. The platform path reduces integration cost. The point-tool path reduces risk of paying for capabilities outside the team’s immediate gap.
What attack techniques specifically target AI agents?
The primary attack techniques are direct prompt injection, where a user manipulates agent instructions through the input field; indirect prompt injection, where malicious instructions are embedded in content the agent retrieves from an external source such as a document or web page; goal hijacking via memory, where an attacker plants false context in the agent’s memory store; and multi-agent propagation, where a compromised sub-agent passes malicious instructions to its orchestrator. Each technique maps to a different control plane for detection and mitigation.
Do large security platforms cover all six control planes adequately?
No current platform covers all six planes with production-ready depth. Palo Alto Networks, SentinelOne, and Cisco each have coverage in two to three planes following their respective acquisitions. The discovery and agent-to-agent communication planes remain underserved by all major platforms. Teams relying solely on a large platform vendor for AI agent security should verify specifically which control planes that vendor’s AI product lines actually address in the current release, not the roadmap.
How is AI-SPM different from AI agent security?
AI-SPM (AI Security Posture Management) focuses on misconfiguration, policy compliance, and visibility into AI assets at a program level. It is closer to CSPM than to runtime security. AI agent security covers the behavioral and runtime layer: what an agent does when it runs, whether it can be manipulated, and whether its tool-call behavior matches its authorized scope. A team needs both, but they address different risks. Posture management finds exposed model endpoints; agent security stops a running agent from exfiltrating data it should not access.
Where This Market Is Likely Heading
The acquisitions of Protect AI, Prompt Security, and Robust Intelligence followed the same pattern that played out in cloud security five years earlier: a cluster of specialist startups attracts platform attention, the platforms acquire two or three of the most differentiated ones, and the remaining independents either raise significant capital to compete as standalone platforms or find buyers. The cloud security parallel is instructive because it took longer than expected for the platforms to absorb the specialists’ capabilities fully. Buyers who assumed a platform acquisition meant instant feature parity learned otherwise.
The segment most likely to produce the next platform-level acquisition is discovery and inventory. It is the control plane that every other plane depends on, it is underserved by current platform offerings, and the technical differentiation is in data model depth and agent framework coverage rather than in AI model sophistication. Those are characteristics that large platforms prefer to acquire rather than build, because the value is in years of integration work rather than in a novel algorithm.
For security and IT leaders working through this budget cycle, the most defensible approach is to treat the six control planes as a gap analysis framework rather than a vendor shopping list. Identify which planes have zero coverage today, which have partial coverage through existing tools, and which are covered but unvalidated. That analysis produces a two or three category answer that guides procurement without requiring a complete understanding of every vendor in the market. The map exists to narrow the decision, not to make every decision visible at once.
