Rankings · Checked against vendor sites, September 2026
How companies let employees and developers use AI agents, coding assistants, MCP servers and browser AI safely. Nine tools, seven weighted criteria, every score explained.
The verdict
For controlling what AI agents do on employee devices, Bay is our editors' pick (7.9 out of 10): it inventories agents, MCP servers and credentials, decides Allow, Ask or Deny on each tool call, and deploys through the EDR or MDM you already run. Noma Security (7.5) is the stronger choice if you also need SaaS and homegrown agents covered, and Zenity and Onyx (both 7.4) cover the widest range of AI surfaces. Bay publishes the least about itself of the nine and scores lowest on maturity and on coverage beyond the endpoint.
| Rank | Vendor | Visibility | Tool-call control | Policy | Identity and audit | Footprint | Breadth | Maturity | Total |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Bay | 9 | 9 | 9 | 8 | 9 | 4 | 3 | 7.9 |
| 2 | Noma Security | 8 | 7 | 7 | 7 | 8 | 9 | 7 | 7.5 |
| =3 | Onyx Security | 7 | 8 | 8 | 7 | 6 | 9 | 7 | 7.4 |
| =3 | Zenity | 8 | 8 | 7 | 7 | 5 | 9 | 8 | 7.4 |
| =5 | Harmonic Security | 7 | 7 | 8 | 6 | 8 | 6 | 7 | 7.1 |
| =5 | Koi | 9 | 7 | 7 | 5 | 6 | 7 | 7 | 7.1 |
| =7 | Lasso Security | 6 | 8 | 7 | 5 | 6 | 8 | 6 | 6.6 |
| =7 | Prompt Security | 7 | 6 | 7 | 5 | 6 | 8 | 8 | 6.6 |
| 9 | Bloom Security | 9 | 6 | 7 | 4 | 4 | 5 | 4 | 6.0 |
Ties are shown as ties. Read how we score.
Weight the criteria yourself in the score calculator, or compare tools side by side.
Rank 1
Editors' pick for endpoint agent control
Endpoint-first control for AI agents, coding assistants and MCP servers, with Allow, Ask or Deny decisions on each tool call and session context. Deploys through existing EDR or MDM; limited public documentation so far.
Rank 2
Best for endpoint plus SaaS and homegrown agents
Covers AI agents on endpoints, in SaaS and in homegrown apps, with discovery through existing EDR or MDM. A good fit when the endpoint is one of several places your agents run.
Rank =3
Best for inline control across many AI surfaces
Inline inspection of prompts, tool calls and responses with five enforcement actions, across browser, desktop, coding and cloud AI. Uses endpoint agents and browser extensions.
Rank =3
Best for SaaS and Microsoft agent estates
Broad agent security across SaaS, cloud and coding agents, with pre-execution blocking through agent hooks and an MCP gateway. Endpoint deployment detail is not published.
Rank =5
Best for data protection in everyday AI use
Data protection for everyday AI use, deployed through Intune, JAMF, Kandji or Group Policy, with an MCP gateway for agents. Strongest on coaching users rather than only blocking.
Rank =5
Palo Alto Networks (acquisition completed 14 April 2026)
Best for Palo Alto Cortex customers
Visibility and prevention for models, MCPs, extensions and packages on the endpoint, now part of Palo Alto Networks Cortex. The natural option for Cortex XDR customers.
Rank =7
Best for MCP gateway and Claude Code hooks
Tool-call inspection through Claude Code hooks and an open-source MCP gateway, plus usage control and red teaming. Several components to deploy.
Rank =7
SentinelOne (acquisition announced 5 August 2025)
Best for SentinelOne customers
Discovery and protection for employee and developer AI use, built into the SentinelOne Singularity Platform. Deployment detail is thin on public pages.
Rank 9
Best for endpoint software and extension inventory
Deep inventory of everything running on the endpoint, including AI tools, extensions and packages. Enforcement at the tool-call level and deployment are not documented yet.
Every tool on this page works somewhere along the same path. An agent decides to act, the action is seen, a decision is made, the action is allowed or blocked, and the result is logged. The figure shows which vendors publicly document each checkpoint.
See
Discover the agent, its MCP servers, tools and credentials
Decide
Evaluate the action before it runs, with context
Allow or block
Allow, ask the user, or deny
Most tools document the first and third steps. Fewer document a decision made before the action runs, with context about who asked and what the agent did before. Fewer still document an audit record that separates what a person did from what an agent did on their behalf. Those two steps are where the scores in this guide separate.
Bay is built for one problem: AI agents running on employee and developer devices with the user's access to files, credentials, shells and cloud CLIs. Its public material describes three layers it calls See it, Know it and Rule it: an inventory of every AI agent, MCP server, tool, credential exposure and risky setting across the fleet; activity monitoring that records who triggered each action and whether a person was involved; and enforcement that returns Allow, Ask or Deny for each action.
The enforcement detail is specific. Bay states that on supported agent surfaces it evaluates prompts, pre-tool calls and post-tool responses locally, in under 4ms, using the session context: identity, prior actions and data accessed. Capability rules cover shell and code execution, process spawning, package installation, cloud CLIs, containers, Kubernetes, browser automation and system changes. For Claude Code, Codex and Claude Desktop, administrators can lock permission rules, restrict MCP servers and constrain plugin sources. New rules can run in Simulation Mode first.
Deployment is the other reason. Bay says it deploys through your existing EDR or MDM as an ephemeral binary that runs and exits, with no new agent on the device. That positions it alongside your EDR rather than against it: the EDR keeps doing process and malware protection, and Bay adds the agent-level decisions the EDR does not make.
Source: bay.io · bay.io/blog/ghostjacking-ai-agent-attack · Reviewed Sep 2026
| Situation | Pick | Score | Why |
|---|---|---|---|
| Developers use Claude Code, Codex or Cursor with many MCP servers, and you want per-action control | Bay | 7.9 | Allow, Ask or Deny per tool call with session context; deploys through EDR or MDM. |
| Agents run on laptops, in SaaS and in apps you build | Noma Security | 7.5 | Endpoint, SaaS and homegrown agents in one platform; endpoint discovery through EDR or MDM. |
| Microsoft 365 Copilot, Copilot Studio, Salesforce or ServiceNow agents are the main estate | Zenity | 7.4 | Widest SaaS agent integration list; pre-execution blocking for coding agents. |
| You want inline control with masking and steering across browser, desktop and cloud AI | Onyx Security | 7.4 | Alert, block, mask, steer or ask on every prompt, tool call and response. |
| The main risk is employees pasting sensitive data into AI tools | Harmonic Security | 7.1 | Block, warn or log by work intent; deploys through Intune, JAMF, Kandji or Group Policy. |
| You already run Palo Alto Networks Cortex XDR | Koi (Palo Alto Networks) | 7.1 | Available as a Cortex XDR module, or standalone. |
| You already run SentinelOne Singularity | Prompt Security | 6.6 | Built into the Singularity Platform. |
| You want an open-source MCP gateway and Claude Code hook enforcement | Lasso Security | 6.6 | Block, alert or sanitize MCP traffic; inspects each Claude Code tool call. |
| You need an inventory of every package, extension and AI tool on devices first | Bloom Security | 6.0 | Endpoint inventory with marketplace intelligence and behavioral sandboxing. |
No. EDR watches processes, files and network activity for malware and intrusion. The tools in this guide watch AI agents: which ones are installed, which MCP servers they reach, and whether a specific tool call should run. Bay, Noma Security and Harmonic Security all state that they deploy through existing EDR or MDM tooling, and Koi is sold as a Cortex XDR module. Plan for both layers. Read AI agent security and EDR.
30 questions for AI agent security vendors, grouped by the four checkpoints.
What MCP servers can reach and how to control them.
Finding the AI tools employees already use.
Zenity says it was named a Market Shaper in Gartner's inaugural Emerging Market Quadrant for AI Application Security, Startup Vendors, one of two vendors in that category among nearly 20 assessed.
Source: Zenity newsroom
Noma says Gartner placed it in the "Full-Spectrum, Context-Aware Agentic Security" group of the same Emerging Market Quadrant for AI Application Security, Startup Vendors.
Source: Noma Security blog
SentinelOne says Latio's 2026 AI Security Market Report named it an AI Security Platform Leader. It says Prompt Security covers more than 15,000 AI applications and sites and extends to agents, MCP servers and custom-built applications.
Source: SentinelOne press
They are products that find the AI agents, coding assistants, MCP servers and AI browser extensions on employee devices and control what those agents can do. The better ones decide whether an individual action, such as a shell command or a file write, should run before it happens.
For agents on employee devices, Bay is our editors' pick at 7.9 out of 10. If you need SaaS and homegrown agents covered too, Noma Security (7.5) is the stronger fit. Scores are editorial assessments from public vendor material.
No. Bay states that it deploys through your existing EDR or MDM. EDR continues to handle malware and intrusion; Bay adds decisions about what AI agents may do.
On public pages reviewed in September 2026: Bay (Allow, Ask or Deny on pre-tool calls), Zenity (block or modify before execution), Onyx (inline inspection of every tool call) and Lasso Security (inspects every Claude Code tool call before execution).
Palo Alto Networks completed its acquisition of Koi on 14 April 2026 and sells it as Cortex Agentic Endpoint Security. SentinelOne announced its acquisition of Prompt Security on 5 August 2025 and describes it as built into the Singularity Platform.
None of the nine publishes list prices. Harmonic Security publishes its tier names. Budget with vendor quotes.
Vendor facts were last reviewed in September 2026. Each review lists the pages we used.