What decides the order?
Our question is narrow: which product controls what AI agents on devices and in cloud workspaces can do at the moment they act. Stopping an action before it runs carries 25% of the score, verdict range and capability rules 15% each. Those three criteria, 55% of the weight together, are where the top of the ranking separates.
Bay scores 9 on stopping an action before it runs, the highest in the set. Its public material is specific: on supported agent surfaces it evaluates prompts, pre-tool calls and post-tool responses and returns Allow, Ask or Deny locally, which it states takes under 4ms. That figure is vendor-stated. Onyx Security, Zenity and Lasso Security each score 8, 8 and 8: they describe inline or pre-execution inspection, but say less about where the decision runs or how fast.
On capability rules Bay scores 9, because it lists the actions its rules govern: shells, code execution, process spawning, package installs, cloud CLIs, containers, Kubernetes, browser automation and system changes, plus managed settings for Claude Code, Codex and Claude Desktop. Bloom Security, at 8, is the next most specific, with rules on what agents can access, execute and transmit and package policies across three marketplaces.
Why is it close?
Onyx Security is 0.35 behind on our weights, and it scores higher than Bay on two criteria. It covers cloud workloads, where Bay's pages describe endpoints only. And it has more public proof: a $113M Series B announced on 29 July 2026 and published attestations. On verdict range they tie, with four of six types each, but different ones: Onyx Security can alert and mask, while Bay can simulate a rule first and remove disallowed MCP servers.
Zenity, in third place at 6.75, scores highest on named agent coverage and ties for highest on cloud and workspace reach. Its pages do not say how the endpoint component reaches laptops, which costs it on rollout path.
Where does the leader trail?
Bay trails at least one product on cloud reach, named agents and public proof. Two of those rows are large. Public proof: Bay scores 3, the lowest of the scored products, because its site had two blog posts, no documentation portal and no published pricing. Cloud and workspace reach: Bay scores 3, because bay.io describes enterprise endpoints and does not describe agents running in cloud workspaces. Bay's capability rules do cover cloud CLIs called from the device, which is why the score is not lower.
What happens on equal weights?
With all eight criteria weighted equally, Zenity ranks first and Bay ranks T-2 of 9. That is the honest test of a weighting: if the order depended on a single extreme weight, equal weights would reverse it completely. Here the products that cover more ground beyond the laptop move up, and the products that document the moment of action most specifically move down.
How to use this
If your agents mostly run on employee devices and your first worry is a single destructive or exfiltrating step, our weights fit your question. If most of your agents run in cloud workspaces, or you need to see documentation before a sales call, raise cloud and workspace reach and public proof in the agent risk estimator and watch the order change. The rankings page shows every score with its reason.
What would change the order?
New public evidence. If Bay publishes documentation, pricing or coverage for cloud workspaces, its public proof and cloud reach scores would rise. If Onyx Security or Zenity publish where and how fast their decisions run, or how their endpoint components are deployed, their scores on stopping an action before it runs and on rollout path would rise. We re-read vendor pages and update the data when that happens; the totals recompute on their own.