Why we count verdicts
A control on AI agents is only as useful as the decisions it can make. If its only answer is no, it will block legitimate work on its first day, and the people blocked will look for a way around it. The more kinds of decision a product can make, the more often a security team can say yes with conditions. That is the idea behind our verdict range criterion, worth 15% of the score.
The criterion is computed, not judged. For each vendor we read the product pages and record which of six verdict types they describe, in their own words. The score is the count divided by six, times ten, rounded.
The six types
Block or deny stops the action. Ask a person pauses it and asks the user or an approver. Alert or warn lets it run while telling someone. Mask or modify changes the action or its data before it continues. Simulate first runs a rule without enforcing it, to see what it would have done. Remove or scale back takes away a risky tool or cuts its permissions.
Vendor by vendor
Onyx Security lists five enforcement actions: alert, block, mask, steer, or ask. That covers four of our six types, tied for the most in the set.
Bay describes three verdicts on each action, Allow, Ask or Deny, a Simulation Mode in which new rules run before enforcement, and MCP Control that removes disallowed MCP servers in Enforcement mode. That is four of six: block, ask, simulate and remove. Bay is the only vendor whose pages describe a simulation mode.
Lasso Security's MCP gateway can block, alert or sanitize, and its usage control masks sensitive data before prompts reach third-party models. Three of six.
Zenity describes blocking or modifying a dangerous tool call before it executes: two of six. Harmonic Security describes blocking in real time, warning the employee with context or logging silently: two of six. Koi, now part of Palo Alto Networks, describes stopping malicious actions and one-click removal of insecure packages, extensions and AI tools: two of six. Bloom Security describes blocking risky packages and skills and removing risky tools, revoking permissions and scaling back overpermissioned MCP servers: two of six.
Prompt Security describes preventing prompt injection and data leakage, and its browser extension inspects and redacts prompts: two of six. Noma Security documents blocking on the pages we read: it describes blocking unauthorized and malicious agents and stopping risky behavior at runtime.
What the census shows
Two gaps stand out. Asking a person is documented by only two of nine products, although it is the verdict that best fits the actions that are sometimes right and sometimes wrong, such as a force push or an install from an unfamiliar registry. And only one product documents a simulation mode, although every new rule benefits from one.
What the census does not show
A verdict on a vendor page is a description. It does not tell you how the verdict appears to the user, whether it applies to every agent the product supports, or how often it fires. Two products with the same count can feel very different in use. Treat the census as a way to build a shortlist and to write your demonstration script: name the verdicts you need, and ask each vendor to show them on your agents.
Why the count matters for adoption
Security teams in this category are usually asked to make agent use safe, not to stop it. Verdicts other than block are how that happens in practice: a developer asked to confirm a destructive command keeps working; a prompt with a customer record masked still gets an answer. When you compare products, the verdict ring on each profile is the quickest place to see this.