Why the path matters
Every new piece of software on a laptop has a cost: a security review, a change window, a support queue and one more thing that can break. Security teams that have spent years consolidating endpoint agents are reluctant to add another. The rollout path also shapes what the product can see: a browser extension sees browser AI, not a coding agent in a terminal.
Through the EDR you already run
Some products deploy through the EDR platform already on the device. Bay states that it deploys through existing EDR or MDM using Wave, an ephemeral binary that runs, scans and exits, and describes itself as agentless by design. Noma Security states that it discovers endpoint agents through existing EDR or MDM with no new endpoint agent to deploy. This path is the fastest to approve because nothing new stays resident.
Through MDM
Mobile device management tools such as Intune, JAMF and Kandji push software and settings to managed devices. Harmonic Security states it rolls out through Intune, JAMF, Kandji or Group Policy. MDM is also how managed settings for coding agents are usually distributed, which matters for the next lesson on capability rules.
As a resident agent or module
Some products install their own component that stays on the device. Koi is offered as a Cortex XDR module or as a standalone agent-based offering, which is the lowest-friction path for Cortex customers and a separate agent for everyone else. Onyx Security works across endpoint agents, browser extensions, APIs and gateways.
As an extension or a gateway
Browser extensions cover AI used in the browser. Proxies and gateways cover traffic that passes through them, such as calls to a model API or to MCP servers. Lasso Security combines a browser extension, proxy integrations, an MCP gateway and Claude Code hooks. Gateways are strong for MCP traffic and model calls; they do not see a shell command that never leaves the device.
How we score it
The rollout path criterion is 10% of our score. We give the most credit to products that deploy through tools you already run without a new resident agent and publish how, and the least to products whose deployment method is not published. Zenity and Bloom Security score lower here because their pages do not say how the endpoint component is installed.
Questions to ask
- What exactly runs on the device, for how long, and with what privileges?
- Which of our EDR and MDM tools are supported today?
- Which agent actions does each component see, and which does it miss?
- What happens on a device where the component is missing or broken: does the agent run uncontrolled?