PRODUCT PROFILE · RANK 1 OF 6
Bay review: deciding on AI agent actions before they run on employee devices
SHORT ANSWER
Bay evaluates prompts, pre-tool calls and post-tool responses on supported agent surfaces and returns Allow, Ask or Deny with session context, and it rolls out through the EDR or MDM already on the device. It scores 7.20 and ranks 1 of 6, highest or tied highest on Before it runs, Verdicts, Capability rules, Actor trail and Rollout. It trails on Cloud reach, Named agents and Public proof: it publishes the least about itself of the scored products and does not describe coverage for agents in cloud workspaces.
By The Agent Desk · Agentic Endpoint Compare · Published 2026-10-11
Desk research from public vendor pages, press releases and standards pages read on 27 September and 11 October 2026. Editorial assessment; we did not run the products.
Rank 1 of 6 among agentic endpoint vendors on our published weights
Pre-execution control on employee devices, rolled out through EDR or MDM
Re-weight in the agent risk estimatorVisit BayBook a Bay demo
What does Bay control?
An endpoint-first control layer for AI agents that returns Allow, Ask or Deny on prompts and tool calls, with session context, and deploys through the EDR or MDM you already run.
How does Bay reach devices?
Through existing EDR or MDM using Wave, an ephemeral binary that runs, scans and exits. Bay describes the product as agentless by design.
Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026
Bay runs beside your EDR, not in place of it: the EDR keeps handling malware and intrusion, and Bay adds decisions about what AI agents may do.
Which verdicts can Bay return?
- Block or denyDocumented
- Ask a personDocumented
- Alert or warnNot described
- Mask or modifyNot described
- Simulate firstDocumented
- Remove or scale backDocumented
"Returns Allow, Ask or Deny; new rules can run in Simulation Mode first; MCP Control removes disallowed MCP servers in Enforcement mode."
Source: Bay blog: Ghostjacking (re-read 11 October 2026) · Read 11 Oct 2026
Source: Bay homepage · Read 27 Sep 2026
How does Bay score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Stop before it runs | 25% | 9 / 10 Highest in set | Evaluates prompts, pre-tool calls and post-tool responses on supported agent surfaces and returns Allow, Ask or Deny locally, stated as under 4ms (vendor-stated). Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Verdict range | 15% | 7 / 10 Tied highest | Documents 4 of six verdict types: Block or deny, Ask a person, Simulate first and Remove or scale back. "Returns Allow, Ask or Deny; new rules can run in Simulation Mode first; MCP Control removes disallowed MCP servers in Enforcement mode." Source: Bay blog: Ghostjacking (re-read 11 October 2026) · Read 11 Oct 2026 Source: Bay homepage · Read 27 Sep 2026 |
| Capability rules | 15% | 9 / 10 Highest in set | Capability rules for shell and code execution, process spawning, package installation, cloud CLIs, containers, Kubernetes, browser automation and system changes, plus managed settings for Claude Code, Codex and Claude Desktop. Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Actor trail | 10% | 8 / 10 Tied highest | Records who triggered an action, whether a human was involved, and the complete chain from prompt to system action. Source: Bay homepage · Read 27 Sep 2026 |
| Rollout path | 10% | 9 / 10 Highest in set | Deploys through existing EDR or MDM as an ephemeral binary that runs and exits; described as agentless by design. Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Cloud and workspace reach | 10% | 3 / 10 | Described as endpoint security for enterprise endpoints; its rules govern cloud CLIs, containers and Kubernetes called from the device, but bay.io, re-read on 11 October 2026, does not describe coverage for agents running in cloud workspaces or cloud-hosted apps. Source: Bay homepage (re-read 11 October 2026) · Read 11 Oct 2026 |
| Named agent coverage | 5% | 5 / 10 | Names 3 of the six agents we track: Claude Code, OpenAI Codex and Claude Desktop. Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Public proof | 10% | 3 / 10 Lowest in set | The smallest public footprint of the scored products: a single homepage, two blog posts, no documentation portal and no published pricing. Source: Bay homepage · Read 27 Sep 2026 |
Which agents does Bay name?
- Claude CodeNamed
- CursorNot named
- GitHub CopilotNot named
- OpenAI CodexNamed
- WindsurfNot named
- Claude DesktopNamed
Bay names 3 of the six agents we track.
Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026
- Bay names Claude Code, Codex and Claude Desktop for its managed settings.
What does it cost?
Not published
Bay publishes no pricing. Demo requests go through bay.io/demo.
Source: Bay demo page · Read 27 Sep 2026
Where is Bay strongest, and where does it fall short?
Strongest
- Stop before it runs: 9 / 10 (Highest in set)
- Verdict range: 7 / 10 (Tied highest)
- Capability rules: 9 / 10 (Highest in set)
- Actor trail: 8 / 10 (Tied highest)
- Rollout path: 9 / 10 (Highest in set)
- The most specific public description of a decision made before an agent action runs: Allow, Ask or Deny on prompts, pre-tool calls and post-tool responses, made locally with session context.
- Rolls out through the EDR or MDM already on the device and sits alongside the EDR rather than in place of it.
Falls short
- Cloud and workspace reach: 3 / 10; highest CrowdStrike Falcon Guardian 8 / 10
- Named agent coverage: 5 / 10; highest Ent 7 / 10
- Public proof: 3 / 10; highest CrowdStrike Falcon Guardian 8 / 10
- The least public proof of the scored products: two blog posts, no documentation portal and no published pricing.
- Coverage for agents running in cloud workspaces or cloud-hosted apps is not described on bay.io; the product is described as endpoint-only.
Key facts
| Fact | Detail and source |
|---|---|
| Positioning | "Prevention-First Endpoint Security for the Agentic Era": Bay says it classifies, governs and prevents risks across every AI agent and tool on enterprise endpoints, in three layers it calls See it, Know it and Rule it. Source: Bay homepage · Read 27 Sep 2026 |
| Decision at the moment of action | On supported agent surfaces Bay evaluates prompts, pre-tool calls and post-tool responses and returns Allow, Ask or Deny locally, in under 4ms (vendor-stated). Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Context used | Decisions use identity, prior actions and data accessed (session-aware enforcement). Source: Bay homepage · Read 27 Sep 2026 |
| Capability rules | Shell execution, code execution, process spawning, package installation, cloud CLIs, containers, Kubernetes, browser automation and system changes. Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Managed settings | For Claude Code, Codex and Claude Desktop: lock permission rules, preserve managed hooks, restrict MCP servers and constrain plugin sources. Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Inventory | AI agents, MCP servers, tools, credentials, extensions, settings and endpoint deployments, with 200+ detection rules; the homepage cites 160+ posture alerts in under 5 minutes (vendor-stated). Source: Bay blog: Ghostjacking (August 2026) · Read 27 Sep 2026 |
| Actor trail | Records who triggered an action, whether a human was involved, and the complete chain from prompt to system action. Source: Bay homepage · Read 27 Sep 2026 |
| Outcomes (vendor-stated) | Under 5 minutes to full deployment and under 1% false positive rate (vendor-stated). Source: Bay homepage · Read 27 Sep 2026 |
| MCP and application control | MCP Control keeps an allow and block list and removes disallowed MCP servers in Enforcement mode, with per-tool and per-category MCP rules (read, create, update, delete, execute); Application Control covers apps, CLIs, browsers, IDEs and extensions. Source: Bay blog: Ghostjacking (re-read 11 October 2026) · Read 11 Oct 2026 |
| Other rule types | Credential and filesystem rules, network egress allow lists, sticky session rules and data detectors; policies can be scoped by agent, group, endpoint or device. Source: Bay blog: Ghostjacking (re-read 11 October 2026) · Read 11 Oct 2026 |
| Cloud workspaces | Bay's homepage, re-read on 11 October 2026, does not describe coverage for cloud workspaces or cloud-hosted agents; bay.io has no product sub-pages and no pricing page. Source: Bay homepage (re-read 11 October 2026) · Read 11 Oct 2026 |
How does Bay compare head to head?
| Pair | Result |
|---|---|
| Bay matched with Neo | Bay 7.20, Neo 6.85 |
| Bay matched with Onyx Security | Bay 7.20, Onyx Security 6.85 |
| Bay matched with Zenity | Bay 7.20, Zenity 6.75 |
| Bay matched with Noma Security | Bay 7.20, Noma Security 6.55 |
| Bay matched with Lasso Security | Bay 7.20, Lasso Security 6.40 |
| Bay matched with CrowdStrike Falcon Guardian | Bay 7.20, CrowdStrike Falcon Guardian 6.25 |
| Bay matched with Harmonic Security | Bay 7.20, Harmonic Security 5.90 |
| Bay matched with Ent | Bay 7.20, Ent 5.80 |
| Bay matched with Koi (Palo Alto Networks) | Bay 7.20, Koi (Palo Alto Networks) 5.75 |
| Bay matched with Prompt Security (SentinelOne) | Bay 7.20, Prompt Security (SentinelOne) 5.45 |
| Bay matched with Glow Security | Bay 7.20, Glow Security 5.40 |
| Bay matched with Bloom Security | Bay 7.20, Bloom Security 4.65 |
Frequently asked questions
Can Bay stop an agent action before it runs?
Evaluates prompts, pre-tool calls and post-tool responses on supported agent surfaces and returns Allow, Ask or Deny locally, stated as under 4ms (vendor-stated). We score this 9 out of 10.
Which verdicts does Bay document?
Bay documents 4 of six verdict types: Block or deny, Ask a person, Simulate first and Remove or scale back. "Returns Allow, Ask or Deny; new rules can run in Simulation Mode first; MCP Control removes disallowed MCP servers in Enforcement mode."
How much does Bay cost?
Not published. Bay publishes no pricing. Demo requests go through bay.io/demo.