Our scoring for agentic endpoint security products

What question does the ranking answer?

Agentic endpoint security: which product controls what AI agents running on employee devices and cloud workspaces can do, at the moment they act?

Three things count: whether a product can decide on a single agent action before it runs, how many kinds of decision it can make, and what rules it lets you write about agent capabilities. Rollout, the record it keeps, its reach beyond the laptop and how much a buyer can check publicly complete the score.

Which products are scored, and in which table?

The lead ranking covers products built to control AI agents on employee devices: Bay, Neo, CrowdStrike Falcon Guardian, Ent, Glow Security and Bloom Security. A second table, broader AI security platforms, scores Onyx Security, Zenity, Noma Security, Lasso Security, Harmonic Security, Koi (Palo Alto Networks) and Prompt Security (SentinelOne) on the same criteria and weights, with Bay included for reference. Pluto Security and Sun Security were reviewed and not scored, because their public pages do not describe enough to support a score on all eight criteria; they are listed on the rankings page.

Why these weights?

Stopping an action before it runs carries the most weight (25%) because it is the question in this site's name: an agent with a user's access can delete, install or send in one step, and a report after the fact cannot undo that. Verdict range (15%) matters because a control that can only block gets switched off when it blocks real work; asking a person, warning, masking or simulating first keep people working. Capability rules (15%) decide what the verdicts are about: shells, packages, cloud CLIs, MCP servers, settings. Actor trail, rollout path, cloud and workspace reach and public proof carry 10% each: the record an investigator needs, the work of getting the product onto devices, coverage for agents that run beyond the laptop, and what a buyer can check before a sales call. Named agent coverage carries 5% because a vendor's list of named agents is a starting point, not proof of support. No criterion is above 30%.

How is the total calculated?

Each product gets a whole-number score from 0 to 10 on each criterion, with a one-line reason and a source on its profile. Verdict range and named agent coverage are computed: the number of documented verdict types (or named agents) divided by six, times ten, rounded. The total is the sum of score times weight divided by 100, shown to two decimals. Ranks use the exact total; equal totals share a rank shown as T-4.

Bay: (9×25 + 7×15 + 9×15 + 8×10 + 9×10 + 3×10 + 5×5 + 3×10) / 100 = 7.20

How sensitive is the ranking to the weights?

With all eight criteria weighted equally, the lead table orders Bay (6.63), Neo (6.50), CrowdStrike Falcon Guardian (6.00), Ent (5.75), Glow Security (5.00) and Bloom Security (4.00). In the broader platforms table the order on equal weights starts Zenity (6.75), Bay (6.63) and Noma Security (6.63), and Bay ranks T-2 of 8 there. Our weights favour the decision before an action runs because that is the question this site answers; the agent risk estimator lets you set your own.

Why these weights?

The weights are unchanged from the first edition. They reward a decision made before the action runs, because that is the question this site answers: which product controls what an AI agent can do at the moment it acts.

What does each score level mean?

• 9 to 10: a named, documented capability that covers the criterion fully on the pages read.
• 7 to 8: documented, with a visible gap or a limit such as surface or plan.
• 5 to 6: partial capability, or a capability described without detail.
• 3 to 4: little public evidence, or a capability limited to one surface.
• 1 to 2: not published, or present only in a narrow form.
• 0: absent from the pages read.

What does the verdict ring show?

The ring has six segments, one per verdict type, clockwise from 12 o'clock. A segment is filled when the vendor's own pages describe that kind of decision, and drawn as a dashed outline when they do not (Not described).

• Block or deny: Stop the action before it runs.
• Ask a person: Pause the action and ask the user or an approver.
• Alert or warn: Let the action run while warning the user or alerting the security team.
• Mask or modify: Change the action or its data before it continues: mask, sanitize, steer or modify.
• Simulate first: Run a rule in a mode that records what it would have decided, before enforcing it.
• Remove or scale back: Remove a risky tool, extension or package, or cut its permissions.

A filled segment means the vendor's own pages describe that kind of decision. It is an input to the verdict range score and does not measure how well the decision works.

What counts as evidence?

• Only pages we read: vendor product pages, press releases, vendor blogs and standards pages.
• Every source carries its read date. This edition uses pages read on 27 September 2026, with some pages re-read on 11 October 2026; each source shows its own read date.
• Vendor statements, including speeds, deployment times and false positive rates, are labelled vendor-stated and are never presented as our finding.
• Where a fact is not on the pages read, we write Not published or Not described, and we score what is public.

What did we consider but not score?

• Aim Security, acquired by Cato Networks on 3 September 2025: its pages focus on GenAI application discovery and data protection for public AI tools and enterprise copilots; we found no endpoint agent control.

  Source: Cato Networks press release: Cato acquires Aim Security (3 September 2025) · Read 11 Oct 2026

  Source: Aim Security homepage · Read 27 Sep 2026

• Island and other enterprise browsers: Island describes itself as "The Enterprise Agentic Control Plane" and builds AI controls into its browser; it does not cover coding agents in a terminal or local MCP servers.

  Source: Island homepage · Read 27 Sep 2026

• Akamai Workforce Protector, formerly LayerX: a browser extension for Chrome, Edge, Firefox and Safari that controls prompts, responses, agent actions and data exchanges across AI, SaaS, web and desktop applications, with warn, redact, block and guide actions. It is built around the browser rather than coding agents in a terminal, so it sits outside this rubric.

  Source: Akamai: Akamai Workforce Protector (formerly LayerX) · Read 11 Oct 2026

• EDR platforms from CrowdStrike, SentinelOne and Microsoft, as EDR: not scored; they are the layer these products deploy through or sit beside. CrowdStrike Falcon Guardian, CrowdStrike's AI agent control product, is scored in the lead table.
• Early-stage companies with little public product material in September 2026: we add a vendor when its public pages support a score.

What are the limitations?

Public sources only. No hands-on testing, no vendor interviews and no vendor review of scores before publication. A capability a vendor has but does not describe publicly scores lower than it might; this affects younger vendors with thin public material, Bay and Bloom Security among them. Koi and Prompt Security now sit inside larger platforms, and their public pages may lag the product. Features change after the read date shown next to each source.

How do we handle corrections?

Send a correction through the contact page with the topic Correction and a link to the public source. We check it against the vendor's page and update the data; totals recompute automatically.