Governing Citizen-Developed AI Agents

7 min read

There is no credible agent runtime security vendor yet. The absence of a category leader is the finding, and it means runtime controls must come from architecture, not procurement.

What this category solves (and what you did before it)

For this category, “before it” and “now” are the same period. The promised product detects and blocks agent misbehaviour as it happens: an injected instruction being acted on, a privilege used outside its purpose, a tool chain nobody authorized. What firms did before it is what they still do: sandboxes, egress rules, scoped credentials and logs assembled in-house.

What actually differentiates products

Nothing demonstrated in production separates the contenders, so hold candidates against criteria rather than a ranking. One useful frame comes from the research: runtime defences split into prompt-level approaches, which use learned detectors whose policies a human cannot really read or manage, and system-level approaches, which enforce control-flow integrity with interpretable policies at a higher instrumentation cost. That taxonomy comes from authors who built a system-level tool and evaluated it on two applications they wrote themselves, so the frame travels further than the verdict.

An interception layer only governs the traffic it can see. That is the question that actually matters, and the two leading implementations answer it badly in the same way. Microsoft’s real-time agent protection evaluates tool invocations through its own tooling-server layer, and agents that use unsupported tools or skip that layer are not covered. The best-funded startup in the category sits, by deliberate design, between users and models; its founder’s stated reason is to occupy a layer the model labs cannot easily absorb. Same architecture, same hole: an agent that routes around the chokepoint is invisible to it. Two independent vendors’ own documentation establishes this, and it is the single most important thing to know about the category.

Three questions to put to any candidate: does it see path-level context or only individual calls; can it enumerate and follow sub-agents; and does “block” integrate with revocation, or does it mean only “stop this one call”?

Tier

Practice-only. Track it, pilot nothing critical on it, and spend the budget on architectural controls that outlast the startups selling this one.

Named examples

There is no anchor to name. That absence is the finding rather than a gap in our research.

Microsoft Defender for Agent 365 is the largest incumbent effort and the most concrete. Two details matter more than the marketing. Its built-in rule is audit-only: it records behaviour without stopping anything, and blocking requires an admin-authored custom rule scoped to specific detection types. And when a blocking rule does cover an agent, near-real-time alerting for that agent stops, so the choice is between seeing and stopping. (As of the July 2026 documentation; this product’s status has changed within weeks before, so date any claim made about it.)

We could find no independent benchmark or evaluation of any product in this category. WitnessAI is the funding marker: $58M announced 13 January 2026, led by Sound Ventures, on company-stated ARR growth “over 500%” with no base disclosed, at Series B. Its announced agent capabilities are vendor claims no third party has tested: monitoring which agents run and which MCP servers they reach, blocking injection before it reaches the agent.

DeepKeep is the one name here selling something that does not depend on sitting in the traffic path. Its AI Agent Scanner, announced 3 March 2026 and offered free to enterprises, maps an agent’s attack surface before deployment: every model, tool, integration and component in the execution path, where prompts flow, where tools are invoked, and which paths are exploitable, scored against the OWASP Top 10 for Agentic Applications and returned as a remediation playbook. Stated coverage is Microsoft’s agent frameworks, Agentforce, OpenAI Agents, CrewAI, Amazon Bedrock AgentCore, n8n and Make. A static map of what an agent can reach is the input the architectural controls need and something an agent registry entry can be checked against, so it earns its place at zero enforcement value. The rest of the platform is a conventional AI-security suite: posture scoring, model scanning, red teaming, and an AI firewall whose runtime guardrails cover “select” agentic frameworks, which puts that half back inside the coverage problem above. DeepKeep was founded in 2021 in Tel Aviv and raised a $10M seed led by Awz Ventures. Its site footer carries ISO 27001, ISO 9001, SOC 2 and GDPR badges, with no trust centre, no report and no Type I or Type II marking on the SOC 2 badge, so those certifications are asserted rather than evidenced.

The MCP-security corner is more telling. Its notable artifacts are one benchmark paper finding that existing protections stop under 30% of attacks on average, one preprint whose proposed extension is named differently in its arXiv record than in the circulating PDF, and one solo researcher’s advisory site. A naming collision inside a four-item field is a fair summary of its maturity.

The most-cited formal framework for runtime governance is a 2026 preprint whose only implementation is a startup owned by two of its three authors, and whose own abstract concedes that its policy scores are severity indicators rather than probabilities calibrated against observed violation rates.

The enterprise bar

Apply it anyway, and expect most contenders to clear less than half: SOC 2 Type II, ISO 27001, deployment mode, SSO and SCIM, RBAC, environment separation, exportable audit logs, zero retention, no-training terms, audit rights, viability and exit path. Here the last one dominates. A company one funding round deep is asking to sit in the enforcement path of a firm’s agents, which makes the exit path the main term rather than a formality.

Add one category-specific question: what fraction of our agent traffic does this product actually see, and how would we know if that fraction dropped?

M&A state and category maturity

Pre-consolidation, seed to Series B, nobody occupying the anchor position. The clearest evidence is rhetorical: the category’s most prominent founder pitches it by analogy — CrowdStrike in endpoint, Splunk in SIEM, Okta in identity — while saying he intends to build an independent leader rather than sell. Those analogies get reached for precisely because no equivalent exists here yet. Both that quote and its supporting one come from the company’s chief executive and a partner at its own investor, in a single article; the structural evidence above is what carries the finding.

Assume acquisition or death within a typical contract term, and write the exit path first.

One artifact of the hype is worth naming so it can be dismissed in a meeting. A widely-syndicated forecast puts AI security software at $800 billion to $1.2 trillion by 2031. Gartner put all worldwide end-user information-security spending at roughly $213 billion in 2025. The low end of that forecast is several times the entire current security industry, for one segment, five years out. We could not locate the analyst, firm, report or methodology; every occurrence traces to a single uncited sentence in one news article.

Where the category is immature

Everywhere, and specifically: no product monitors multi-agent cascades; none has published an independent evaluation; the incumbent ships audit-only; and every architecture here depends on seeing traffic it cannot compel agents to route through. Until one of those changes, the controls that work are the ones in sandboxing and egress control: architectural, unglamorous, and already in hand.

See also

Graph View

Backlinks