Mapping the Market: What the Agentic AI Security Vendor Landscape Actually Covers (And What It Doesn't)

TBDCyber | Agentic AI Security Series

This is our ninth article in our Agentic AI Security series.

Our first two articles discussed the problem framework (see The 45 Billion Identity Problem Nobody Is Talking About and The Identity Paradox: Why Agentic AI Breaks IAM by Design). Articles 3 and 4 mapped internal and external agent risk (Shadow AI Is Already Here And Your Security Team Doesn't Know It and The Vendor in Your Environment You Didn't Hire: Third-Party Embedded AI Risk).

In our fifth and sixth articles (Who Governs the Agents You Didn't Build? The Platform Vendor Conflict of Interest and When Your Employee's AI Becomes Your Liability: The Bring Your Own Agent Problem), we examined the governance accountability gaps created by platform vendor limitations and personal AI tool use.

Articles 7 and 8 addressed the accountability consequences: forensic ungovernability (The Audit Trail That Isn't: Why Agentic AI Incidents Are Forensically Ungovernable) and the failure of financial risk transfer (Your Cyber Policy Probably Doesn't Cover This: The Agentic AI Insurance Gap).

This article maps the emerging vendor landscape. We discuss what each category covers, what it structurally cannot cover, and how to approach building a governance stack using components designed for different problems.

***

Security leaders evaluating the agentic AI governance market face a recurring frustration: every vendor claims to address the problem, yet no one covers it completely.

The vendor landscape responding to agentic AI identity governance is, with few exceptions, organized around incumbent commercial strength rather than the shape of the problem itself. Each major vendor category is bringing its established approach (its tooling, its mental model, and its existing customer relationships) to bear on a challenge that does not map cleanly onto any single discipline. The coverage gaps left by each category's approach are structural, reflecting the limits of each vendor's heritage domain.

This is the starting point for any evaluation of the market: no single vendor category covers the full governance challenge. Organizations deploying agentic AI at scale should plan for a multi-vendor posture for the foreseeable future and should be skeptical of any single vendor claiming comprehensive coverage.

How Each Vendor Category Sees the Problem

PAM and Privileged Access Management vendors. CyberArk, BeyondTrust, and other PAM vendors approach agentic AI through the lens of privileged account governance. In their framing, agents are a new class of privileged non-human identity. Govern them as you would a service account: least privilege, zero standing privilege, vault credentials, audit activity.

PAM controls for agent credentials reduce the blast radius when credentials are compromised, and zero-standing privilege for agent access is the right architectural direction for high-risk deployments. However, PAM tooling was not designed to address prompt injection (the attack that weaponizes an agent's legitimate credentials against the agent). It also has no mechanism for reasoning-trace capture or delegation-chain attribution. It governs the credential, not the agent that holds it, and those are different problems.

IGA and Identity Governance vendors. SailPoint, Saviynt, Veza, and similar IGA vendors bring the joiner-mover-leaver logic to non-human identities. Agents need owners, access certifications, and lifecycle governance. SailPoint's Agentic Fabric, launched May 2026 and significantly strengthened by the Entro Security acquisition completed June 29, 2026, is the most direct IGA response to the problem: dedicated AI agent discovery and governance with an identity graph for attribution. Okta for AI Agents, which became generally available in April 2026, provides agent registration as first-class directory identities with shadow-agent detection.

The IGA lens produces the right answers on lifecycle and ownership. Its gaps are at the behavioral and forensic layer: access certification tells you what an agent is authorized to do, not what it is actually doing, and IGA platforms were not designed to capture or analyze agent reasoning at execution time.

NHI-specific vendors. Oasis Security, Astrix Security, and until recently Entro Security have emerged specifically to address the non-human identity discovery and credential lifecycle problem that predates agentic AI. Oasis covers NHI security across IaaS, SaaS, PaaS, and on-premises environments, including Copilot, ChatGPT, and Salesforce agents. Astrix provides API and service account discovery with agentic identity coverage.

The most significant recent development in this category is the consolidation it signals. On June 29, 2026, SailPoint completed its acquisition of Entro Security for approximately $200 million. Entro, named a Gartner Cool Vendor in 2025 for its continuous NHI discovery capabilities including AI agents and MCP servers, is being natively integrated into SailPoint's Agentic Fabric platform. The acquisition is a meaningful consolidation move: SailPoint now has a credible claim to both IGA lifecycle governance and purpose-built NHI discovery in a single platform. Whether the integration delivers on that promise, or produces the complexity that typically follows acquisitions of this type, will be worth watching closely over the next twelve months.

These vendors have the most agentic-native discovery posture of the incumbent-adjacent category. Their shared limitation is breadth of coverage: strong in credential lifecycle and shadow agent discovery, less developed in behavioral monitoring, delegation chain governance, and regulatory compliance mapping.

CNAPP and cloud security vendors. Wiz (acquired by Google in March 2026), Palo Alto Prisma, and Orca Security address agentic AI as a cloud workload security and entitlement problem. Cloud Identity Entitlement Management (CIEM) capabilities provide visibility into what cloud-hosted agents can access, and workload identity federation addresses how agents authenticate to cloud resources. The detection coverage for behavioral anomalies is real but immature for agentic workloads: these platforms have agentic behavioral baselines in development, not in production, and the false-positive risk for early deployments is significant. The Wiz acquisition is worth noting from a governance standpoint: Wiz's CNAPP and CIEM capabilities now sit within Google's cloud ecosystem, which raises the same platform-vendor conflict-of-interest question we examined in Article 5. An organization running multi-cloud workloads across AWS, Azure, and GCP should factor that context into how they weigh Wiz's neutrality as an independent governance layer.

AI-native security vendors. Lakera Guard, Lasso Security, and Protect AI (now part of Palo Alto) address the attack surface that no incumbent category was designed for: the semantic layer. Prompt injection, memory poisoning, RAG manipulation, tool misuse. These are agentic-specific threats that cannot be addressed through credential controls, access certification, or network monitoring. The semantic layer is where the Identity Paradox is most acute in practice (the attack that arrives as data and weaponizes the agent's authorized access), and this vendor category is the only one currently addressing it directly.

The structural gap is the mirror image of the IGA gap: strong in semantic-layer defense, but limited in identity lifecycle governance, access certification, and regulatory compliance mapping.

Platform vendors. ServiceNow, Microsoft, Salesforce, and AWS govern agents within their own ecosystems. ServiceNow's Agent Control Tower, Microsoft Purview's Copilot integration, Salesforce's Agentforce governance controls, and AWS AgentCore with Cedar policy enforcement each provide meaningful visibility and control within their respective perimeters. As we examined in Article 5, those perimeters are the limit of their governance and the conflict of interest inherent in vendor-as-governor cannot be resolved by any feature addition.

Purpose-built forensics is, as of mid-2026, essentially a single-vendor category. Vorlon's AI Agent Flight Recorder, launched at RSAC 2026, provides forensic reconstruction of agent activity across SaaS, cloud, and API integrations. This addresses the gap we described in Article 7 more directly than any other available tool. However, this is a new solution with several limitations: a very early deployment base, narrow organizational experience at scale, and the reasoning trace standard problem remains unsolved.

The Frontier Labs: A Different Kind of Governance Actor

Frontier model labs (Anthropic, OpenAI, Google, Meta) occupy a position in the governance stack that no other vendor category does. Every other vendor governs agents from the outside: wrapping controls around systems they did not build. The labs govern agents from the inside, through the model itself, the runtime it executes in, and the protocols that define how it interacts with tools and other agents.

This is a qualitatively different position. Anthropic's model specification, OpenAI's safety training, and Google's model-layer constraints are authorization controls in the functional sense. They define what an agent will and will not do, regardless of what credentials it holds or what external policy is applied on top of it. They also define the protocol architecture: MCP (Model Context Protocol) and A2A (Agent-to-Agent) are the emerging infrastructure for how agents authenticate to tools and how delegation is communicated. How those protocols evolve will shape what is governable across the entire ecosystem.

Three structural limitations constrain the lab governance contribution. First, there is no cross-lab interoperability. Governance investments made by Anthropic are effective for Claude-based agents; they do not extend to GPT-based or Gemini-based agents in the same enterprise deployment. The multi-model enterprise (which in our experience is most enterprises) benefits only from what is interoperable across all model providers, which today is almost nothing. Second, the commercial conflict of interest identified in Article 5 for platform vendors applies with greater force to frontier labs. Labs calibrate their safety measures to be compatible with broad deployment, rather than imposing the constraints an independent security function would apply. Third, the concentration risk is systemic in a way that has no precedent in traditional vendor risk: a behavioral drift or safety regression at a major lab simultaneously affects every enterprise running that model.

The Five Gaps No Vendor Currently Addresses

Across all vendor categories, including the frontier labs, five governance challenges remain structurally unaddressed. Security leaders building their governance stack should understand which of these gaps their posture leaves open, as none of the available vendors currently address them.

Cross-organizational agent trust. No vendor provides a mechanism for verifying the identity, delegated authority, or behavioral constraints of an agent arriving from another organization. Any cross-organizational agent interaction today occurs on implicit trust, regardless of what governance controls either organization has deployed. W3C Decentralized Identifiers and Verifiable Credentials provide the conceptual infrastructure, but enterprise-scale adoption is lacking.

Reasoning trace standards. No vendor provides a forensic-grade reasoning trace  (capturing intermediate decision steps in a tamper-evident, legally defensible format) as a standard enterprise governance artifact. Vorlon addresses ecosystem-level action logging; it does not address the model's internal reasoning. No agreed format exists, and no lab has committed to providing this.

BYOA governance. As we examined in Article 6, no vendor provides comprehensive governance of personal AI assistants used by employees for work purposes. The personal agent operating invisibly within an employee's sessions is ungoverned because no current technical control can address it.

Semantic attestation across labs. For a multi-model enterprise, what is needed is cross-lab interoperable attestation. A standard format by which any model provider can attest that a specific agent is running an authorized configuration, in a form that any enterprise governance platform can verify. No such standard exists, and the competitive dynamics of the frontier lab market make voluntary convergence unlikely in the near term.

Multi-model governance interoperability. There is no unified framework for governing an agent estate that spans multiple foundation model providers. Audit logs, behavioral baselines, attestation formats, and incident response obligations are all provider-specific. The governance complexity of a multi-model enterprise is multiplicative, not additive.

For a detailed mapping of each governance challenge to available vendor solutions, standards frameworks, and maturity assessments, download TBDCyber's companion reference table: Agentic AI Identity Governance: Challenge-to-Framework and Vendor Mapping. It covers all major challenge categories across identity lifecycle, authorization, forensics, and regulatory compliance, and is designed as a working reference for security architects and procurement teams evaluating their governance stack.

How to Think About Building a Governance Stack

Given the fragmented market and the structural gaps that persist regardless of vendor selection, the practical question is how to build a governance posture that is effective with available tools while being clear-eyed about what it does not yet cover.

Start with discovery, not tooling selection. The foundational governance requirement, knowing which agents exist, who owns them, what access they hold, and which platforms they operate on, precedes every other capability. An IGA platform that governs registered agents provides no value against agents it does not know exist. Discovery capability that operates at the platform layer (not just the identity directory) is the prerequisite for everything else.

Layer by governance dimension, not by vendor category. The full governance challenge spans discovery, lifecycle, credential security, behavioral monitoring, forensic attribution, and regulatory compliance. No single vendor covers all of these. Build your stack by identifying the vendor that best addresses each dimension, rather than seeking a single platform that promises comprehensive coverage. The likely architecture is: an IGA or NHI platform for lifecycle and inventory management; a PAM tool for privilege controls; CNAPP or a purpose-built NHI vendor for cloud entitlement and shadow discovery; semantic-layer tooling for prompt-injection defense; and forensic capabilities for incident-response readiness.

Treat platform-native governance as a configured component, not a default. As noted in Article 5, platform governance tools require explicit configuration to deliver value. For each major platform in your environment, assign ownership of the governance configuration within the security function, and treat unconfigured platform governance as an open gap rather than a closed one.

Monitor protocol development as a governance signal. MCP and A2A protocol evolution will shape what is governable. Changes to how agents authenticate to tools, how delegation is recorded, and what audit data protocol interactions generate have direct implications for your forensic readiness and regulatory posture. This is a technical standards question that belongs in the security function's monitoring portfolio, not just the development team's.

Apply proportionate skepticism to comprehensive coverage claims. The five structural gaps above are a useful test for any vendor claiming comprehensive coverage of agentic AI governance. Ask specifically which of those gaps their product addresses and how. A vendor that cannot answer that question clearly has not yet built a solution to the hardest parts of the problem.

***

The market will mature. Purpose-built vendors will expand their coverage. Protocol standards will develop. IGA and PAM platforms will deepen their agentic capabilities. The organizations that navigate this period most effectively will not be those waiting for a comprehensive single-vendor solution before acting. They will be the ones who build what is buildable now (discovery, lifecycle, credential controls, configured platform governance) while maintaining a view of where the residual exposure lies and communicating it clearly to the board.

Going deeper: The vendor analysis in this article is drawn from TBDCyber's full challenge-to-framework and vendor mapping research. The companion reference table provides a structured, challenge-by-challenge view of available vendor solutions, formal standards, and practitioner frameworks. It was designed for security architects and IAM teams building their agentic AI governance stack. Download the full vendor mapping table.

This is the ninth article in TBDCyber's series on agentic AI identity governance. Our final article pulls the series together into a practical pre-renewal checklist: the five questions every CISO should ask before signing the next AI platform contract.

TBDCyber advises security leaders on identity governance, agentic AI security, and emerging threat architectures. To discuss what this means for your organization, contact us.