What 19 AI endpoint products say about unmanaged devices

What did we look for?

For each product, we recorded how it reaches devices and whether its pages mention personal devices, contractor machines or bring-your-own-device programmes. The finder needs this because one of its seven questions asks whether the devices people use for AI are managed, mixed or mostly unmanaged.

The result was uniform. Every product that explains how it reaches the device describes a path that assumes the device is enrolled somewhere. None describes what happens on a device that is not.

How does each product reach the device?

The products that act on or from the device fall into four groups, as the product notes record them. Three others sit off the device altogether: Zscaler Generative AI Security and AI Access Security from Palo Alto Networks in the network path, and Cloudflare AI Gateway in front of AI applications.

• Through EDR or device management you already run, with no new agent: Bay and Noma Security state this. Harmonic Security names Intune, JAMF, Kandji and Group Policy for its rollout.
• Its own agent, or a module of a platform: Koi (Palo Alto Networks) is agent-based and offered as a Cortex XDR module or standalone. Onyx Security uses endpoint agents and browser extensions, and Prompt Security (SentinelOne) uses its own browser extension and AI endpoint agent. Akamai Workforce Protector, formerly LayerX, is a browser extension for Chrome, Edge, Firefox and Safari.
• Inside the AI agent: Lasso Security connects to Claude Code's lifecycle hooks through the enterprise management platform, and Zenity uses native agent hooks.
• Not detailed: Bloom Security does not publish its deployment method (re-checked 11 October 2026).

Every one of those paths needs a managed device. EDR and device management only reach enrolled machines. An agent needs to be installed by someone with rights to install it. Managed settings for an AI agent are pushed by the same device management. A browser extension is enforced by browser policy, which is again device management.

Is this a gap vendors should fill?

Partly, but there is a limit to what any vendor can do. Installing security software on a device you do not own raises consent and privacy questions as well as technical ones. Some companies solve it by issuing managed devices to anyone with sensitive access. Others move the work into a virtual desktop or cloud development environment, so the device in front of the person matters less. Neither is a product feature.

What vendors can do is offer controls that do not depend on the device. Gateways are the obvious one. Five products describe a gateway on the pages we read: Harmonic Security and Zenity describe MCP gateways, Lasso Security offers an open-source MCP gateway, Onyx Security lists gateways and APIs, and Cloudflare AI Gateway sits in front of the model providers your own applications call. Network controls such as Zscaler's and Palo Alto Networks' also work without the device, as long as the traffic passes through them, though neither page we read describes unmanaged devices. A gateway can sit in front of the MCP servers and model access you provide, whoever's laptop the call comes from, as long as access is forced through it.

What should a company with many unmanaged devices do?

1. Decide which systems AI tools on those devices should be able to reach, and require company identity, and where possible a managed device or a gateway, for anything sensitive.
2. Offer approved AI tools inside a cloud workspace for the work that touches sensitive data.
3. Put a gateway in front of the MCP servers and model access you provide.
4. Write a policy for AI use on personal devices with company data, and make it short enough that people read it.
5. Revisit the decision when the share of managed devices changes.

How does the finder handle it?

When you answer that devices are mostly unmanaged, the finder adds points to the browser extension, gateway and policy positions, and it shows a note above the product list saying that none of the products describes unmanaged-device coverage on the pages we read. In our example profile for unmanaged devices where the company is not sure which AI tools are in use, the result is policy before a product. For a mixed estate, it adds weight to the browser and gateway positions for the unmanaged part and keeps the device position for the rest.

If a vendor publishes unmanaged-device coverage, send us the page through the contact form and we will add it. The note above the product list is generated from the data, so it will disappear on its own once any product has a source for it.