Where 19 AI endpoint products put their controls

How many products describe each position?

The table below is computed from our product data, with each product's status for each position as recorded from its own pages on 27 September 2026, with additions read on 11 October 2026.

Two things stand out. First, the network position is the thinnest: Zscaler Generative AI Security and AI Access Security from Palo Alto Networks sit there, and Lasso Security describes proxy integrations. We could not read Netskope's AI pages for this edition, so the large SSE vendors are only partly represented. Second, several products describe the device position only partly, because their pages either cover part of the job, such as discovery without enforcement, or do not explain how they reach the device.

Why does position matter more than features?

A product's features only apply to what it can see, and what it can see depends on where it sits. A browser extension with excellent data detection sees nothing of a coding agent in a terminal. A gateway with fine-grained tool-call rules sees nothing of a local MCP server talking to an agent over standard input and output. An on-device control sees what agents do on the laptop, but nothing of an AI feature inside a SaaS product.

So the first question for any shortlist is which positions it covers, and whether those are the positions where your risk sits. The finder answers that from your situation before it looks at any product.

What do the single-position products have in common?

The products that describe only the device position are built for agents on the endpoint. Bay, Koi (Palo Alto Networks) and Noma Security all describe the device position fully and none of the other three. Zscaler, AI Access Security and Cloudflare AI Gateway are single-position products too, on the network or at a gateway. That focus is a strength when coding agents are the main concern, and a limit when browser AI or cloud workspaces matter as much. Noma Security and Koi offset part of that through coverage beyond the endpoint: Noma covers SaaS and homegrown agents, and Palo Alto Networks plans to integrate Koi with Prisma AIRS. Bay describes no coverage beyond the endpoint.

What do the multi-position products have in common?

Lasso Security and Onyx Security describe the most positions, and Prompt Security (SentinelOne) now describes both the device and the browser with its own two sensors. Lasso describes a browser extension, proxy integrations and an open-source MCP gateway, and acts on the device through Claude Code hooks. Onyx describes endpoint agents, browser extensions and gateways. Harmonic Security describes the browser and MCP gateways, with desktop and CLI coverage rolled out through device management. More positions means wider reach, and usually more components to deploy and run, which Lasso's notes list as a limit.

Does it make sense to combine products?

Often. A common pattern is one control on the device for coding agents and a second in the browser or at a gateway for everything else. The risk is overlap and two consoles. Before combining, check whether one product's partial coverage of a position is enough, using the line-up page to put candidates side by side.

What should you take from the map?

• Decide where your risk sits first: browser, device, network path or remote tools.
• Shortlist products that describe those positions fully, not partly.
• For positions a shortlisted product describes only partly, ask the vendor to show the missing part.
• Treat Not in our sources as a question for the vendor, not a no.

How often will this map change?

Quickly. Several of the products sit inside larger companies that are integrating them, several vendors raised large rounds in 2026, and new positions are easy to announce. We re-read each product's pages before every update of this site, and the table above is generated from the same data as the finder, so a new source changes both at once. If a product you are evaluating describes a position that our notes mark as not in our sources, send us the page. That is the fastest way to improve the map, and it helps the next reader as much as it helps the vendor.

Until then, treat the map as a starting point for questions. A dashed marker on a product's map is the most useful thing to bring to a first call, because it is exactly where its public pages stop and the vendor's own explanation has to start.