Share with your CISO
Zenity is betting that AI security’s next frontier isn’t detecting what agents have already done, it’s governing what they’re allowed to do before they act. The company’s expanded AI security platform adds Exposure Management and Runtime Boundaries to its existing foundation, targeting a specific gap: long-horizon agents that execute multi-step workflows over hours or days across systems like Microsoft Copilot, Salesforce Agentforce, and Amazon Bedrock. The platform is available immediately for enterprise customers.
What this means for your business
The security model most enterprises have deployed for AI assumes a human is still in the loop often enough to catch problems. That assumption is breaking down fast. Agents writing production code, invoking APIs, and handling sensitive data across extended workflows can accumulate risk across individually innocuous steps, each one approved, the sequence catastrophic. If your organization has moved past AI pilots into AI execution, your current tooling was almost certainly designed for the earlier, simpler world.
Zenity’s framing of a “decision layer” is conceptually correct and commercially self-serving in roughly equal measure. The company positions itself as the category definer, and that positioning conveniently makes every existing SIEM or endpoint tool look like it’s solving the wrong problem. The underlying point still holds, though. Runtime enforcement, the idea that a policy engine evaluates every agent action against intent, identity, and execution history before it fires, is meaningfully different from logging what already happened. The real test is whether Zenity’s policy definitions are expressive enough to handle the actual ambiguity of production agent workflows, where “access sensitive data” and “do your job” are often the same instruction.
The CISO who should pay closest attention isn’t the one managing a fully deployed agent fleet. It’s the one whose organization is six to eighteen months away from that state, when the vendor stack is still being chosen and the security architecture is still negotiable. Once agents are woven into production workflows at scale, retrofitting decision-layer governance gets expensive and politically complicated. The budget question worth surfacing now isn’t whether a platform like Zenity is justified, it’s whether the AI deployment roadmap your CTO owns has a security architecture decision embedded in it at all. If it doesn’t, that’s the gap that matters.
Concept deep-dive: Long-horizon agents
A long-horizon agent is an AI system that executes a goal across many sequential steps, over minutes, hours, or days, rather than responding to a single prompt and stopping. Think of it as the difference between asking a calculator a question and hiring a contractor who works unsupervised for a week. Each individual action the agent takes may look legitimate in isolation; the risk accumulates in the sequence, especially when context, permissions, and available tools shift mid-task without a human reviewing the transition.
Based on reporting from Zenity Launches AI Security Platform for Autonomous Agents and Enterprise Protection, originally published 2026-07-28 19:08:00.
