Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
How Many AI Security Products Control What an AI Agent Sees?
None of 86 AI security products reviewed describes giving an AI agent tokens it can work with in place of the sensitive values it reads on a screen. Most, 58 of 86, control where data can go, and 27 control what a model receives in pipelines. One describes masking what an agent reads on web pages.
Almost none. Of 86 AI security and data protection products reviewed for this report, 58 control where data can go: which sites and apps can be reached, what can be pasted or uploaded, who holds which credential, and which actions an agent may take. Another 27 control what a model receives inside the pipelines and traffic they handle, by redacting prompts at a gateway, tokenizing data in a vault an application calls, or detecting personal data in text a team sends them. Only one, Menlo Security, describes masking what an AI agent reads on the web pages it works in (Menlo Security, AI Agent Security, 2026). None describes replacing those values with tokens the agent can still work with.
Key findings
- 0 of 86 AI security products describe giving an agent tokens it can work with in place of the sensitive values it reads on a screen, resolved to the real value only at an approved destination (What Tools Tokenize Data Before an LLM Sees It?).
- The agents these products govern show the same gap. Of 15 AI agents and 86 AI security products reviewed, none describes replacing the customer data an agent reads on a screen with tokens it can work with (Do AI Agents Ask Before Making a Payment?).
- None of the 86 describes recording the rendered screen an agent read when it acted. Thirty-six record prompts or request payloads at their own gateway or pipeline (OWASP, 2025).
- 58 of 86 control where data can go: data loss prevention, network and secure access, identity and access, data security posture, secrets managers, enterprise browsers, and agent runtime controls that allow or block actions.
- 27 of 86 control what a model receives in pipelines or traffic they handle: 12 AI gateways that redact prompts, 11 data vaults and pipeline tokenization services, and 4 personal data detection libraries.
- 1 of 86 describes masking what an AI agent reads from the web pages it retrieves; its public pages describe masking, not tokens an agent can work with (Menlo Security, AI Agent Security, 2026).
Where does each product put its control?
| Where the control sits | Category | Products | Record prompts or payloads | Send AI activity to a SIEM |
|---|---|---|---|---|
| Where data can go | Data loss prevention and insider risk | 13 | 7 | 7 |
| Where data can go | Agent runtime controls that allow or block actions | 10 | 3 | 3 |
| Where data can go | Identity and access | 10 | 3 | 5 |
| Where data can go | Data security posture and governance | 8 | 4 | 2 |
| Where data can go | Network and secure access, including sandboxes | 8 | 4 | 5 |
| Where data can go | Secrets managers | 6 | 0 | 3 |
| Where data can go | Enterprise and secure browsers | 3 | 2 | 1 |
| What a model receives in pipelines | AI gateways that redact prompts | 12 | 10 | 5 |
| What a model receives in pipelines | Data vaults and pipeline tokenization | 11 | 3 | 2 |
| What a model receives in pipelines | Personal data detection libraries | 4 | 0 | 0 |
| What an agent reads on web pages | Masking in a browsing layer | 1 | 0 | 0 |
| Total | 86 | 36 | 33 |
Each product is placed by its primary control, as its own documentation describes it. Many products do more than one thing, and the table records the one that defines where the product acts. The categories are placements, not quality grades: a well-built gateway and a well-built DLP product each protect what passes through the point where they sit. "Record prompts or payloads" counts products that describe keeping what passes through them to a model. "Send AI activity to a SIEM" counts products that describe exporting AI activity to a security information and event management system; another 10 describe a general log export without saying it includes AI activity.
Which products control where data can go?
These 58 products decide which sites, apps, files, credentials and actions a person or agent can reach. Each name links to its RedactSure comparison page, which cites the vendor's own documentation.
| Product | Category | Records prompts or payloads | Sends AI activity to a SIEM |
|---|---|---|---|
| Akamai Workforce Protector | Data loss prevention and insider risk | Yes | Yes |
| Cyberhaven | Data loss prevention and insider risk | Yes | Yes |
| DoControl | Data loss prevention and insider risk | Not described | Not described |
| DTEX | Data loss prevention and insider risk | Yes | Yes |
| Forcepoint | Data loss prevention and insider risk | Yes | Yes |
| Fortra DLP (Digital Guardian) | Data loss prevention and insider risk | Not described | Not described |
| Mimecast | Data loss prevention and insider risk | Not described | General logs only |
| Mimecast Incydr | Data loss prevention and insider risk | Not described | Yes |
| Nightfall AI | Data loss prevention and insider risk | Yes | Yes |
| Safetica | Data loss prevention and insider risk | Yes | Not described |
| Skyhigh Security | Data loss prevention and insider risk | Yes | Yes |
| Symantec DLP | Data loss prevention and insider risk | Not described | General logs only |
| Trellix | Data loss prevention and insider risk | Not described | Not described |
| Anjuna | Agent runtime controls that allow or block actions | Not described | Not described |
| Arcade | Agent runtime controls that allow or block actions | Not described | Yes |
| CrowdStrike | Agent runtime controls that allow or block actions | Not described | Yes |
| Cyera | Agent runtime controls that allow or block actions | Not described | Not described |
| F5 CalypsoAI | Agent runtime controls that allow or block actions | Yes | Yes |
| Modal | Agent runtime controls that allow or block actions | Not described | States it is not audited |
| NVIDIA NeMo Guardrails | Agent runtime controls that allow or block actions | Not described | Not described |
| Radware | Agent runtime controls that allow or block actions | Not described | Not described |
| Straiker | Agent runtime controls that allow or block actions | Yes | Not described |
| Zenity | Agent runtime controls that allow or block actions | Yes | Not described |
| Auth0 | Identity and access | Not described | Not described |
| Composio | Identity and access | Yes | Yes |
| CyberArk | Identity and access | Not described | Not described |
| Microsoft Agent 365 | Identity and access | Yes | Yes |
| Microsoft Entra Agent ID | Identity and access | Not described | Yes |
| Oasis Security | Identity and access | Not described | Not described |
| Okta | Identity and access | Not described | Yes |
| Silverfort | Identity and access | Not described | Not described |
| Teleport | Identity and access | Yes | Yes |
| Virtru | Identity and access | Not described | General logs only |
| BigID | Data security posture and governance | Yes | Yes |
| Immuta | Data security posture and governance | Not described | Not described |
| Informatica (Privitar) | Data security posture and governance | Not described | Not described |
| Microsoft Purview | Data security posture and governance | Yes | Yes |
| Noma Security | Data security posture and governance | Not described | Not described |
| Snowflake | Data security posture and governance | Yes | Not described |
| Varonis | Data security posture and governance | Yes | Not described |
| Wiz | Data security posture and governance | Not described | General logs only |
| Cato Networks Aim Security | Network and secure access, including sandboxes | Yes | Yes |
| Cisco Cloudlock | Network and secure access, including sandboxes | Not described | Not described |
| Daytona | Network and secure access, including sandboxes | Not described | Not described |
| Docker Sandboxes | Network and secure access, including sandboxes | Not described | Yes |
| E2B | Network and secure access, including sandboxes | Not described | General logs only |
| Netskope | Network and secure access, including sandboxes | Yes | Yes |
| Prisma AIRS | Network and secure access, including sandboxes | Yes | Yes |
| Zscaler | Network and secure access, including sandboxes | Yes | Yes |
| 1Password | Secrets managers | Not described | Not described |
| Doppler | Secrets managers | Not described | General logs only |
| HashiCorp Vault | Secrets managers | Not described | Yes |
| Infisical | Secrets managers | Not described | Yes |
| Keeper | Secrets managers | Not described | Yes |
| TruffleHog | Secrets managers | Not described | Not described |
| Chrome Enterprise Premium | Enterprise and secure browsers | Not described | General logs only |
| Island Enterprise Browser | Enterprise and secure browsers | Yes | Yes |
| Prisma Browser | Enterprise and secure browsers | Yes | Not described |
Which products control what a model receives?
These 27 products change or inspect content inside the pipelines and traffic they handle, and one masks what an agent reads on web pages. None of the 28 describes giving an agent tokens it can work with on a screen.
| Product | Category | Records prompts or payloads | Sends AI activity to a SIEM |
|---|---|---|---|
| Arthur AI | AI gateways that redact prompts | Yes | Yes |
| Aurascape | AI gateways that redact prompts | Yes | Not described |
| Check Point Lakera | AI gateways that redact prompts | Yes | Yes |
| Databricks | AI gateways that redact prompts | Yes | Not described |
| Harmonic Security | AI gateways that redact prompts | Yes | Yes |
| Portkey | AI gateways that redact prompts | Yes | Yes |
| Proofpoint | AI gateways that redact prompts | Yes | Not described |
| Securiti | AI gateways that redact prompts | Not described | Not described |
| SentinelOne Prompt Security | AI gateways that redact prompts | Not described | Not described |
| Strac | AI gateways that redact prompts | Yes | Not described |
| TrojAI | AI gateways that redact prompts | Yes | Yes |
| WitnessAI | AI gateways that redact prompts | Yes | Not described |
| Basis Theory | Data vaults and pipeline tokenization | Not described | Not described |
| Bluemetrix | Data vaults and pipeline tokenization | Not described | Yes |
| Evervault | Data vaults and pipeline tokenization | Not described | General logs only |
| K2view | Data vaults and pipeline tokenization | Yes | Not described |
| Limina (Private AI) | Data vaults and pipeline tokenization | Not described | Not described |
| Perforce Delphix | Data vaults and pipeline tokenization | Not described | General logs only |
| Protecto | Data vaults and pipeline tokenization | Yes | Not described |
| Protegrity | Data vaults and pipeline tokenization | Not described | Yes |
| Skyflow | Data vaults and pipeline tokenization | Not described | General logs only |
| Tonic AI | Data vaults and pipeline tokenization | Yes | Not described |
| Very Good Security | Data vaults and pipeline tokenization | Not described | Not described |
| Amazon Comprehend | Personal data detection libraries | Not described | Not described |
| Azure Language (Azure AI Language) | Personal data detection libraries | Not described | Not described |
| Microsoft Presidio | Personal data detection libraries | Not described | Not described |
| OpenAI Privacy Filter | Personal data detection libraries | Not described | Not described |
| Menlo Security | Masking in a browsing layer | Not described | Not described |
"Not described" means the public documentation read for this report does not describe the record or export. It never means the product cannot do it.
Is masking the same as tokenization?
No. Masking decides whether an agent may see a value. Tokenization lets the agent do the work without seeing it.
When a page goes to an AI model through an agent, masking leaves two choices. Give the agent permission, and the model reads the real value, along with its logs and anything a prompt injection can reach. Withhold permission, and the agent sees a masked value it cannot act on, so a task such as paying the right account cannot finish. Menlo Security's public pages describe the first kind of control: AI-powered redaction that masks sensitive data "from agents without appropriate permissions" (Menlo Security, AI Agent Security, 2026). They do not describe tokens or a step that restores a value later.
Tokenization removes that choice. The agent works with a consistent token such as ACCT_001 for the whole task, and the real value is released only at the approved destination, when a named person approves. The data vaults in the table do tokenize reversibly, but inside the applications and pipelines a team integrates with them, not on the screens an agent reads in applications nobody integrated.
Do AI security products record what an agent saw?
Within their own boundary, many do. Thirty-six of the 86 describe recording what passes through them to a model: prompts, conversations or request payloads at a gateway or in a pipeline. Thirty-three describe sending AI activity to a SIEM. None of the 86 describes recording the rendered screen an agent read when it acted.
That gap matters when someone has to reconstruct an agent's work. An auditor asking why an agent paid an invoice or changed a record needs three things together: what the agent saw on each screen, what it did, and which policy allowed it. Some products in the table record the agent's actions, and some record the policy decision on a tool call, but none describes keeping the screen the model was shown at the moment it acted. A gateway records the prompt it inspected and a vault records which values were requested; neither sees the screen of an application an agent opened directly. OWASP lists sensitive information disclosure among the top risks for applications built on large language models, and without that screen-level record no one can show which sensitive values a model held (OWASP, 2025).
Methodology and limitations
The 86 products are those compared on RedactSure's research pages, and every one is listed by name in the tables above with a link to its comparison page. Each product's placement comes from its comparison or alternatives page, dated October 22 to 24, 2026, with the supporting sentence recorded for every row; the one product in the web page group was confirmed against its own pages. The SIEM and record fields come from each vendor's own documentation, read on October 27, 2026, with every page saved. Products with two RedactSure pages are counted once, and a page covering AI gateways as a category is excluded. RedactSure is not in the table, nor is any product that is itself an AI agent or agentic browser.
The table records what each vendor's public documentation describes, not how the product behaves under test. "Not described" covers documentation behind a login, sites that refused automated reading, and documentation that does not address the question; it never means a product lacks the feature. Counts describe the 86 products reviewed, not the market.
Frequently asked questions
What is the difference between controlling where data goes and controlling what the AI sees?
Controls on where data goes decide which sites, apps, files and credentials a person or agent can reach, and block data from leaving. Controls on what the AI sees change the content itself before a model reads it, so sensitive values never reach the model at all. Most security products do the first. An agent working inside an approved application needs the second as well.
Is data masking the same as tokenization?
No. Masking hides a value from anyone without permission, so an agent either reads the real value or sees one it cannot use. Tokenization replaces the value with a consistent token the agent can work with, and the real value is restored only at an approved destination. For agents doing real work, that difference decides whether a task can finish without exposure.
Do AI security tools record what an agent saw?
Thirty-six of the 86 products reviewed describe recording what passes through them to a model, such as prompts or request payloads. None describes recording the rendered screen an agent read. That screen is where an agent sees most sensitive values in business work, and it is what an auditor needs, with the action and the policy, to reconstruct what the agent did.
How RedactSure Controls What the AI Can See
Fifty-eight of the products in the table decide where data can go, and none replaces the values an agent reads on a screen with tokens it can work with. That is the gap an agent working inside business applications falls into.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent paying a supplier opens the vendor record, and the model reads the real account number because the agent was allowed to see it. Inside the governed environment: render-layer tokenization shows the model ACCT_001 on the screen, the agent prepares the payment with the token, and the real account is released only at the approved payment, when a named person approves under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Where a control sits decides what it can protect. Bring one agent workflow and see, with test values, what the model reads on each screen and who approves each action. Book a demo