Comparison · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
RedactSure vs Menlo Security: 2026 Comparison & Alternative
Menlo Security cleans and masks pages in its cloud browser, while RedactSure, a Menlo Security alternative built for AI agents, replaces values with tokens before a model reads the screen. RedactSure is an alternative way to think about agent browsing security, because it protects sensitive data as it is rendered on a screen, before an agent uses it.
An adjuster leaves a claim open on one screen and the agent that will check it starts on another, with the claimant's name, claim number and bank account in view, which is where a Menlo Security alternative for agent work begins. Menlo Security runs that web activity in the Menlo Cloud and cleans and masks the pages before the agent sees them, while RedactSure replaces values on the rendered screen with consistent tokens before any model reads it, so the real values appear only at the approved destination.
This page quotes Menlo Security's release and follows one claims task through both designs: a claim to check, then a payment to approve. What Is Render-Layer Tokenization? defines the substitution at issue, and What Is a Tethered Agent? describes the authority an agent runs under when it borrows an adjuster's session.
Key findings
- As a Menlo Security alternative for agent work, RedactSure replaces the claimant's name, claim number and bank account with CLAIMANT_001, CLAIM_001 and ACCT_001 on the screen before any model reads it, and releases the real account only at the approved payment destination (What Is Render-Layer Tokenization?).
- A value that reaches the model is exposed whatever the browser does with the page afterward: injections that ask agents to leak personal data seen during a task reached "average attack success rates (ASR) around 20 percent" (Alizadeh et al., 2025).
- MARS masks sensitive information through Adaptive DLP, and the release describes no step that turns a masked value back into the real account number at a payment destination, so the pages reviewed leave open what the agent submits at the bank (Menlo Security, 2026).
- MARS "is the first Browser Security Platform to strip prompt injection and hidden instructions out of what agents read," a first the release asserts for itself (Menlo Security, 2026).
- MARS "runs that web activity in the Menlo Cloud and cleans the pages and files, including downloads and uploads, before the agent sees them," so the cleaning covers the session the cloud serves (Menlo Security, 2026).
- "MARS provides token-based authentication for the agents driving secure browser sessions," and security teams get per-agent logs and "the ability to take over live agent browser sessions," controls on the session rather than on the values a page shows (Menlo Security, 2026).
How do the two compare side by side?
The table sets Menlo Security's own wording beside what a governed environment does on the same point, and names the check a buyer can run.
| Dimension | Menlo Security, per its pages | RedactSure | What to verify |
|---|---|---|---|
| Where the control sits | "runs that web activity in the Menlo Cloud and cleans the pages and files" before the agent sees them (Menlo Security, 2026) | On the rendered claims screen, before any model reads it | The exact point in one screen where a value is replaced rather than cleaned |
| How coverage starts | Agent activity routed through the Menlo Cloud, with policy over "which sites each agent may reach" (Menlo Security, 2026) | The agent works in the governed environment and the claims platform is unchanged | Which of the claim's applications run through the cloud today |
| What the model receives | A cleaned page, with sensitive information masked: "masks sensitive information" (Menlo Security, 2026) | CLAIMANT_001, CLAIM_001 and ACCT_001, consistent for the whole run | One claim screen, field by field, as the model held it |
| How real values are restored | The release describes masking and no restore step at a destination (Menlo Security, 2026) | Released to the payment destination when a named person approves | Who turns a token into a value, at which destination, with what written down |
| Who approves an action | Policy over the sites an agent may reach; the release describes no per-payment approval (Menlo Security, 2026) | A named person approves every payment, submission and record change | A person's name in the record, not a site rule |
| The audit record | Per-agent logs and "the ability to take over live agent browser sessions" (Menlo Security, 2026) | Every screen as tokens, every action and every approval, exported to the customer's SIEM | Whether the record shows what the model read |
The difference is the object each product governs. Menlo Security governs the web session its cloud serves, so its answer covers the page after cleaning and stops at the edge of that session. RedactSure governs what an agent reads, so its answer is one record of the claims screen as tokens. They also differ on who turns a token back into a real value: a DLP policy on one side, a named approver in the other's design, which What Is the Difference Between Approving a Credential and Approving Its Use? sets out.
What does Menlo Security protect, and where does it act?
Menlo Security sells MARS as browser security for agents, and its release describes what happens to a page before the agent reads it: MARS "runs that web activity in the Menlo Cloud and cleans the pages and files, including downloads and uploads, before the agent sees them," and it "is the first Browser Security Platform to strip prompt injection and hidden instructions out of what agents read," a claim the release makes for its own product. On the data side, "through Menlo AI Adaptive DLP it masks sensitive information," controls "which sites each agent may reach," and gives security teams per-agent logs and "the ability to take over live agent browser sessions" (Menlo Security, 2026).
Every benefit depends on one condition: the agent's web activity runs in the Menlo Cloud, which is where the cleaning and the masking happen. That is a limit of where the control sits rather than a flaw in it, and it matters because the application an agent reaches is often one the security team never chose: "Eight in ten employees use AI tools not approved by their organizations" (Cloud Security Alliance, 2026).
Menlo Security is 1 of the 86 AI security products reviewed whose public pages describe masking what an agent reads on a web page, and its documentation does not describe a record of the screen the model received or a SIEM export of that activity (How Many AI Security Products Control What an AI Agent Sees?).
What does an agent read when it opens a claims record?
The agent in this task is one of the "autonomous software systems that perceive, reason, and act in digital environments" that MIT Sloan defines (MIT Sloan, 2026). The claim record holds a claimant's name, a claim number and the bank account the payment will go to, and the agent opens it under the adjuster's session.
Inside the Menlo Cloud the page arrives cleaned and masked, so hidden instructions are stripped and the account is masked by Adaptive DLP before the agent sees the page (Menlo Security, 2026). The model then reads the claim as the cloud served it, including any instruction in visible text, because cleaning removes what the vendor's filter recognizes. Brave's researchers showed that once an agent follows injected instructions in a logged-in browser, "same-origin policy (SOP) or cross-origin resource sharing (CORS) are all effectively useless" (Chaikin and Sahib, 2025).
There is also an identity gap. The agent borrowed the adjuster's session, so the claims platform records the adjuster, and a firm that must generally notify affected individuals within 30 days of unauthorized access needs to know which values the model held (SEC, 2024). Menlo's per-agent logs sit beside the platform's record, and the release does not describe what they contain.
A masked account is also a value the agent cannot type into a payment form, so the step that would let it pay needs a placeholder and a place where that placeholder becomes the real number, which Can an AI Agent Work With a Placeholder Instead of a Real Credential? sets out.
Which control fits which work?
Keep Menlo Security for
- Agents whose web activity can run in the Menlo Cloud, where the pages and files they read are cleaned before they see them (Menlo Security, 2026).
- Teams that want to control which sites each agent may reach, since the release says Adaptive DLP does that (Menlo Security, 2026).
- Security teams that watch agent sessions live, with per-agent logs and "the ability to take over live agent browser sessions" (Menlo Security, 2026).
Add RedactSure for
- Agents reading screens in applications the organization bought, where the model receives CLAIMANT_001 and ACCT_001 instead of the name and the account (What Is Render-Layer Tokenization?).
- A named person's approval for each payment, submission and record change the agent proposes (What Is Supervised Delegation?).
- The record of what the model read on each screen, exported to the customer's SIEM (What Is an AI Control Record?).
An organization running agents usually needs both, and the lists above show the work each product is built for.
How do you test it on one workflow?
Give both vendors one real claims workflow and an afternoon, and write the answers down as they come.
Step 1. Choose the claim the team actually processes and one screen from it, such as the claim record with the payment details open, rather than a diagram of the data flow.
Step 2. Ask each vendor to replay the model's input for that screen, field by field, and write down what each says the model holds on the claimant's name, the claim number and the bank account.
Step 3. List every application the claim task touches, from the claims platform to the payment system, and mark each one as covered by that vendor's control or not. The uncovered count is the exposure on the first day.
Step 4. Trace the bank account from the screen to the payment: what releases the real value, at which destination, when, and whose name appears in the record. Ask for the approval record the approver worked from, rather than a description of policy.
Step 5. Calculate coverage. If the task touches six screens and two are covered, first-day coverage is two of six. Compare the costs that differ: the work to route activity through the vendor's environment, and the claim payments delayed until it is finished (What Is Least Exposure?).
What does a governed environment change?
A governed environment is a category of control rather than a product feature. The agent works under its own session and identity, and it sees a different page from the person because values are replaced with consistent tokens before the model reads anything. The claimant appears as CLAIMANT_001, with CLAIM_001 and ACCT_001, on every screen of the run. Real values resolve only at approved destinations at the moment of an approved action, a named person approves every payment, submission and record change, and every screen, action and approval lands in a control record exported to the organization's SIEM.
Harry Ghuman (CEO, Alpha Decisions) described the enterprise on a HAL podcast this way: "An enterprise is like a bundle of decisions." (What Is the AI Delegation Frontier? Harry Ghuman on Who Gave the AI Its Authority)
The study of task drift names the risk that an agent leaves the user's instruction behind: "We define this deviation as task drift" (Abdelnabi et al., 2025). Data minimisation asks for personal data that is "adequate, relevant and limited to what is necessary" (Regulation 2016/679, 2016). A model that never received the account number cannot be argued into sending it, which is the difference between cleaning a page and substituting what the page shows.
What the record shows
The claim record carries a name, a claim number and a bank account, and the question is what the model holds when it reads them. A render-layer control replaces those values with CLAIMANT_001, CLAIM_001 and ACCT_001 before anything model-facing sees the screen, releases the real account only for an approved payment, and puts the approver's name in the record. That is the job RedactSure, as the Menlo Security alternative for agent work, does for this record. Menlo Security's real coverage is the web session its cloud serves: pages and files cleaned, sensitive information masked through Adaptive DLP, and per-agent logs with session takeover. A buyer can test the difference on one claim: ask each vendor to replay the fields the model held, then trace the bank account to the approval that released it.
Methodology and limitations
This page draws on Menlo Security's release for MARS, one browser-security study, one paper on task drift, one paper on data leaked during agent tasks, the SEC's rule notice, the data minimisation article, one research note and MIT Sloan's definition. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation; none was tested for this page, and no customer of either is described. Documentation describes intended design, both products change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The claim is an illustrative record type, not an organization. Compliance determinations belong to the organization's counsel, assessors and its security team, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Menlo Security protect the data an agent sends to a model?
Partly. MARS runs the agent's web activity in the Menlo Cloud, cleans the pages and files, and masks sensitive information through Adaptive DLP, so a bank account on a served page can be masked before the agent reads it (Menlo Security, 2026). The release does not describe a value that stays consistent for the agent or a restore step at the payment destination, which is what an agent needs when it has to submit that account.
Does Menlo Security cover what an agent reads on a rendered screen?
Only for activity it serves. MARS runs that web activity in the Menlo Cloud and cleans pages and files before the agent sees them, and it controls which sites each agent may reach. A screen the agent opens outside that session has no cleaning or masking described for it, so coverage follows the session rather than the screen.
Who approves the payment the agent prepares?
No person is described in the release. MARS provides token-based authentication for the agents driving secure browser sessions, and security teams can control which sites each agent may reach and take over a live session, which gates where the agent goes. No per-payment approval, approver name or record of a person authorizing the transfer appears in the release, so the approval has to come from elsewhere.
What record does Menlo Security leave of what its agent read?
Per-agent logs. Security teams get per-agent logs and the ability to take over live agent browser sessions, which is a record of the session. The release does not describe what those logs contain, whether they show the values the model held on a screen, or an export to the customer's SIEM, so a reviewer cannot tell from it what can be rebuilt.
Does masking a bank account leave the agent able to pay?
Not as documented. Masking is a DLP function: the release says that through Menlo AI Adaptive DLP it "masks sensitive information" and controls which sites each agent may reach. A masked account is withheld from the agent, and the release describes no consistent placeholder it can type into a payment form or a release of the real value at the destination, so the payment falls back to a person or another control.
Can a team use both products?
Yes, in sequence. Menlo Security can clean and mask the web activity an agent runs in its cloud, and a governed environment can substitute values on the screens of applications the organization bought and record the approval that releases them. They act at different points: one cleans the page the agent receives, and the other decides what the page shows the model.
How RedactSure closes the gap between a cleaned page and a released value
Menlo Security cleans the pages its cloud serves, and a claim payment also depends on a value the agent has to enter on a screen it reads. Its own release says MARS "masks sensitive information," which withholds the account from the agent rather than releasing it at the bank.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the claim under the adjuster's session and the model receives the name, the claim number and the bank account. Inside the governed environment: the same screen shows CLAIMANT_001, CLAIM_001 and ACCT_001, and the real account is released to the payment system when the named adjuster approves the payment.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Protecting the sensitive data an agent could read on a screen is a needed part of any solution that includes Menlo Security. Bring one claims task and see, with test values, what the model reads and where the real account lands. Book a demo