Comparison · By Chris Sowa · Published
Last updated
What Is the Difference Between RedactSure and Zenity for Enterprise AI Agent Runtime Security?
The comparison turns on what each product governs. Zenity's 2025 release describes security monitoring, vulnerability assessment and threat detection for AI agents built in Copilot Studio; RedactSure decides what an agent's model receives from each screen and who approves each consequential action. Detection that misses still leaves real values in the model's context.
The comparison turns on what each product governs. Zenity's 2025 release describes security monitoring, vulnerability assessment and threat detection for AI agents built in Copilot Studio; RedactSure decides what an agent's model receives from each screen and who approves each consequential action. Detection that misses still leaves real values in the model's context. Security teams evaluating agents in 2026 face two different questions that share one label. The first is inventory and behavior: which agents exist across the low-code platforms and SaaS tools the business already uses, how they are configured, and whether anything they do at runtime looks like an attack. The second is exposure and authority: for one piece of work, what the model was given to read, and which person allowed the step that changed a record. Render-layer tokenization answers the second question before the model reads anything. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Key findings
- Zenity describes a platform combining AI Observability, AI Security Posture Management (AISPM) and AI Detection and Response (AIDR) for AI agents built in Microsoft Copilot Studio, with build-time guardrails and a runtime security layer on top of Microsoft's build-time governance (Zenity, 2025).
- Zenity says the platform detects prompt injection, data leakage and behavioral anomalies in near real time and responds at runtime with automated actions based on logs; the release does not state how sensitive data is handled beyond detection or whether individual tool calls are blocked (Zenity, 2025).
- Microsoft documents that a Copilot Studio computer-using agent works applications through the user interface, shares screenshots of the machine's activity in conversational use, and that its access control "only prevents the model from taking actions" outside the allow list, without stopping it from opening them (Microsoft, 2026).
- OWASP ranks prompt injection first in its 2025 Top 10 for LLM Applications and lists sensitive information disclosure second (OWASP, 2025).
- Researchers at ServiceNow, Mila and partner universities report that a model-agnostic firewall at the agent-tool boundary, which strips unneeded data and sanitizes tool outputs, reached about 0 percent attack success with little utility loss across four agent benchmarks (Bhagwatkar et al., 2026).
- Gartner said in May 2026 that applying uniform governance across AI agents will lead to enterprise AI agent failure (Gartner, 2026).
What does Zenity say its platform covers?
Zenity positions itself around the agents an enterprise already builds on Microsoft Copilot Studio. Its May 2025 release describes security monitoring, vulnerability assessment and threat detection for those agents, through a platform that combines AI Observability, AI Security Posture Management (AISPM) and AI Detection and Response (AIDR) (Zenity, 2025). The release frames the goal as "every agent is governed, secured, and observable from buildtime to runtime" (Zenity, 2025).
The release gives the clearest map of the product's scope. At build time, guardrails are embedded in agent creation and policy enforcement addresses overly broad access. At runtime, Zenity describes a security layer on top of Microsoft's build-time governance that detects prompt injection, data leakage and behavioral anomalies in near real time and responds with automated actions based on logs (Zenity, 2025). For records, it describes visibility into agent activity, usage and access, including what happened, who was involved and what data was used (Zenity, 2025).
Read together, those statements describe a platform whose unit of work is the agent as an asset: assess how it is configured and what it can reach, watch what it does, and intervene when behavior matches a threat. That is a recognizable security discipline, close to how cloud security posture management treats workloads, applied to agents. It fits the problem many security teams describe first, which is that agents appear across Copilot Studio, SaaS suites and internal tools faster than any review board can catalog them. A companion page on tools to discover and secure AI agents across the enterprise works through that inventory problem in more detail.
What the release does not settle is how each mechanism behaves. It does not state where the product sits relative to the model, how sensitive data is handled beyond detection, or whether individual tool calls are blocked. Those are questions for Zenity's detailed documentation and for a product evaluation, and the comparison below keeps to what the release states.
Where does each product sit relative to the agent and the model?
Placement decides what a control can see and when it can act. A product that sits beside an agent platform sees what that platform exposes: agent definitions, connectors, permissions, conversation and tool events. A product that sits between the screen and the model decides what the model receives before reasoning starts.
Zenity, on the evidence of its release, sits alongside the platform where agents are built and run: build-time guardrails embedded in agent creation, and a runtime security layer on top of Microsoft's build-time governance for Copilot Studio agents (Zenity, 2025). The release does not state its position relative to the model. The agent still runs on its own platform, with that platform's model and that platform's view of the data. For a Copilot Studio computer-using agent, Microsoft documents that view: the agent operates web and desktop applications through the graphical interface, and in conversational use "it shares reasoning messages and screenshots of the machine's activity in the chat" (Microsoft, 2026). A security layer next to that platform observes and can intervene in that activity; the release does not state that it changes what the screen shows the model.
RedactSure sits at a different point. Its agents work inside a governed environment, a secure virtual machine deployed into the cloud the customer's posture requires, on hardware-encrypted enclaves with keys the customer holds. Values chosen by policy are replaced with consistent tokens at the render layer before any model reads the screen, and the environment hands the model the task's fields rather than a picture of the screen. The agent is a tethered agent: it works only inside the environment a named person connected it to, on the applications that person chose. The environment is model agnostic, so Claude, GPT, Gemini or an open-weights model can do the work without the controls moving.
The practical difference is reach versus depth. A platform-side product can cover many agents an organization did not build deliberately, which is its point. A render-layer environment covers the agents a named person delegated work to, and governs exactly what each one reads and does. Gartner's warning that uniform governance across all agents leads to failure (Gartner, 2026) argues for matching the control to the agent's risk rather than picking one placement for every agent.
How do the two products compare side by side?
The table places the two designs on the dimensions that decide runtime security for an agent doing regulated work. The Zenity column states what the vendor's release says; where the release does not state something, the cell says so.
| Dimension | Zenity, per its press release | RedactSure, per its published design |
|---|---|---|
| What it is | Security monitoring, vulnerability assessment and threat detection for AI agents, combining AI Observability, AISPM and AIDR (Zenity, 2025) | AI agent controls, governance and data protection for supervised AI co-workers working an organization's applications |
| What it covers | AI agents built in Microsoft Copilot Studio (Zenity, 2025) | Agents a named person connects to the governed environment, on the applications that person chose |
| Where it sits | Build-time guardrails in agent creation and a runtime layer on top of Microsoft's build-time governance; the release does not state its position relative to the model (Zenity, 2025) | Between the rendered screen and the model, inside a governed virtual machine with customer-held keys |
| Sensitive values before the model reads them | Detects data leakage in near real time; the release does not state handling beyond detection (Zenity, 2025) | Values chosen by policy replaced by consistent tokens (SSN_001, ACCT_001) at the render layer before any model reads the screen |
| Runtime threats | Detects prompt injection, data leakage and behavioral anomalies in near real time (Zenity, 2025) | A successful injection collects tokens; the consequential action still stops for a named person |
| Agent actions | Build-time policy enforcement against overly broad access; runtime automated actions based on logs; the release does not state blocking of individual tool calls or per-action human approval (Zenity, 2025) | A named person approves every payment, submission and record change at the moment it runs (Supervised Delegation) |
| Record | Visibility into agent activity, usage and access, including what happened, who was involved and what data was used (Zenity, 2025) | Every action logged, human and computer; all PII as tokens, in the AI Control Record, exported to the customer's SIEM |
| Model | The release does not state it; the agent runs on its platform's model | Model agnostic; models swap without moving the controls |
The table is not a ranking. Zenity addresses agents RedactSure never sees: the ones built in Copilot Studio without a named delegator, monitored for posture and runtime threats. RedactSure addresses a moment the Zenity release does not describe: the instant a model is about to read a rendered screen during a delegated workflow, and the instant that workflow reaches a consequential step.
What happens to a sensitive value before the model reads it?
Take a claims adjuster's screen showing a policyholder's name, Social Security number and bank account, with an agent asked to prepare a payment for review. The sharpest difference between the two designs is what the model holds at that moment.
On an agent platform governed by detection, the agent's model reads what the platform gives it. For a computer-using agent on Copilot Studio, Microsoft documents a model that combines vision and reasoning to interact with the interface, with screenshots of the machine's activity shared in conversational use (Microsoft, 2026). A detection and response layer can watch that run and act on what it sees. Zenity says its platform detects data leakage in near real time (Zenity, 2025); the release does not state handling beyond detection, such as replacing the values on that screen before the model reads them. Unless a detection fires and a run is stopped, the identifiers are in the model's context.
That matters because the context is where attacks land. OWASP ranks prompt injection first among LLM application risks and sensitive information disclosure second (OWASP, 2025). Greshake and colleagues showed that instructions hidden in content an application retrieves can take over an LLM-integrated application, which means anything the model can read, an attacker's text can ask it to send (Greshake et al., 2023). Detection reduces how often that succeeds. It does not change what an undetected success can reach.
In a RedactSure run, the treatment happens before the read. The Planner sets which values are tokenized for the task, and a named person confirms that policy before the run starts. When the agent opens the claim, the name, SSN and account number arrive at the model as PATIENT_001, SSN_001 and ACCT_001, while the amount, dates and coverage facts the work runs on stay in clear where the policy says so. Tokens are consistent, so ACCT_001 on the claim screen is ACCT_001 on the payment screen, and the agent can match records without holding the number. Real values resolve only at approved destinations at the moment of an approved action. Data is hidden from the AI, not from the human workers, whose permissions do not change.
The research on agent defenses points the same way. Bhagwatkar and colleagues report that minimizing what crosses the agent-tool boundary and sanitizing what comes back reached about 0 percent attack success across four benchmarks, and they warn that public agent-security benchmarks are easily saturated (Bhagwatkar et al., 2026). Limiting what the model can read is a control that does not depend on catching the attack.
How are agent actions approved and recorded in each design?
An agent that reads can leak; an agent that acts can pay the wrong vendor or change the wrong record. A companion page on AI agent action governance sets out the options. Zenity's release describes build-time policy enforcement that addresses overly broad access and runtime automated actions based on logs (Zenity, 2025). It does not state blocking of individual tool calls or a named person approving each consequential action before it executes. For records, it describes visibility into agent activity, usage and access, including what happened, who was involved and what data was used (Zenity, 2025). The inventory problem behind unmanaged agents is one that a companion page on reducing shadow AI agents across the enterprise treats directly.
The platforms underneath carry their own controls. Microsoft documents that a Copilot Studio computer-using agent can email a designated reviewer when it detects potentially harmful instructions, and warns that a reviewer who did not start the run "likely [doesn't] see the activity" (Microsoft, 2026). MIT Technology Review describes vendor safety stacks of prompts, classifiers and probes as a "Swiss cheese" model in which each layer has holes (MIT Technology Review, 2026), and Microsoft's AI Red Team taxonomy treats agent actions as a failure surface of their own (Microsoft, 2025).
Under Supervised Delegation, a named person confirms what is tokenized, can watch and pause the run, and approves every payment, submission and record change while it runs, watching the same tokenized stream the agent works from. Every screen as tokens, every action and every named approval lands in the AI Control Record, exported to the customer's SIEM, so the evidence store holds tokens rather than identifiers. Accenture counts traceability among the conditions of trust in AI (Accenture, 2025): an agent inventory supplies it across the estate, and a run record supplies it for each delegated decision, the Map and Measure versus Manage split in the NIST AI Risk Management Framework (NIST, 2023).
Where does RedactSure sit?
For delegated work, RedactSure answers the question detection leaves open: what the model held when something went wrong. The Planner sets which values become tokens, a named person confirms that policy before the run, and the model receives the task's fields with identifiers as tokens. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The agent works existing applications inside a governed environment, with no per-application integration and no change to user permissions, and the AI Control Record exports to the customer's SIEM. A prompt injection that succeeds collects tokens. Deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.
Methodology and limitations
This page rests on vendor documentation and public standards, read between October 13 and October 14, 2026. For Zenity, the source is the company's May 22, 2025 press release on Copilot Studio agent security, accessed October 14, 2026. Microsoft's Copilot Studio computer use documentation was read as vendor documentation. Standards are the OWASP Top 10 for LLM Applications 2025 and the NIST AI Risk Management Framework; research sources are the Greshake and Bhagwatkar preprints and Microsoft's agent failure taxonomy; analysis and press sources are Gartner, MIT Technology Review and Accenture.
No product was tested, no Zenity or RedactSure deployment was run, and no benchmark is reported. Where the comparison says the release does not state something, the statement is limited to that release; Zenity's detailed documentation may describe behavior the release does not, and vendor features change. The page carries its date and is revised when the documentation changes. Pricing, licensing and platform coverage were out of scope. The claims example describes a record type; no customer, prospect or other organization is described.
Whether either product, or the two together, meets an organization's requirements for a given agent or workflow is a determination for its counsel, its assessor and its security and compliance officers, who hold the policies, the agent inventory and the risk tolerance the decision depends on.
What the record shows
Agent runtime security has two halves. One finds agents across platforms, assesses their posture and detects threats as they run; the other governs what a delegated agent's model reads and who approves each consequential step. An agent covered only by detection still holds real identifiers whenever a detection misses, and a successful attack reaches whatever the agent read. The test for any runtime security product is one question: for one screen of one workflow, show what the model received and the name of the person who approved the action that followed.
Frequently asked questions
Is Zenity a competitor or a complement to RedactSure?
Mostly a complement. Zenity's release centers on posture, observability and runtime threat detection for agents built in Copilot Studio. RedactSure governs the workflows a named person delegates: what the model reads, as tokens, and who approves each consequential action. An organization can inventory its agent estate with one and run its regulated workflows through the other.
Does Zenity tokenize sensitive data before the model reads it?
The release does not state that. Zenity says the platform detects data leakage in near real time, but the release does not state handling beyond detection, such as replacing values on a screen or in a prompt with tokens before the agent's model reads them (Zenity, 2025). Buyers should ask the vendor directly and check the detailed documentation, since features change.
What does runtime detection miss that exposure control covers?
Detection decides whether an action or input looks malicious, and a miss leaves the agent's context intact. Exposure control limits what the context holds in the first place. Under render-layer tokenization the model reads SSN_001 and ACCT_001 instead of identifiers, so an injection that slips past every detector collects tokens, and the consequential action still waits for a named person.
Does RedactSure discover shadow AI agents?
No. RedactSure governs agents a named person connects to its governed environment, on applications that person chose. Finding agents built across low-code platforms and SaaS suites without a delegator is a discovery problem, closer to the posture and observability work Zenity's release describes for Copilot Studio agents. Once discovery identifies an agent touching identifiers or money, that work can move into a governed environment.
How does human approval differ between the two designs?
Zenity's release describes build-time policy enforcement against overly broad access and runtime automated actions based on logs; it does not state per-action human approval. RedactSure requires a named person to approve every payment, submission and record change at the moment it runs, watching the same tokenized stream the agent works from, with each approval recorded by name.
Can both send records to the same SIEM?
The release does not state SIEM integrations. It describes visibility into agent activity, usage and access, including what happened, who was involved and what data was used (Zenity, 2025). RedactSure exports the AI Control Record, with every screen as tokens, every action and every named approval, to the customer's own SIEM. The two streams answer different questions: what the agent estate is doing, and what one delegated run did.
Related reading
What Are the Best Tools to Discover and Secure AI Agents Across the Enterprise? · What Is AI Agent Action Governance? · How to Reduce Shadow AI Agents Across the Enterprise · What Is AI Agent Discovery? · What Is AI Agent Runtime Security? · Does Microsoft Copilot Studio Computer Use Control What the Agent Sees? · On the RedactSure blog: The Two Gaps AI Agents Opened in Your Security Stack
Sources
Peer-reviewed research and preprints
- Greshake, Kai, et al., "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," arXiv:2302.12173, 2023 (preprint; also AISec 2023). https://arxiv.org/abs/2302.12173
- Bhagwatkar, Kasa, et al., "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?," arXiv:2510.05244, v2 2026 (preprint). https://arxiv.org/abs/2510.05244
- Microsoft AI Red Team, "Taxonomy of Failure Modes in Agentic AI Systems," Microsoft, April 2025 (whitepaper). https://www.microsoft.com/en-us/security/blog/2025/04/24/new-whitepaper-outlines-the-taxonomy-of-failure-modes-in-ai-agents/
Vendor documentation
- Zenity, "Zenity Enhances Security from Buildtime to Runtime for Enterprise AI Agents with Copilot Studio," May 22, 2025 (vendor press release, accessed October 14, 2026). https://zenity.io/company-overview/newsroom/company-news/zenity-enhances-security-with-copilot-studio
- Microsoft, "Automate web and desktop apps with computer use" (2026; vendor documentation). https://learn.microsoft.com/en-us/microsoft-copilot-studio/computer-use
Regulation, standards and official guidance
- OWASP, "LLM01:2025 Prompt Injection," Top 10 for LLM Applications 2025 (standard). https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- OWASP, "LLM02:2025 Sensitive Information Disclosure," Top 10 for LLM Applications 2025 (standard). https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
- NIST, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)," NIST AI 100-1, 2023 (official guidance). https://www.nist.gov/itl/ai-risk-management-framework
Industry analysis and press
- Gartner, "Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure" (May 26, 2026; press release). https://www.gartner.com/en/newsroom/press-releases/2026-05-26-gartner-says-applying-uniform-governance-across-ai-agents-will-lead-to-enterprise-ai-agent-failure
- Holland Michel, Arthur, "We're putting too much faith in AI's ability to say no," MIT Technology Review (October 9, 2026; press). https://www.technologyreview.com/2026/10/09/1145728/we-are-putting-too-much-faith-in-ai-to-say-no/
- Accenture, "Technology Vision 2025: AI: A Declaration of Autonomy" (January 2025; industry analysis). https://www.accenture.com/us-en/insights/technology/technology-trends-2025
RedactSure documents
- RedactSure Research, "What Is Render-Layer Tokenization?" (2026). https://redactsure.com/research/what-is-render-layer-tokenization
- RedactSure Research, "What Is Supervised Delegation?" (2026). https://redactsure.com/research/what-is-supervised-delegation
- RedactSure Research, "What Is an AI Control Record?" (2026). https://redactsure.com/research/what-is-an-ai-control-record
- RedactSure Research, "What Is a Tethered Agent?" (2026). https://redactsure.com/research/what-is-a-tethered-agent
- RedactSure, "The Two Gaps AI Agents Opened in Your Security Stack" (2026). https://redactsure.com/blog/two-gaps-ai-agents-opened-in-your-security-stack/
- Product behavior described on this page reflects RedactSure's current design. Zenity is a trademark of its owner; Microsoft and Copilot Studio are trademarks of Microsoft Corporation; named to identify the products.
What Tools Discover and Secure Enterprise AI Agents?
Review What Tools Discover and Secure Enterprise AI Agents, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
What Is AI Agent Action Governance?
Review AI Agent Action Governance, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
How to Reduce Shadow AI Agents Across Your Enterprise
Review Reduce Shadow AI Agents Across Your Enterprise, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
What Is AI Agent Discovery?
Review AI Agent Discovery for AI agent security, with practical checks on sensitive data, tokenization and named human approvals.
What Is AI Agent Runtime Security?
Review AI Agent Runtime Security, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
Does Copilot Studio Limit What Its Agent Sees?
Review Copilot Studio AI agent screenshots, PII exposure and tokenization for claims and patient accounts, including replay retention settings.
The Two Gaps AI Agents Opened in Your Security Stack
Explore AI agent security through two questions: which PII reaches the model, and who approves consequential billing and claims actions.
What Is Render-Layer Tokenization?
Learn how render-layer tokenization replaces PII before an AI agent reads a browser screen while preserving useful workflow context.
What Is Supervised Delegation?
Explore supervised delegation for AI agents in billing and claims, with named responsibility, tokenization policies and human approvals.
What Is an AI Control Record?
Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.
What Is a Tethered Agent?
Learn how a tethered AI agent stays tied to a named person, with tokenization, bounded permissions and approval for sensitive payments.
Book an AI Agent Security Review →
Bring your hardest questions.
Bring one sensitive workflow and the decisions your team needs to keep in its hands.
Book a demoAbout the author
Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.