WitnessAI Agent Security: Agentic Security and Control
WitnessAI sells security software that governs how a company's employees use AI tools, and now how its AI agents do. In January 2026 it extended that platform to agents with a product called Agentic Security. In June 2026 it added Agentic Control, which governs which MCP servers and tools those agents may call. By the end you will know what the two products do and which claims only WitnessAI has made. It also covers a part of agent security the products do not address: what agents remember.
What is WitnessAI agent security, in one sentence?
WitnessAI agent security is a pair of products that finds the AI agents in a company and controls which MCP servers and tools they may call.
WitnessAI calls itself an AI-native security platform. Its original product governed employee use of chat tools. The January 2026 launch post applied the same model to agents: treat agent activity like employee AI use, and protect agents from malicious input. SiliconANGLE reported the launch alongside a $58 million funding round led by Sound Ventures.
How does WitnessAI agent security differ from a prompt firewall?
A prompt firewall inspects one prompt and one response. Agent security has to follow what happens after the model answers: the tool calls.
| Prompt firewall | WitnessAI Agentic Security (Jan 2026) | WitnessAI Agentic Control (Jun 2026) | |
|---|---|---|---|
| What it watches | Prompts and responses | Agent sessions, told apart from chat by tool use in traffic | The tool boundary where an agent acts on a system |
| Discovery | None | Agents in Claude Desktop, VS Code extensions, ChatGPT plugins and local frameworks | Agents in IDEs, apps, frameworks and custom cloud agents |
| MCP handling | None | Fingerprints each MCP server and classifies its intent | Organization-wide allow lists, with risk scores per tool |
| Enforcement | Block or redact a prompt | Pre-execution scans, PII tokenization, output scans | Calls off the allow list are denied before the tool runs |
| Audit | Prompt logs | One audit log linking agents to the humans who started them | A record per blocked call naming user, agent, tool and rule |
Sources: WitnessAI's Agentic Security post and Agentic Control post.
How does WitnessAI Agentic Security work?
The January product is about seeing agents. WitnessAI says it separates agentic sessions from ordinary chat by spotting tool advertisements in traffic. That lets a security team allow approved agent work while still seeing connections to unverified tools. Each MCP server gets a fingerprint and a category, such as Software Development or Data Access. Its tool calls are tracked over time.
Policies are written around intent. WitnessAI says it reads the meaning of a prompt, which it argues catches prompt injection and multi-turn attacks that keyword lists miss. A scan runs before the agent processes input and blocks injection attempts. Sensitive data such as credentials can be tokenized in real time, and output is scanned before it reaches a user.
The platform also links agent identities to human ones, so an agent-to-agent action traces back to the person who started the workflow. Employees and agents share one policy framework and one audit log.
What does Agentic Control add for MCP servers?
Agentic Control launched on June 17, 2026, and WitnessAI says it is available to all customers.
The launch post names Claude Code, Codex and GitHub Copilot as coding agents it covers in the IDE. A new MCP Catalog scores known tools against OWASP and CVE risk classes, so approvals rest on a recorded assessment. Security teams then publish an organization-wide allow list of MCP servers and tools, a list that often lives in each developer's config file today. A call to anything off the list is denied before the tool runs. WitnessAI says the rule holds across model providers. A tool banned organization-wide stays banned locally. Custom agents can attach the runtime protections through two REST API endpoints on their orchestration layer.
What do WitnessAI's claims leave out?
Most of what is public comes from WitnessAI. The June press release claims a 99.3% true positive rate on employee AI guardrails and coverage of more than 4,000 AI applications. Neither number comes with a published method, and neither is about agents specifically. CEO Rick Caccia's line to SiliconANGLE that WitnessAI is the only vendor that can secure every AI interaction is a sales claim. SiliconANGLE's article adds the funding details. It contains no independent testing or analyst view.
Two practical questions stay open in the posts we read. The January post says no endpoint clients are needed. Neither post explains how traffic from a local IDE agent gets inspected. Intent-based detection also has false positives, and WitnessAI publishes no rate for agent traffic. Ask for both in a trial before you rely on the allow list as your only control.
The bottom line
Many teams let developers run Claude Code or Codex with their own MCP servers. For them, a central allow list with an audit trail closes a real gap, and Agentic Control is one product that provides it. Treat the detection numbers as vendor claims and test them on your own agent traffic. Keep Claude Code's permission rules and hooks too. They run on the machine whether or not traffic is inspected.
How do you keep agent memory auditable for a security review?
Content an agent read from a poisoned page or a bad tool result can end up in its memory and steer later sessions. Coding agents now keep that kind of memory: notes about the codebase and past fixes. A gateway that scans calls in flight does not see what an agent wrote into its own notes yesterday. Security reviewers will ask where that memory lives and whether a person can read it.
memU keeps agent memory as readable Markdown, so a reviewer can open it and delete a bad entry. The agent decides what to remember. memU is open source under Apache-2.0, and its MemoryService makes no LLM or chat calls. It stores the Markdown the agent prepared and retrieves it by embedding search. Self-hosted mode runs privately on one device and needs an embedding key. The hosted mode on memu.so adds cross-device sync.
To self-host, send your agent one message:
Read https://raw.githubusercontent.com/NevaMind-AI/MemU/main/SKILL.md and follow it to install memU.
The code and the support matrix for each agent are in the memU GitHub repository.
FAQ
What is WitnessAI?
WitnessAI is an enterprise AI security company that governs how employees and AI agents use AI tools. Its platform discovers AI usage and enforces policies on prompts and responses at runtime.
What is the difference between WitnessAI Agentic Security and Agentic Control?
Agentic Security, launched in January 2026, discovers agents and scans their inputs and outputs. Agentic Control, launched on June 17, 2026, adds risk-scored MCP tools and an organization-wide allow list enforced before a tool runs.
Does WitnessAI work with Claude Code?
Yes, according to WitnessAI. Its Agentic Control launch post names Claude Code among the coding agents it governs in the IDE. Check deployment details with the vendor, because the posts do not describe the integration.
How much funding has WitnessAI raised?
SiliconANGLE reported a $58 million round in January 2026, led by Sound Ventures, after a $27.5 million round in May 2024.
Is WitnessAI's 99.3% detection rate independently verified?
Not in anything we found. The figure appears in WitnessAI's own press release and applies to employee AI guardrails. No test method is published.