Home / Reports
State of AI Agent Security Tools, October 2026
Published by Agent Security Index. Data as of .
As of October 24, 2026. Data last updated October 24, 2026. Source: the Agent Security Index open dataset (https://agentsecurityindex.com/data/tools.json).
Cite this: Agent Security Index, "State of AI Agent Security Tools, October 2026", https://agentsecurityindex.com/reports/state-of-ai-agent-security-2026-10/ (data as of Oct 24, 2026).
Headline numbers
- 83 AI agent security tools are listed, in 6 categories.
- 37 of 83 (44.6%) are open source or have an open-source edition. 42 (50.6%) are commercial only. 4 (4.8%) are cloud-provider services.
- 38 of the 62 tools that are not purely open source (61.3%) have no public pricing recorded.
- 23 of 83 (27.7%) have a source-linked acquisition record. 14 of those 23 first date to 2026.
- The directory grew from 78 to 83 tools between Oct 18 and Oct 24, 2026 (+6.4%).
Tools per category
| Category | Tools | Open source | Open source + commercial | Commercial | Cloud service | Open-source share* | Added since Oct 18 |
|---|---|---|---|---|---|---|---|
| Prompt-injection firewalls & guardrails | 16 | 4 | 1 | 7 | 4 | 31% | 0 |
| Agent identity & authorization | 15 | 0 | 2 | 13 | 0 | 13% | 2 |
| MCP gateways & scanners | 14 | 8 | 3 | 3 | 0 | 79% | 1 |
| AI red teaming & evals | 14 | 7 | 2 | 5 | 0 | 64% | 0 |
| Agent runtime security & posture | 12 | 1 | 0 | 11 | 0 | 8% | 1 |
| Agent audit & observability | 12 | 1 | 8 | 3 | 0 | 75% | 1 |
| Total | 83 | 21 | 16 | 42 | 4 | 44.6% | 5 |
*Open-source share = "Open source" plus "Open source + commercial", divided by the category total, rounded.
Open source versus commercial
- 21 tools (25.3%) are open source only.
- 16 tools (19.3%) are open source with a commercial offer.
- 42 tools (50.6%) are commercial only.
- 4 tools (4.8%) are cloud-provider services.
- 37 tools have a public GitHub repository recorded. 36 of them have a license recorded.
- Licenses recorded: Apache-2.0 (20), MIT (12), GPL-3.0 (1), AGPL-3.0 (1), Elastic License 2.0 (1), MIT with an exception for
ee/directories (1). - Open source is common in MCP gateways & scanners (79%), audit & observability (75%) and red teaming & evals (64%). It is rare in runtime security (8%) and agent identity (13%).
Pricing
Our pricing field holds only prices a vendor publishes. A blank means we could not verify a public price. It does not mean the product is free or "contact sales".
| Pricing field | Tools | Share of 83 |
|---|---|---|
| Free (open source) | 22 | 26.5% |
| Free tier or $0 plan, plus paid options | 16 | 19.3% |
| Paid plans only (no free tier recorded) | 3 | 3.6% |
| Usage-based only | 4 | 4.8% |
| No public pricing recorded (blank) | 38 | 45.8% |
- 17 pricing records include at least one dollar amount.
- 6 records mention an "Enterprise" plan. 3 of those say custom pricing or sales-led pricing.
- The 38 blanks are all tools that are commercial, hybrid or cloud services. Every purely open-source tool has a pricing entry.
- Blank pricing by category: runtime security 9 of 12, firewalls & guardrails 8 of 16, identity 7 of 15, red teaming 6 of 14, MCP 5 of 14, audit & observability 3 of 12.
What changed this month
The directory listed 78 tools after a full verification pass on Oct 18, 2026. Five tools were added in the following five days.
New entrants (from the changelog)
| Date added | Tool | Category | License model in our data |
|---|---|---|---|
| Oct 19, 2026 | PlainID | Agent identity & authorization | Commercial |
| Oct 20, 2026 | Red Hat MCP Gateway (generally available since Oct 16) | MCP gateways & scanners | Open source + commercial |
| Oct 21, 2026 | Agent Beacon (Asymptote Labs), MIT license; re-checked against the vendor's docs on Oct 24 and kept as open source plus commercial | Agent audit & observability | Open source + commercial |
| Oct 22, 2026 | NVIDIA OpenShell, Apache-2.0 | Agent runtime security & posture | Open source |
| Oct 22, 2026 | BeyondTrust AI Agent Security (generally available since Oct 21) | Agent identity & authorization | Commercial |
Notable updates logged
- Oct 18: Lakera Guard is now sold as Check Point AI Guardrails. MintMCP is now Mintive. LLM Guard is marked archived and unmaintained. Helicone is marked in maintenance mode.
- Oct 20: Prisma AIRS added AI Gateway MCP Guardrails (announced Oct 15). Descope released Agentic Identity Hub 3.0 (Oct 15).
- Oct 21: Gray Swan relaunched its Arena on Oct 20 with a $300K indirect prompt-injection challenge. Straiker announced a Workday Agent Passport red-teaming integration (Oct 16).
- Oct 22: Noma Security's runtime product now integrates with NVIDIA OpenShell (announced Oct 21).
- Oct 23: Prisma AIRS made Idira agent identity security generally available (announced Oct 22). Docker MCP Gateway carries a security note: CVE-2026-55887 affects versions 0.21.0 through 0.42.1 and is fixed in 0.42.2.
- Oct 24: Agent Beacon was re-checked against the vendor's docs. It stays listed as open source plus commercial (MIT-licensed open-source Beacon; Asymptote Managed and private deployments offered on request), with a refreshed description and sources.
Ownership changes on record
- 23 listings carry an acquisition record with a source link. Two of them (LLM Guard and Prisma AIRS) refer to the same Protect AI deal.
- 16 records are marked completed or closed. 6 are marked announced. 1 says "acquired" with no status word.
- 14 records first date to 2026 and 9 to 2025.
- Four records carry a September or October 2026 date: Oasis Security (Cyera, completed Sep 3), Guardrails AI (Harvey, announced Sep 8), Oso (Tiny, closed Oct 1) and Arize Phoenix (Dynatrace, completed Oct 1).
- Share of each category with an acquisition record: audit & observability 6 of 12 (50%), firewalls & guardrails 6 of 16 (37.5%), identity 4 of 15 (26.7%), red teaming 4 of 14 (28.6%), runtime security 2 of 12 (16.7%), MCP gateways & scanners 1 of 14 (7.1%).
- 2 more listings have an ownership note that is not an acquisition: Snyk Agent Scan (repository moved to Snyk) and agentgateway (hosted by the Agentic AI Foundation since Jun 4, 2026).
Freshness
- 71 of 83 listings were last verified on Oct 18. The other 12 were verified between Oct 19 and Oct 24 (5 new listings and 7 others).
- No listing was last verified before Oct 18.
- Daily link checks on Oct 20 to Oct 23 found 0 broken internal pages each time. Each run flagged 3 or 4 outbound links. Our run notes attribute these to vendor sites that block automated requests.
Takeaways
- The category count is stable. The list is growing at the edges. All six categories hold 12 to 16 tools. Identity gained two tools in five days, the most of any category.
- Open source leads in the infrastructure layers. About four in five MCP tools and three in four audit tools have an open-source edition. Only one of 12 runtime security tools is open source only.
- Half the commercial market does not publish prices. 61.3% of tools that are not purely open source have no public price recorded. Runtime security is the most opaque category (9 of 12).
- Where prices are public, a free tier is the norm. Of the 19 tools with published plan prices, 16 offer a free tier or $0 plan.
- Ownership is shifting. More than one in four listed tools has a recorded acquisition. Audit & observability is highest at 50%.
- Product news arrives daily. Nine update lines and five new listings were logged across seven passes, Oct 18 to Oct 24. Several tie products together, such as Noma with NVIDIA OpenShell and Prisma AIRS with agent identity.
How we collected this
- Agent Security Index is an independent, vendor-neutral directory. A tool is listed with a category, an official URL, a description, a license model, a license, public pricing, the maker, ownership or acquisition, a source repository and a last-verified date.
- Each field comes from the vendor's own site, its public GitHub repository, or a linked public source such as a press release or SEC filing. If we cannot confirm a fact, the field stays blank.
- We verified all 78 listings on Oct 18, 2026 and log every later update in the public changelog (https://agentsecurityindex.com/changelog/).
- All figures here are computed from the open dataset and the changelog as of Oct 24, 2026. The latest data update was Oct 24, 2026.
- Limits. This is a directory, not a census of the market. Counts describe the tools we list. A tool that is not listed is not counted. Percentages are rounded to one decimal place. Pricing figures cover only vendors that publish prices. Category assignment is our own.
- Corrections. If a figure here is wrong, tell us and we will fix it and log the fix.
Appendix: methods and reproduction
Every number above is computed by a short script over the open dataset and the public changelog. The method is written out below so you can check it.
Inputs:
- The open dataset at https://agentsecurityindex.com/data/tools.json (83 records, one per tool).
- The public changelog at https://agentsecurityindex.com/changelog/.
- Our own daily run notes for Oct 20 to Oct 23, 2026, used only for the link-check results.
Definitions
| Figure | Computation |
|---|---|
| Total tools | Row count of the dataset (83). |
| Per category | Count of rows by the category column. |
| Open source or hybrid | Rows where model starts with "Open source" (21 + 16 = 37). |
| Commercial only | Rows where model is "Commercial" (42). Cloud service (4) is counted separately. |
| Licenses | Count of non-empty license values. The value "MIT (except ee/ directories, separate license)" is shown as MIT with an exception. |
| Pricing buckets | From the pricing column. Blank → "No public pricing recorded". Exactly "Free (open source)" → free. Starts with "Usage-based" → usage-based. Contains "free" or "$0" (any case) → free tier or $0 plan. Anything else → paid plans only. |
| Blank pricing among non-pure-open-source tools | Rows with blank pricing and model not equal to "Open source" (38), divided by rows with model not equal to "Open source" (62). |
| Ownership records | Rows with a non-empty parent_or_acquisition (25). All 25 also have a parent_source URL. |
| Acquisition records | Ownership records whose text contains "acqui" (case-insensitive): 23. The other 2 are Snyk Agent Scan and agentgateway. |
| Acquisition status | Text contains "closed" or "complet" → completed (16). Otherwise contains "announced" → announced (6). Otherwise other (1). |
| Acquisition year | Year of the first date written in the record text. |
| New entrants | Changelog lines that start with "Added ", matched to a tool name in the dataset (5). |
| Oct 18 baseline | The Oct 18 changelog line "Verified all 78 listings". Check: 83 minus the 5 added tools gives 78, and the per-category counts sum to 78. |
| Growth | (83 − 78) / 78 = 6.4%. |
| Updates logged | Changelog lines starting "Updated", "Replaced" or "Renamed". Two Oct 18 lines each cover several tools, so the line count (9) is not a tool count. |
| Freshness | Count of rows by last_verified: Oct 18 (71), Oct 19 (1), Oct 20 (3), Oct 21 (2), Oct 22 (3), Oct 23 (2), Oct 24 (1). |
| Link checks | Regex over the daily notes: "N pages, 0 bad internal, M outbound flagged". Oct 20: 99 pages, 4 flagged. Oct 21: 99 pages, 4. Oct 22: 100 pages, 3. Oct 23: page count not recorded, 3. |
Quick spot check
curl -s https://agentsecurityindex.com/data/tools.json | python3 -c "import json,sys,collections;t=json.load(sys.stdin)['tools'];print(len(t),collections.Counter(x['category'] for x in t))"Reproducibility note: the figures reflect the dataset as it stood on Oct 24, 2026. The live dataset changes over time, so a later check can differ. We will publish a new report rather than silently edit this one, and log any correction in the changelog.