TL;DR · 30-second read

The Short Version

Many programmers and office workers now use artificial intelligence assistants that act on their own. They edit code, open files and pass data to other systems, using the same logins and permissions as the person who installed them.

Noma, a New York security company, launched software that finds these assistants on company laptops, decides what each one may do, and blocks risky actions as they happen.

The bigger shift: companies are moving from asking “is this tool approved?” to “is this specific action allowed?” An assistant might be allowed to read a database but not delete it.

On September 28, 2026, Noma Security announced in a release distributed via PR Newswire that it has extended its AI agent security platform to employee endpoints, meaning the laptops and desktops where staff work. The new capabilities find AI agents, MCP servers and skills running on managed machines. They place those assets under access control and apply runtime protection through Noma’s AI Detection and Response (AI-DR) layer. MCP servers are connectors built on the Model Context Protocol that let agents reach databases, repositories and applications. Skills are packaged instructions that agents load for specific tasks.

Noma says coverage spans agents including Claude Code, Claude Cowork, Cursor, Codex, Windsurf, Kiro, Antigravity and OpenClaw. It works through tools companies already run: endpoint detection and response (EDR) software, mobile device management (MDM) software, agent hooks, AI and MCP gateways, and SDKs. Noma also says it plans to bring its Agent Boundaries feature to the endpoint, without giving a date.

Executive Summary

Noma’s announcement targets a specific problem. AI agents installed by individual employees inherit that employee’s credentials and can chain actions together across a session, such as reading files, calling tools and changing systems, without a human approving each step. Noma’s pitch is that the laptop, not the cloud, is where these agents are multiplying fastest and where security teams have the least visibility.

The product has three layers. Discovery reads local evidence to build a live inventory. Access Control assigns every agent, MCP server and skill a status of approved, needs review or blocked, and ties it to the responsible employee’s identity. AI-DR watches behavior at runtime and can alert, steer, block, mask data or hand an action to a human.

The release’s most important idea is stated in one line: “Approving an agent is not enough.” That marks a change in how enterprises govern AI tools. Deciding once whether an app is allowed is giving way to deciding, continuously, which individual actions an allowed agent may take.

Why the Laptop Became the Blind Spot

Enterprise AI security so far has concentrated on systems the company builds or buys centrally: homegrown applications on cloud AI platforms, and SaaS agent builders run through IT. Coding and productivity agents took a different route. Developers and business users often install them directly, the same way unsanctioned SaaS apps once spread before IT caught up. By the time security notices, the agent already holds the user’s access to source code, production infrastructure, documents and internal data.

MCP servers and skills widen that reach. Each connector adds new tools an agent can call, and each skill adds new instructions it can follow. Noma’s argument is that this exposure “already exists before any attacker is ever involved.” The risk is not only malicious code. It is also a legitimate tool doing something broader than intended, with credentials nobody scoped for it.

From Approving Apps to Governing Actions

The headline shift is visible in how Noma structures control. Its release names at least eight agents from several vendors: Claude Code, Claude Cowork, Cursor, Codex, Windsurf, Kiro, Antigravity and OpenClaw. An approve-or-block decision per application does not scale across that many tools, each with its own connectors and update cycle. Noma instead governs at five levels: the agent, the MCP server, the skill, the individual tool and the specific action. Its example is precise. Read access can stay broadly available while create, update and delete operations are limited to a smaller group.

The runtime layer extends the same logic across time. Noma says its Contextual Policies correlate prompts, tool calls, tool responses, data access and identity across a full session. The goal is to catch threats that “develop across a sequence of otherwise permitted actions.” This is the core of the argument. Every step can be individually allowed while the sequence is harmful, for example an approved database tool turning a routine task into mass deletion. To support the claim that sanctioned tools can misbehave, Noma cites a security researcher’s finding that xAI’s Grok Build coding assistant uploaded tracked repositories and full Git history to the provider’s cloud after being told not to open files.

The people affected are concrete. Security teams gain a registry and policy engine keyed to user and group identity from the company’s identity provider. Developers and business users may see new review states, write restrictions, or human-approval steps inserted mid-session. Agent vendors face customers who expect hooks and telemetry detailed enough to support action-level enforcement.

Riding on EDR and MDM: The Deployment Bet

Noma does not install a new heavyweight agent on every laptop. It connects through EDR or MDM tools already deployed and reads configuration files, skills directories, connector history and running processes. Enforcement runs through agent hooks, gateways and SDKs. That lowers adoption friction, a real advantage in enterprises wary of adding more endpoint software.

The trade-off is dependency. Discovery depends on what existing EDR and MDM tools can see. Inline blocking depends on how much control each agent’s hooks expose. The release frames inventory around managed devices, which leaves personal and unmanaged machines outside the described scope. The approach also places Noma alongside two sets of possible competitors: EDR vendors that already sit on the endpoint, and agent vendors that could build governance controls into their own products.

What the Release Substantiates, and What It Does Not

The functional description is specific. It names detectors (prompt injection, sensitive data leakage, tool poisoning, scope violations, behavioral drift), enforcement modes, and data sources. Security buyers can test claims at that level of detail.

The commercial claims are less specific. “Market-leading,” “widely adopted by Fortune 500 customers,” “hundreds of AI-DR policies” and work with “dozens of Fortune 500 security teams” are not quantified or tied to named customers. The release gives no detection accuracy, false-positive rates or performance impact for inline blocking. Agent Boundaries is described as planned, with no timeline. None of this undercuts the product’s premise, but buyers will need proof-of-concept results rather than the announcement to judge effectiveness.

Background

Noma Security is a New York-based company that sells an AI and agent security platform for large enterprises. Before this announcement, the company described coverage across homegrown AI applications built on AWS Bedrock, Azure AI Foundry and Databricks, SaaS agent platforms such as Microsoft Copilot Studio and Salesforce AgentForce, and prebuilt agents like Claude Code, Cursor and GitHub Copilot on developer machines. Its backers include Evolution Equity Partners, Ballistic Ventures, Glilot Capital, Cyber Club London, Databricks Ventures and SVCI. The company says Gartner has recognized it as a leader in AI trust, risk and security management (AI TRiSM).

The wider market context is the rapid spread of autonomous AI agents. These tools do more than suggest text: they take actions such as editing code, querying databases and operating SaaS apps. The Model Context Protocol has become a common way to connect agents to outside tools. That has made the question of what an agent is permitted to do a security and governance problem, not only a productivity one.

Sources

Source: Noma Extends Agent Security and Governance to the Employee Endpoint, Noma Security’s September 28, 2026 announcement of discovery, access control and runtime protection for AI agents on employee machines.

TL;DR · 30-second read

The Short Version

A software company called Hexnode has built a system where artificial intelligence helpers do routine office tech work largely on their own. Examples include setting up a new employee’s laptop and accounts, or cutting off a computer that may have been hacked.

The big question is how much software should do without a person clicking ‘yes.’ Hexnode says the riskiest moves, like erasing a device, still need human sign-off, and every action is recorded.

Nobody can buy it yet. A small, invitation-only test starts later this year.

Hexnode, the enterprise software division of Mitsogo, unveiled Hexnode Synapse on September 16, 2026, at HexCon26, its annual user conference, according to the company’s announcement datelined Munich. Synapse is described as an agent-based orchestration layer for IT and security operations. It uses specialized AI agents to turn requests, alerts and system events into coordinated, governed and traceable actions across multiple business systems.

At launch, Synapse ships with a device agent, an identity agent and a threat agent. It connects to Hexnode’s own endpoint management, threat detection and identity products, plus ServiceNow, Zendesk, Microsoft Entra ID and BambooHR. An invitation-only trial is planned for later this year.

Executive Summary

Hexnode Synapse is Hexnode’s bid to move AI from answering questions to doing work. Instead of an administrator hopping between a device console, an identity directory, an HR system and a ticketing tool, Synapse’s agents read the request, decide the next step and act within limits set by the administrator. Hexnode’s headline example is a single instruction, ‘Onboard John,’ which pulls the new hire’s HR profile, creates their identity, assigns app licenses by department, pushes device and endpoint-protection settings, and logs the IT ticket.

Hexnode makes governance the central claim. Administrator-defined guardrails, per-action approvals and an exportable execution log called the Execution Center are meant to keep agents under human control. High-impact actions, including wiping a device, isolating an endpoint from the network or changing access privileges, are routed to a designated approver before they run.

The announcement matters because it puts a concrete product behind a question the whole security industry faces: whether autonomous software can be trusted with actions that lock people out, erase data or quarantine machines. For now, the answer rests on design claims. Synapse is not generally available, and Hexnode has not published pricing, customer names or performance data.

The Bottleneck Is the Handoff, Not the Tool

Hexnode’s pitch starts from a familiar complaint in corporate IT: tool sprawl. Chief executive and founder Apu Pavithran framed it plainly, noting that onboarding touches identity, devices and the HR system, and threat response touches the endpoint, user access and the incident ticket. Today, a person stitches those pieces together each time. Every handoff adds manual work and delay.

That framing is important because Synapse does not claim to do anything a skilled administrator cannot already do. Its value proposition is coordination: carrying one request across several systems without a human copying data between screens. For a lean IT team, the gains from eliminating those context switches can be real. However, they are hard to measure from the outside, and Hexnode has not quantified them.

Hexnode’s structural advantage is that it already sells the three systems most involved in these workflows. Those are Hexnode UEM (unified endpoint management, which configures and secures laptops and phones), Hexnode XDR (extended detection and response, which spots and contains threats) and Hexnode IdP (an identity provider, which controls who can log in to what). Synapse draws on native context from all three, which should make its agents better informed inside the Hexnode estate than a bolt-on tool would be.

Autonomy on a Leash

The governance design is the most substantive part of the announcement. It has three layers. Guardrails define what an agent may do on its own. Action-level approvals gate specific steps. The Execution Center records every action, whether autonomous or approved, and teams can search and export that history. Hexnode says this turns audits into a data download rather than an evidence hunt that could stretch for weeks. That is a plausible benefit for regulated organizations, though it is Hexnode’s characterization rather than a measured result.

The harder questions sit in the details. The line between ‘autonomous’ and ‘needs approval’ is set by administrators, so real-world safety depends on sensible defaults and on how easily a busy team can loosen them. Threat containment also carries a built-in tension. Endpoint isolation is on Hexnode’s list of critical actions that require approval, yet speed is the main reason to automate incident response. How organizations balance a waiting approver against a spreading intrusion will likely shape whether the threat agent is used aggressively or cautiously.

There is also the reasoning layer itself. Hexnode says its agents ‘reason’ about incoming requests and alerts to decide the next step. Misjudging an alert, or misreading an HR record during onboarding, could grant the wrong access or miss a real threat. Approvals and logs make such errors visible and reversible after the fact. They do not by themselves make the agents more accurate.

A Platform Play With a Short Integration List

Strategically, Synapse looks like a way to make Hexnode’s product suite more valuable when bought together. Organizations already running Hexnode UEM, XDR and IdP stand to gain the most. Those standardized on other endpoint, security or identity vendors get less, because the launch integrations beyond Hexnode’s own products are limited to ServiceNow and Zendesk for ticketing, Microsoft Entra ID for identity and BambooHR for HR data.

Those are sensible first choices that cover common help-desk, directory and HR systems, but many enterprises run a wider mix. Hexnode says it will expand the integration catalog and Synapse’s core capabilities in future phases, and that customers can configure custom agents built on their own tools and knowledge sources. How far custom agents can reach, and whether the same guardrails apply to them, will determine whether Synapse becomes a genuine cross-vendor orchestration layer or remains mainly a Hexnode accessory.

Announced, Not Yet Proven

Synapse will enter an invitation-only trial later this year, which makes this announcement a statement of direction rather than a shipping product. The self-healing behavior Hexnode describes is a good illustration of what still needs field testing. In Hexnode’s example, a stalled onboarding recovers on its own, files a ticket when app licenses run out, and resumes provisioning once a seat frees up. It is a compelling scenario, but real IT environments are messier than demonstrations.

For buyers, the practical takeaway is to treat the trial as an evaluation of governance as much as of automation. Useful checks include whether approvals route cleanly, whether logs are complete enough for auditors, and how often the agents pick the right next step. For the broader market, Synapse adds to evidence that endpoint and identity vendors see agentic AI as the next competitive front, and that trust controls, rather than raw autonomy, are becoming the selling point.

Background

Hexnode is the enterprise software arm of Mitsogo. It is best known for unified endpoint management (UEM), the category of tools companies use to enroll, configure, update and secure employee laptops, phones and other devices from one console. The company has since added Hexnode XDR, an extended detection and response product that spots and contains security threats, and Hexnode IdP, an identity provider that governs who can sign in to which applications. HexCon is Hexnode’s annual user conference, where it typically showcases new products.

Synapse arrives as enterprise software vendors move beyond AI assistants that answer questions toward agentic AI that takes actions. In IT and security, that shift is especially sensitive. The same actions that save time, such as granting access, wiping a lost device or isolating a compromised computer, can cause serious disruption if triggered wrongly. As a result, approval workflows and audit trails have become central to how vendors present these products.

Sources

Source: Hexnode presenta Hexnode Synapse, que aporta orquestación basada en agentes a las operaciones de TI y seguridad, Hexnode’s announcement of its agent-based orchestration layer for IT and security operations, unveiled at HexCon26.