Many programmers and office workers now use artificial intelligence assistants that act on their own. They edit code, open files and pass data to other systems, using the same logins and permissions as the person who installed them.
Noma, a New York security company, launched software that finds these assistants on company laptops, decides what each one may do, and blocks risky actions as they happen.
The bigger shift: companies are moving from asking “is this tool approved?” to “is this specific action allowed?” An assistant might be allowed to read a database but not delete it.
On September 28, 2026, Noma Security announced in a release distributed via PR Newswire that it has extended its AI agent security platform to employee endpoints, meaning the laptops and desktops where staff work. The new capabilities find AI agents, MCP servers and skills running on managed machines. They place those assets under access control and apply runtime protection through Noma’s AI Detection and Response (AI-DR) layer. MCP servers are connectors built on the Model Context Protocol that let agents reach databases, repositories and applications. Skills are packaged instructions that agents load for specific tasks.
Noma says coverage spans agents including Claude Code, Claude Cowork, Cursor, Codex, Windsurf, Kiro, Antigravity and OpenClaw. It works through tools companies already run: endpoint detection and response (EDR) software, mobile device management (MDM) software, agent hooks, AI and MCP gateways, and SDKs. Noma also says it plans to bring its Agent Boundaries feature to the endpoint, without giving a date.
Executive Summary
Noma’s announcement targets a specific problem. AI agents installed by individual employees inherit that employee’s credentials and can chain actions together across a session, such as reading files, calling tools and changing systems, without a human approving each step. Noma’s pitch is that the laptop, not the cloud, is where these agents are multiplying fastest and where security teams have the least visibility.
The product has three layers. Discovery reads local evidence to build a live inventory. Access Control assigns every agent, MCP server and skill a status of approved, needs review or blocked, and ties it to the responsible employee’s identity. AI-DR watches behavior at runtime and can alert, steer, block, mask data or hand an action to a human.
The release’s most important idea is stated in one line: “Approving an agent is not enough.” That marks a change in how enterprises govern AI tools. Deciding once whether an app is allowed is giving way to deciding, continuously, which individual actions an allowed agent may take.
Why the Laptop Became the Blind Spot
Enterprise AI security so far has concentrated on systems the company builds or buys centrally: homegrown applications on cloud AI platforms, and SaaS agent builders run through IT. Coding and productivity agents took a different route. Developers and business users often install them directly, the same way unsanctioned SaaS apps once spread before IT caught up. By the time security notices, the agent already holds the user’s access to source code, production infrastructure, documents and internal data.
MCP servers and skills widen that reach. Each connector adds new tools an agent can call, and each skill adds new instructions it can follow. Noma’s argument is that this exposure “already exists before any attacker is ever involved.” The risk is not only malicious code. It is also a legitimate tool doing something broader than intended, with credentials nobody scoped for it.
From Approving Apps to Governing Actions
The headline shift is visible in how Noma structures control. Its release names at least eight agents from several vendors: Claude Code, Claude Cowork, Cursor, Codex, Windsurf, Kiro, Antigravity and OpenClaw. An approve-or-block decision per application does not scale across that many tools, each with its own connectors and update cycle. Noma instead governs at five levels: the agent, the MCP server, the skill, the individual tool and the specific action. Its example is precise. Read access can stay broadly available while create, update and delete operations are limited to a smaller group.
The runtime layer extends the same logic across time. Noma says its Contextual Policies correlate prompts, tool calls, tool responses, data access and identity across a full session. The goal is to catch threats that “develop across a sequence of otherwise permitted actions.” This is the core of the argument. Every step can be individually allowed while the sequence is harmful, for example an approved database tool turning a routine task into mass deletion. To support the claim that sanctioned tools can misbehave, Noma cites a security researcher’s finding that xAI’s Grok Build coding assistant uploaded tracked repositories and full Git history to the provider’s cloud after being told not to open files.
The people affected are concrete. Security teams gain a registry and policy engine keyed to user and group identity from the company’s identity provider. Developers and business users may see new review states, write restrictions, or human-approval steps inserted mid-session. Agent vendors face customers who expect hooks and telemetry detailed enough to support action-level enforcement.
Riding on EDR and MDM: The Deployment Bet
Noma does not install a new heavyweight agent on every laptop. It connects through EDR or MDM tools already deployed and reads configuration files, skills directories, connector history and running processes. Enforcement runs through agent hooks, gateways and SDKs. That lowers adoption friction, a real advantage in enterprises wary of adding more endpoint software.
The trade-off is dependency. Discovery depends on what existing EDR and MDM tools can see. Inline blocking depends on how much control each agent’s hooks expose. The release frames inventory around managed devices, which leaves personal and unmanaged machines outside the described scope. The approach also places Noma alongside two sets of possible competitors: EDR vendors that already sit on the endpoint, and agent vendors that could build governance controls into their own products.
What the Release Substantiates, and What It Does Not
The functional description is specific. It names detectors (prompt injection, sensitive data leakage, tool poisoning, scope violations, behavioral drift), enforcement modes, and data sources. Security buyers can test claims at that level of detail.
The commercial claims are less specific. “Market-leading,” “widely adopted by Fortune 500 customers,” “hundreds of AI-DR policies” and work with “dozens of Fortune 500 security teams” are not quantified or tied to named customers. The release gives no detection accuracy, false-positive rates or performance impact for inline blocking. Agent Boundaries is described as planned, with no timeline. None of this undercuts the product’s premise, but buyers will need proof-of-concept results rather than the announcement to judge effectiveness.
Background
Noma Security is a New York-based company that sells an AI and agent security platform for large enterprises. Before this announcement, the company described coverage across homegrown AI applications built on AWS Bedrock, Azure AI Foundry and Databricks, SaaS agent platforms such as Microsoft Copilot Studio and Salesforce AgentForce, and prebuilt agents like Claude Code, Cursor and GitHub Copilot on developer machines. Its backers include Evolution Equity Partners, Ballistic Ventures, Glilot Capital, Cyber Club London, Databricks Ventures and SVCI. The company says Gartner has recognized it as a leader in AI trust, risk and security management (AI TRiSM).
The wider market context is the rapid spread of autonomous AI agents. These tools do more than suggest text: they take actions such as editing code, querying databases and operating SaaS apps. The Model Context Protocol has become a common way to connect agents to outside tools. That has made the question of what an agent is permitted to do a security and governance problem, not only a productivity one.
Companies are starting to let artificial intelligence software act on its own — sending emails, moving money, pulling up customer records — without a person approving each step. If one of those systems is tricked or badly set up, it can leak data or take a wrong action in seconds.
NeuralTrust, a Barcelona company that sells software to watch and restrain those systems, has opened an office in London to serve British banks, airlines and large firms. It says it raised twenty million dollars in June to expand.
NeuralTrust, a Barcelona-headquartered platform for securing AI agents, announced on 7 September 2026 that it has opened a dedicated London office at 167 Great Portland Street. The company says the site will serve as its hub for UK customers, partners and hiring, supporting a client base spanning financial services, technology and other large enterprises, and that it plans to recruit across sales, customer success and engineering in the coming months.
The expansion follows a $20 million seed round the company raised in June 2026, which it describes as the largest cybersecurity seed financing by an EU company to date. NeuralTrust now lists offices in Barcelona, London and New York, and says its customers include global banks, airlines, energy companies and government agencies.
Executive Summary
The announcement is, on its face, a routine go-to-market step: a well-funded European security startup putting staff on the ground in one of the world’s largest financial centres. What makes it worth reading closely is the problem it is chasing. Enterprises are moving from AI systems that answer questions to AI agents — software that takes actions on a company’s behalf, calling internal tools, querying databases and triggering transactions, often with no human approving each step.
That shift breaks a core assumption behind most existing security controls. Traditional tooling is built to police users, devices and network traffic against rules that are known in advance. An agent’s behaviour is generated at runtime from natural-language input, which means an attacker can attempt to redirect it with text — the class of attack known as prompt injection — rather than with code. NeuralTrust sells three products aimed at that gap: TrustGate, a gateway that sits between applications, agents, tools and models to enforce policy and control access; TrustGuard, runtime monitoring that blocks unsafe agent behaviour as it happens; and TrustTest, a red-teaming tool that probes AI systems for weaknesses before attackers find them.
The strategic read is that NeuralTrust is betting UK buyers — particularly regulated banks and airlines, where an unauthorised automated action carries immediate legal and operational consequence — will pay for agent governance sooner than buyers elsewhere. The company’s UK managing director, Cameron Brown, frames the office in exactly those terms. Whether that bet pays off depends on questions the announcement does not settle.
Why Agent Security Is Not Just Application Security
The security industry has spent two decades learning to defend systems whose behaviour is deterministic: given the same input, the same code path runs. Agents break that. They are given goals in plain language, decide which tools to call, and chain those calls together in sequences nobody wrote down in advance. A firewall sees an outbound API request; it does not see that the request was the third step in a plan an agent improvised after reading a malicious instruction hidden in a customer support ticket.
This is why the gateway pattern NeuralTrust is selling with TrustGate has become the consensus architecture across this young market. Putting a control point between the agent and everything it can touch — models, internal tools, data stores — restores the thing traditional security depends on and agents destroy: a chokepoint where policy can be enforced and activity can be logged. It is the same instinct that produced API gateways and, before them, web proxies. The harder part is TrustGuard’s job: deciding, in real time and without adding latency a user would notice, whether a given agent action is legitimate. That is a detection problem with no settled ground truth, and vendors across the category are still establishing what good looks like.
Red teaming, NeuralTrust’s third product line, is the least glamorous and arguably the most immediately saleable piece. Security teams asked to sign off on an agent deployment need evidence, and “we attacked it ourselves and here is what broke” is evidence a CISO can take to a risk committee. It also maps cleanly onto assurance processes enterprises already run for conventional software.
A Crowded Layer of the Stack
NeuralTrust is not entering an empty field. The control point between an application and a model is contested by several groups at once: cloud providers shipping native guardrail and filtering services with their own model platforms; established API management and identity vendors extending existing gateways to cover model traffic; a cohort of AI-security startups funded through 2025 and 2026; and open-source projects that give engineering teams a serviceable proxy for free. Each has a structural advantage. The hyperscalers own the deployment surface and can bundle. The incumbents own the buyer relationship and the procurement slot. Open source owns the price.
The independent vendor’s counter-argument is portability. An enterprise running agents across multiple model providers, several clouds and a mix of internal and third-party tools cannot govern that estate from any single provider’s native console, and will not want its policy layer to be an artefact of a vendor it may want to leave. NeuralTrust’s positioning — a platform spanning “every platform and endpoint” — is aimed squarely at that argument, and the customer profile it describes, global banks and airlines with heterogeneous estates and hard regulatory obligations, is where it is most persuasive.
The commercial risk is timing rather than technology. If the market consolidates before independent vendors reach durable scale, the natural outcome is acquisition by a platform security company rather than category leadership. A $20 million seed is substantial for the stage, and larger than typical for European cybersecurity, but it is not the war chest of a firm intending to outspend cloud providers on distribution. Spreading a round of that size across Barcelona, London and New York simultaneously is an aggressive allocation, and it implies the company expects revenue to arrive quickly enough to fund the next phase.
Why London, and What an Office Actually Proves
London is a rational first international bet for this product. The concentration of banks, insurers and airlines in the UK gives a vendor a dense cluster of buyers who share the same risk profile, and financial services firms operate under supervisory expectations around operational resilience and third-party technology risk that push governance spending forward rather than leaving it to discretion. Sales cycles in the sector are slow and reference-driven, which rewards local presence: a named managing director and a staffed office change how a procurement committee reads a vendor’s commitment.
It is worth being precise about what an office opening does and does not demonstrate. It is a genuine cost commitment and a credible signal of intent, and paired with disclosed funding it is more than a press exercise. It is not evidence of revenue, contracted capacity or customer count in the market being entered. NeuralTrust states that it partners with major UK industry bodies and serves financial services, technology and enterprise clients in the region, but attaches no names, numbers or contract values to those statements. Both things can be true at once: the expansion is real, and its commercial scale is unquantified.
Reading the Supporting Claims
NeuralTrust cites a Gartner prediction that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because governance gaps surface only after something has gone wrong in production. That figure is a forecast, not a measurement of anything that has happened, and forecasts of AI adoption have proven volatile in both directions. It is nonetheless directionally consistent with what enterprise buyers report: pilots that reach production and then stall when nobody can answer basic questions about what the agent did, why, and who is accountable. Used as a description of a pattern, it is useful. Used as a market-size proxy, it should carry a wide error bar.
The company also describes itself as a category leader recognised by Gartner, KuppingerCole and MarketsandMarkets, and its June round as the largest cybersecurity seed financing by an EU company to date. These are checkable claims of different weight. Analyst recognition depends heavily on which specific report, which category and which evaluation criteria — details the announcement does not specify. The funding superlative is narrowly scoped by geography, sector and stage, which is how such records are usually constructed; it says something real about European cybersecurity funding levels and less about NeuralTrust’s standing against globally funded competitors.
None of this undercuts the underlying thesis, which is the strongest part of the announcement. The gap between how quickly enterprises can deploy agents and how quickly security teams can build monitoring, policy and incident response for them is real, widely reported by practitioners, and unlikely to close on its own. A vendor addressing it with a gateway, runtime controls and adversarial testing is addressing the right problem. The open question is execution, not diagnosis.
Background
Enterprise adoption of generative AI moved through a recognisable sequence: internal chat assistants, then retrieval systems answering questions over company documents, and now agents that take actions. The final step is where the security model changes, because an agent that can call an internal payments interface or update a customer record introduces operational risk in a way a chatbot does not. Security teams have found their existing tooling largely blind to it — identity systems were designed around human users, network controls around known traffic patterns, and neither explains why an autonomous system chose a particular sequence of steps.
That gap produced a wave of specialist vendors from 2024 onward, converging on a common architecture of a policy-enforcing gateway, runtime behavioural monitoring and adversarial testing. NeuralTrust, founded in Barcelona, is among the more heavily funded European entrants, having raised a $20 million seed in June 2026 and previously launched what it describes as a runtime security mesh extensible across every AI agent. Its expansion into London places it in a market where financial-services regulation around operational resilience and third-party technology risk gives security buyers an unusually early mandate to govern AI systems in production.
