Microsoft wants to be the place where every agent in your company signs in. Zenity wants to watch what those agents do once they are inside. They sound like competitors. On paper they look more like a landlord and a very good security guard. We read the documentation, the price lists and the small print, and looked at who else is in the market. Checked on 27 October 2026.
Documentation review: not tested. We have not used the products in this review. It is a structured reading of published evidence, linked throughout. How we review products explains what that covers.
Status: correct as at 27 October 2026. Prices are public list prices as displayed on the dates given; real deals are negotiated.
Disclosure: no vendor sponsored, reviewed or saw this review before publication, and there are no affiliate links. Microsoft’s venture fund, M12, led an investment in Zenity in 2024, and the two companies sell together; see ‘Two different animals’. Our independence policy explains how we work.
Verdict
Agent 365 is the sensible default control plane for a Microsoft-centred estate; Zenity is the stronger choice for runtime security across many platforms; neither one does AI FinOps.
- Good for: Agent 365 suits organisations already on Microsoft 365 E5 that want identity, registry and policy for their agents in one place. Zenity suits security teams whose agents are spread across Microsoft, Salesforce, ServiceNow, ChatGPT Enterprise, AWS and coding tools.
- Not for: Agent 365 is a poor fit for shops without E5 or the Defender and Purview suites. Zenity is a poor fit for anyone looking for a full governance and records platform or a cost dashboard.
- Price: Agent 365 costs £11.50 per user per month, paid yearly, excluding VAT (opens in a new tab) (checked 27 October 2026). Zenity lists usage-based rates on AWS Marketplace, including $130 per resource per month for observability (opens in a new tab) (checked 27 October 2026). Otherwise its prices are by quote.
- Score: No numeric score (documentation review)
Two different animals
Microsoft Agent 365 reached general availability for commercial customers on 1 May 2026 (opens in a new tab). Microsoft describes it in three verbs: observe, govern and secure. In practice it is a control plane assembled from parts Microsoft already sells: Entra for identity, Purview for data and compliance, Defender for threats, and a registry that ties them together.
Microsoft’s own overview (opens in a new tab) says it “works best when using Microsoft E5”. That is a polite way of saying it is built for E5 customers.
Zenity is a specialist. It was founded in 2021 (opens in a new tab), does its research and development in Tel Aviv and runs its commercial operation from New York, according to its Series C announcement (opens in a new tab). That round, announced on 3 August 2026, raised $125 million.
Zenity sells security and governance for agents wherever they are built: SaaS copilots, low-code builders, cloud platforms and coding assistants on developers’ laptops. Its homepage (opens in a new tab) puts it in three words: surface, enforce, protect.
Before anyone gets excited about a feud, there is a conflict of interest to declare. M12, Microsoft’s venture fund, led a strategic investment in Zenity on 30 July 2024 (opens in a new tab). Since then Zenity has:
- listed in the Azure Marketplace (opens in a new tab);
- joined the Microsoft Security Store partner ecosystem (opens in a new tab), announced 30 September 2025;
- shipped an integration with Agent 365 (opens in a new tab), announced 4 August 2026, that puts Zenity’s runtime risk signals inside Microsoft’s console.
So Microsoft has a financial interest in Zenity, and Zenity has a commercial interest in Microsoft’s success. We have no interest in either. Read the comparison with that in mind, and expect “Agent 365 and Zenity” to be a more common answer than “Agent 365 or Zenity”.
Head to head
| Area | Microsoft Agent 365 | Zenity |
|---|---|---|
| What it is | Control plane for agents, built on Entra, Purview and Defender | Specialist platform for agent security and governance |
| Inventory and discovery | Registry of Microsoft-built agents. Local-agent discovery on endpoints. Registry sync (opens in a new tab) with Bedrock, Vertex AI, Claude Managed Agents, Agentforce, Databricks Genie, Oracle and Snowflake, with manual sync only. | Inventory across SaaS, cloud, custom and endpoint agents (opens in a new tab), plus MCP servers, including shadow servers (opens in a new tab) |
| Tracing and telemetry | OpenTelemetry-based SDK (opens in a new tab). Third-party tracing (opens in a new tab) is a Frontier preview, due to roll out from late October 2026 (opens in a new tab), with general availability planned for late November. | Execution paths, tool calls, memory and retrieval, per the observability page (opens in a new tab) |
| Agent identity | Entra Agent ID (opens in a new tab), with sponsors, Conditional Access and lifecycle controls | Reads identities from Entra ID and Okta (opens in a new tab) and maps agent permissions |
| Runtime enforcement | Defender audit and block rules (opens in a new tab) on supported tools | Boundaries engine (opens in a new tab), with stateful multi-step rules and simulation |
| MCP and tool risk | Through Azure API Management (preview) (opens in a new tab). Tool-level blocking needs the AI Gateway tier. | MCP gateway (opens in a new tab) that can allow, modify or block tool calls |
| Compliance mapping | EU AI Act, ISO/IEC 42001 and NIST AI RMF templates in Purview Compliance Manager (opens in a new tab) | NIST AI RMF, GDPR, HIPAA, PCI-DSS and others (opens in a new tab). We found no mention of the EU AI Act or ISO 42001. |
| FinOps | Flat per-user licence. No token or cost metering found. | No cost features found |
| List price | £11.50 per user per month (opens in a new tab), or included in E7 | $130 per resource per month, $16 per million tokens (opens in a new tab) (AWS listing) |
| Prerequisites | Enterprise: E5, or E3 plus the Defender and Purview suites (opens in a new tab). Business Premium, frontline and education plans have their own routes | None published |
Observability: first, find the agents
You can’t govern an agent you don’t know about. Agent 365 starts with a registry. Agents built in Copilot Studio, Foundry and Microsoft’s own builders appear there automatically. For the rest, Microsoft’s integration guide (opens in a new tab) offers registry sync (opens in a new tab) for platforms including Amazon Bedrock, Google Vertex AI (which Google has folded into its Gemini Enterprise Agent Platform (opens in a new tab)), Salesforce Agentforce and Databricks Genie, an SDK for frameworks such as LangChain, CrewAI and the OpenAI Agents SDK, and endpoint discovery for local agents.
On 19 October 2026 (opens in a new tab) Microsoft said local discovery now includes Claude Code, OpenAI Codex and GitHub Copilot. That is a quiet admission that a large share of agent activity now lives in developers’ terminals rather than in SharePoint.
Telemetry runs on OpenTelemetry (opens in a new tab), which is the right call: your traces aren’t locked into a proprietary format.
Agents outside Microsoft’s estate are a different story. Microsoft’s own documentation (opens in a new tab) labels third-party observability a Frontier preview. It covers agents on Amazon Bedrock (classic agents and AgentCore), Google Vertex AI, Anthropic’s Claude Managed Agents, Salesforce Agentforce and Databricks Genie. According to Message Center item MC1480873 (opens in a new tab), public preview is due to begin rolling out in late October 2026, with general availability planned for late November; both dates have already slipped once. Synced third-party agents don’t get the Users metric, telemetry is kept for 30 days, and Microsoft says it doesn’t yet guarantee that connection changes appear in the Purview audit log.
The same Message Center item adds a warning: “Third-party providers may charge for tracing, storage, logging, or query services.” Hold that thought for FinOps.
Zenity’s observability (opens in a new tab) starts from the opposite end. It assumes agents are everywhere and builds one inventory across SaaS platforms, cloud builders, custom code and endpoints. It then traces execution paths, tool calls, memory and retrieval.
Zenity’s MCP page (opens in a new tab) goes a step further. It describes finding MCP servers that nobody approved, including ones pulled from public registries, and logging each request in a live view. For a security team the question is not “which Copilot Studio bots do we own” but “what is talking to what”. Zenity’s documentation answers that more directly.
Edge: Zenity for breadth across platforms today. Agent 365 for depth inside Microsoft, with third-party coverage that is improving but still in preview.
FinOps: neither product ships it
How does each product handle cost? Neither really does, and the documentation says as much if you read closely.
Agent 365’s pricing is pleasingly simple. Microsoft’s licensing FAQ (opens in a new tab) says:
- the licence is per user;
- agents themselves are not licensed and there are no per-agent charges;
- “There are no consumption-based costs for Agent 365 yet.”
“Yet” is doing a lot of work in that sentence.
The UK price (opens in a new tab) is £11.50 per user per month on an annual commitment. Agent 365 is also bundled into Microsoft 365 E7 at £81.60. Microsoft recommends a licence “for all users who interact with, own, manage, or sponsor” managed agents, which in a busy tenant could mean most people.
A foundational tier, included with every Microsoft cloud subscription with no separate charge, covers identity, the registry, basic usage insights and audit. The paid tier adds advanced usage insights and the Agent Map.
What you won’t find is a token meter, a cost-per-agent view or chargeback. The money agents actually burn sits elsewhere: in Copilot Studio credits (opens in a new tab), sold at $200 a month for 25,000 credits or on a pay-as-you-go meter, and in Azure model consumption. Agent 365 makes the licence predictable. It does not make agent spending predictable.
Zenity publishes no prices on its own site. Its AWS Marketplace listing for Security Hub Extended (opens in a new tab) is the only public rate card we found:
- $130 per resource per month for observability, where a resource means any discovered agent, thread or connected resource;
- $16 per million tokens for runtime protection;
- $2 per million tokens for guardrails;
- a 30-day free trial.
The main AWS listing is private offer only (opens in a new tab), so treat those figures as a reference point, not a quote. The structure matters more than the numbers. Zenity’s bill grows with your agent inventory and your token volume. That is fair, since you pay for what it watches, but it means the security tool becomes another line item to forecast.
Neither product does what the FinOps Foundation’s AI guidance (opens in a new tab) describes: tokenomics, cost per token, quotas and tagging for allocation. For that you need an observability or FinOps tool such as:
- Datadog LLM Observability (opens in a new tab), which compares quality, cost and latency across releases;
- Langfuse (opens in a new tab), open source and owned by ClickHouse since 16 January 2026 (opens in a new tab);
- Arize (opens in a new tab), for OpenInference tracing and evaluation.
If your agents run on AWS, AgentCore pricing (opens in a new tab) is an education in itself. Policy checks cost $0.000025 per authorisation request, and observability is billed through CloudWatch. Each of those is a small number, and small numbers add up quickly in a busy estate.
The nearest thing on the horizon is ServiceNow, which on 15 October 2026 (opens in a new tab) announced AI Cost Management, part of its IT Asset Management product, which will integrate with its Control Tower and is expected in the fourth quarter. Announced is not shipped.
Edge: Agent 365 for budgeting the licence. Neither for managing what agents spend.
Governance: identity, policy and the paperwork
Governance is where Microsoft’s platform position pays off. Entra Agent ID (opens in a new tab) gives each agent a real directory identity: a service principal created from a blueprint. Every blueprint and identity must have a human sponsor. Agents fall under Conditional Access, least-privilege controls and lifecycle governance (opens in a new tab), the same machinery that already handles your staff.
An agent that leaves the company can be offboarded like any other employee. The difference is that it is less likely to take the stapler.
Compliance mapping comes from Purview rather than Agent 365 itself. Compliance Manager (opens in a new tab) has assessment templates for the EU Artificial Intelligence Act, ISO/IEC 42001:2023 and NIST AI RMF 1.0, and the licensed tier (opens in a new tab) extends DLP, sensitivity labels, insider risk, communication compliance and data lifecycle management to agents.
For a regulated firm already living in Purview, that is a ready-made audit trail.
Zenity doesn’t issue identities. It reads them from Entra ID and Okta (opens in a new tab) and works out what each agent can actually reach, with reference to the OWASP non-human identity risks. Its posture management (opens in a new tab) flags over-permissioned agents, risky connectors and misconfigured builders, including the low-code tools where business users make agents without telling anyone.
Zenity’s compliance page (opens in a new tab) names NIST AI RMF, NIST CSF 2.0, GDPR, SOX, HIPAA, PCI-DSS and FDIC requirements. We found no mention of the EU AI Act or ISO 42001 on Zenity’s pages. That doesn’t mean the platform can’t support them, only that Zenity doesn’t publish the mapping.
On its own security, Zenity’s trust centre (opens in a new tab) lists SOC 2 Type II, ISO 27001 and ISO 27701. It also announced FedRAMP “In Process” status on 12 March 2026 (opens in a new tab). “In Process” is not the same as authorised.
Edge: Agent 365, clearly, for identity, lifecycle and the formal compliance record. Zenity for finding out what those identities are actually allowed to touch, across platforms.
Security: runtime, prompt injection and tools
Microsoft has a good phrase for the problem. Its October 2026 security blog (opens in a new tab) calls agents “your newest insiders” and argues for surrounding “non-deterministic intelligence with deterministic controls”. We agree. The question is how far each product’s controls reach.
Defender’s real-time agent protection (opens in a new tab) checks tool calls before they run, in audit or block mode: for Copilot Studio and Foundry agents (both in preview) and for tools exposed through Work IQ MCP. Local agents are covered through Defender for Endpoint in active mode, and Prompt Shields blocks against prompt injection are recorded for Foundry, Copilot Studio and Agent Builder. For the Work IQ route, the page states the limit plainly: “Agents that rely on unsupported tools or don’t integrate with Work IQ MCP aren’t covered.”
For MCP traffic more widely, Microsoft’s answer is Azure API Management (opens in a new tab). That integration has been in public preview since about 8 October 2026. It can inventory and block MCP servers, but blocking individual tools needs the AI Gateway tier, which is also in preview.
Zenity’s runtime story is more developed. Its Boundaries engine (opens in a new tab) enforces one rule across Copilot, ChatGPT Enterprise, Agentforce, Bedrock, coding agents and homegrown builds. Each action can be allowed or blocked, or the agent can be shut down.
Its rules look at whole sessions rather than single prompts, so they can catch a chain such as “read the customer file, then email it outside”. Zenity says “about a third” of its out-of-the-box rules work this way. Rules can be simulated before blocking is switched on, which spares you the security-team tradition of breaking the finance department on a Friday.
The MCP gateway (opens in a new tab) sits between agents and tools. It can allow, modify or block calls without any change to the agent, and it watches for tool poisoning and “rug-pull” servers that change their behaviour after approval. Zenity maps its detections to OWASP and MITRE ATLAS, which we covered in our OWASP and ATLAS explainer.
On Microsoft’s own platforms the two now overlap. Zenity announced inline runtime security for Foundry agents (opens in a new tab) on 17 March 2026. Its Agent 365 integration (opens in a new tab) sends findings for Copilot Studio, Microsoft 365 Copilot and Foundry into Microsoft’s console.
Microsoft’s roadmap is closing the gap: the runtime blocking its GA post promised for June now has its own documentation, and Ignite opens on 17 November. A specialist’s advantage over a platform vendor tends to shrink at the centre of the platform and survive at the edges.
Edge: Zenity for runtime enforcement across platforms and for MCP. Agent 365 for anything that should be stopped by identity and data policy before it ever reaches runtime.
Pros and cons
Microsoft Agent 365
Pros
- Agents get first-class Entra identities, with sponsors, Conditional Access and lifecycle controls.
- Purview brings DLP, labels, insider risk and compliance templates for the EU AI Act, ISO 42001 and NIST AI RMF.
- The flat per-user price has no per-agent or consumption charges, and there is a foundational tier included with every Microsoft cloud subscription, with no separate charge.
- Telemetry is based on OpenTelemetry.
Cons
- Enterprise customers need E5, or E3 plus the Defender and Purview suites; Business, frontline and education plans have their own routes.
- Coverage of third-party agents and MCP is still mostly in preview.
- Runtime blocking only works on supported tools.
- It has no cost or token metering, and the “yet” in the licensing FAQ is worth watching.
Zenity
Pros
- One inventory and one set of policies covers SaaS, cloud, low-code and endpoint agents.
- Runtime rules are stateful and can be simulated first.
- Its MCP gateway handles shadow servers, tool poisoning and rug-pull servers.
- It integrates with Agent 365 rather than competing with it.
Cons
- Pricing is not published, apart from one AWS listing.
- The bill scales with inventory and tokens.
- We found no published mapping to the EU AI Act or ISO 42001.
- It has no native identity issuance and depends on Entra or Okta.
- Its FedRAMP status is “In Process”, not authorised.
Microsoft Agent 365 has a 4.5 out of 5 based on 88 ratings submitted in the AI Governance Platforms market on Gartner® Peer Insights™ as of 27 October 2026 (Gartner Peer Insights (opens in a new tab)).
Zenity Platform has a 4.5 out of 5 based on 2 ratings submitted in the AI Governance Platforms market on Gartner Peer Insights™ as of 27 October 2026 (Gartner Peer Insights (opens in a new tab)).
Two ratings tell you very little, and Gartner counts ratings and reviews differently, so treat neither score as a verdict.
The rest of the market
The independent AI security start-up is becoming a rare breed. Over 2025 the large security vendors bought a good share of the first wave. We have covered the wider deal-making separately. The deals below are the ones that shape this market, each confirmed from the buyer’s own announcement or filing.
| Player | Type | Main strength | Status |
|---|---|---|---|
| Palo Alto Networks Prisma AIRS (opens in a new tab) | Security platform | Model scanning, red teaming and runtime protection | Absorbed Protect AI, completed 22 July 2025 (opens in a new tab) |
| SentinelOne (Prompt Security) | Security platform | Employee AI use, shadow AI and prompt-level controls | Completed 5 September 2025 (opens in a new tab) (SEC filing) |
| Check Point (Lakera) | Security platform | Prompt-injection guardrails and red teaming | Announced 16 September 2025 (opens in a new tab), completed 22 October 2025 (opens in a new tab) |
| Cato Networks (Aim Security) | SASE | AI usage control from the network | Announced 3 September 2025 (opens in a new tab) |
| F5 AI Guardrails (opens in a new tab) (CalypsoAI) | Application delivery | Inline guardrails and red teaming | Closed 26 September 2025 (opens in a new tab) (SEC filing) |
| Noma Security (opens in a new tab) | Independent | Agent and AI application security across the lifecycle | No acquisition announced |
| Lasso (opens in a new tab), Pillar (opens in a new tab), Straiker (opens in a new tab) | Independent | Discovery, red teaming and runtime guardrails | No acquisition announced |
| HiddenLayer (opens in a new tab) | Independent | Model supply chain and runtime detection | No acquisition announced |
| WitnessAI (opens in a new tab) | Independent | Usage governance for people and agents | No acquisition announced |
| AWS Bedrock AgentCore (opens in a new tab) | Cloud platform | Identity, policy and observability for AWS agents | GA 13 October 2025 (opens in a new tab) |
| Google Model Armor (opens in a new tab) | Cloud platform | Prompt and response screening | Free up to 2 million tokens a month, then $0.10 per million |
| ServiceNow AI Control Tower (opens in a new tab) | Governance platform | Inventory tied to the CMDB, kill switch, EU AI Act content packs | Product page now titled “Super Intelligence Control Tower”; AI Cost Management announced 15 October 2026, not shipped |
| Credo AI (opens in a new tab), IBM watsonx.governance (opens in a new tab) | Governance platform | Risk registers, policy and regulatory mapping | Specialist and IBM product respectively |
The market divides into three groups.
Security platforms. Palo Alto, SentinelOne, Check Point, Cato and F5 now each own an AI security start-up. They will sell agent protection as part of a broader deal. If you already buy their firewall or endpoint product, the agent module is the path of least resistance.
Independent specialists. Zenity, Noma, Lasso, Pillar, HiddenLayer, WitnessAI and Straiker compete on depth and on neutrality across platforms. Noma is the closest match to Zenity. It raised $100 million in July 2025 (opens in a new tab) and says it serves “over 10% of the Fortune 100”. That is the company’s own figure, not one we have verified.
Platform owners. AWS and Google offer the same identity-and-guardrail pattern for their own clouds as Microsoft does, at metered prices. ServiceNow, Credo AI and IBM come at the problem from risk and compliance rather than detection. If your board’s question is “show me our AI Act register”, start with them.
Who should buy which
- Mostly Microsoft and already on E5: start with the foundational Agent 365 capabilities that come with your Microsoft cloud subscription, then license it for the people who own and sponsor agents. Revisit once third-party observability reaches general availability, which Microsoft currently plans for late November 2026.
- Agents across Salesforce, ServiceNow, ChatGPT, AWS and developer laptops: Zenity today, or a peer such as Noma, as the security layer. If you have Microsoft, use Agent 365 for identity. The Zenity integration exists so you don’t have to choose.
- Heavy MCP use today: Zenity’s gateway is published and specific. Microsoft’s APIM route is in preview.
- Regulated, with an EU AI Act deadline: Purview Compliance Manager, or a governance platform such as ServiceNow, Credo AI or IBM. Neither Agent 365 nor Zenity is a register on its own.
- Worried about the bill: buy neither for that reason. Put a tracing tool such as Datadog, Langfuse or Arize in front of the model spend, and follow the FinOps Foundation’s guidance.
- Already a Palo Alto, Check Point, SentinelOne, F5 or Cato customer: price their AI module before signing with a specialist. Then check whether it covers low-code builders and coding agents, because that is where specialists earn their fee.
What we could not verify
Noma’s Fortune 100 figure is its own claim. ServiceNow has not announced a date for renaming AI Control Tower. The new name, Super Intelligence Control Tower, appears in its 15 October 2026 press release (opens in a new tab); Gartner Peer Insights still lists the old name. We found no primary source for funding at the other independents, so we haven’t given any. We also found no public price for Zenity outside AWS. Where something wasn’t published, we have said so rather than guess.
Sources: every figure above links to its source, with the date we checked it. Spotted an error? Tell us.
Gartner and Peer Insights™ are trademarks of Gartner, Inc. and/or its affiliates. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)