Zenity vs Noma vs Pillar Security: AI Agent Security Compared

Last updated October 19, 2026. Capabilities, deployment options, certifications, and AWS Marketplace list prices were checked against each vendor’s own pages and listings on that date.

Zenity vs Noma is the most common AI agent security shortlist in 2026, and Pillar Security is the name buyers add when prompts and tool calls cannot leave their own environment. Choose Zenity when most agents are built by business users in Microsoft Copilot Studio, Salesforce Agentforce, or ChatGPT Enterprise. Choose Noma Security when coding agents, homegrown agents, and SaaS agents need one policy. Choose Pillar Security when regulated AI traffic must be inspected in your own cloud account or data center.

All three sell the same promise: find every agent, judge what it can reach, and stop a harmful action before it lands. They start from different places, enforce at different control points, and price differently, so the wrong pick leaves a gap the size of your largest agent estate. This comparison sits in our Agent Security hub within the wider AI Governance and Security topic.

AI agent security platforms are products that discover AI agents, assess their permissions and configuration, and enforce policy on what those agents do at runtime. No vendor paid for placement or reviewed this page before publication, per our editorial standards and disclosure policy.

Zenity vs Noma vs Pillar Security: The Short Answer

Zenity fits enterprises whose agent sprawl starts in Microsoft and Salesforce builders. Noma fits security teams that must govern coding agents on laptops and cloud agents under one policy. Pillar fits regulated teams that build their own AI apps, want red teaming tied to guardrails, and need the whole stack self-hosted. Each one is weakest where the next one starts.

	Zenity	Noma Security	Pillar Security
Starting point	SaaS and low-code agents (Copilot Studio, Agentforce, ChatGPT Enterprise)	Mixed estate: endpoint, SaaS, cloud, and homegrown agents	Homegrown AI apps, coding agents, and regulated data
Platform layers	Surface, Enforce, Protect, plus Guardian Agents	AI-SPM, Access Control, AI-DR, AI Red Teaming	Discovery, AI-SPM, agentic red teaming, runtime guardrails, governance
Runtime action control	Runtime Boundaries: allow, block, or shut down	Per detector: monitor, alert, steer, block, mask, or route to a human	Guardrails start in monitor mode, then block; Runtime Guardian on endpoints
Coding agents on laptops	Lightweight monitoring for personal and coding agents	Discovery through existing EDR or MDM; hooks for enforcement	MDM script; pre-tool hooks in Claude Code, Codex CLI, and Cursor
Self-hosting	Not publicly documented; listings are SaaS on AWS	SaaS, hybrid, and on-prem documented	Managed cloud, self-hosted, or hybrid, fully documented
Certifications	SOC 2 Type II, ISO 27001, ISO 27701	SOC 2 Type II, ISO 27001, ISO/IEC 42001, HIPAA	SOC 2 Type II, ISO/IEC 27001:2022
Gartner EMQ, September 2026	Market Shaper	Market Shaper	Pioneer
Public list price cue	$130 per resource a month; $16 per 1M runtime tokens	$130 per asset; $8 hybrid or $16 SaaS per 1M tokens; $650 per red team test	$175,000 per 12-month contract

Verdict: Zenity wins when the agent inventory lives in Microsoft and Salesforce builders. Noma wins when one registry must govern laptops, SaaS, and cloud agents together. Pillar wins when data residency decides the shortlist, and it is the only one of the three whose self-hosted architecture is published in full.

How We Compared Zenity, Noma, and Pillar Security

We compared the three platforms on six controls a security team must prove in a pilot, using only public evidence: vendor documentation, trust portals, AWS Marketplace listings, and the Gartner Emerging Market Quadrant for AI Application Security published September 16, 2026. We did not run the products, so detection quality claims below are vendor claims.

• Discovery: Can it find agents, MCP servers, and skills that nobody registered, including on employee laptops?
• Posture: Does it flag excessive permissions, risky configuration, and exposed credentials before an agent runs?
• Runtime control: Can it stop a single agent action inline, and does it reason over the whole session?
• Testing: Does it red team agents with multi-step attacks and feed the findings back into policy?
• Deployment: SaaS, hybrid, or self-hosted, and what leaves your environment in each case.
• Price clarity: Published list rates versus quote-only contracts.

Gartner placed only two startups, Zenity and Noma, in its Market Shapers quadrant, which it describes as full-spectrum, context-aware agentic security, per the Zenity announcement and the Noma announcement. Pillar was placed among the Pioneers and furthest on the market disruption axis within that group, per the Pillar announcement. Analyst placements describe vision and execution, so treat them as a shortlist signal and test the controls yourself.

Three Platforms, Three Starting Points

Each vendor grew from a different first customer problem, and that origin still shows in where its controls are deepest. Zenity began with low-code and SaaS agents, Noma with data and AI pipelines before extending to every agent type, and Pillar with securing AI applications that engineering teams build themselves. The profiles below show each vendor’s homepage and current position.

Zenity

Zenity is the strongest fit when business users build agents in Microsoft Copilot Studio, Salesforce Agentforce, or ChatGPT Enterprise and security needs one rule set across all of them. Its platform has three layers, Surface, Enforce, and Protect, per the Zenity platform page. Runtime Boundaries review each agent action and let it proceed, block it, or shut the agent down, and Agentic Identity ties identity from Okta and Microsoft Entra to what the agent actually does.

Microsoft depth is the differentiator. Zenity made inline prevention in Copilot Studio generally available on November 18, 2025, added runtime security for agents built on Microsoft Foundry on March 17, 2026, and integrated with Microsoft Agent 365 on August 4, 2026. Zenity raised a $125 million Series C led by Norwest on August 3, 2026, reports more than 230 employees, and says Gartner named it the Company to Beat in AI Agent Governance in April 2026.

• Best for: Enterprises whose agent sprawl starts in Copilot Studio, Agentforce, Microsoft 365 Copilot, and ChatGPT Enterprise.
• Status and price (October 2026): Generally available. SOC 2 Type II, ISO 27001, and ISO 27701 per the Zenity Trust Center. AWS Marketplace lists $130 per resource a month for observability and $16 per million tokens for runtime protection.
• Watch out for: Zenity does not publicly document a self-hosted deployment, and both of its AWS Marketplace listings are delivered as SaaS.

Noma Security

Noma Security is the best pick when one team must govern coding agents on laptops, agents in SaaS builders, and agents engineers ship on Bedrock, Azure, or Databricks. Its platform has four parts: AI-SPM, Access Control, AI-DR, and AI Red Teaming, per the Noma endpoint agents page. The Access Control registry gives every agent, MCP server, and skill a status of approved, needs review, or blocked, and policy can be scoped by user, group, tool, or single action.

Noma’s September 28, 2026 endpoint expansion discovers agents through the EDR or MDM already in place, then enforces through agent hooks, AI and MCP gateways, SDKs, and EDR. Each AI-DR detector can monitor, alert, steer, block, mask data, or route an action to a human. Noma says it runs on more than 2.6 million endpoints and enforces through Kong, Amazon Bedrock AgentCore, LiteLLM, and TrueFoundry, per its Gartner announcement.

• Best for: Security teams that want one policy across endpoint, SaaS, cloud, and homegrown agents.
• Status and price (October 2026): Generally available. HIPAA, SOC 2 Type II, ISO 27001, and ISO/IEC 42001 listed on the Noma trust portal. Total funding of $132 million, including a $100 million Series B on July 31, 2025.
• Watch out for: Agent Boundaries, Noma’s business-defined action limits, were still a planned endpoint feature in the September 2026 announcement.

Pillar Security

Pillar Security is the best fit for banks, insurers, and healthcare teams that build their own AI apps and cannot send prompts or tool calls to a vendor cloud. The platform covers discovery and an AI bill of materials, AI-SPM, agentic red teaming, runtime guardrails, and governance, per the Pillar homepage. Its RedGraph engine runs multi-step attacks, and validated findings feed directly into guardrail policy.

Pillar is the smallest of the three. It announced a $9 million seed round on April 16, 2025 and had about 20 employees in January 2026, per Refresh Miami. Gartner named it a Cool Vendor in AI Software Security in July 2026, citing RedGraph, dynamic runtime guardrails, and its SAIL framework.

• Best for: Regulated teams that build AI apps in-house and want red teaming wired to runtime guardrails.
• Status and price (October 2026): Generally available. SOC 2 Type II and ISO/IEC 27001:2022 per the deployment page. AWS Marketplace lists $175,000 per 12-month contract.
• Watch out for: Adaptive guardrails run in Pillar’s managed cloud only as of October 2026, so a fully self-hosted deployment gives up that feature.

Capability Matrix: Discover, Assess, Enforce, Test, Respond

The three platforms overlap on paper, because each claims discovery, posture, runtime protection, and red teaming. The real differences sit in which environments each control reaches and how much of it runs inline. The matrix below records what each vendor documents publicly, with nuanced values where a flat yes would mislead.

Control	Zenity	Noma Security	Pillar Security
Agent discovery	SaaS builders, cloud platforms, and endpoints	Endpoint through EDR or MDM, SaaS, cloud, and homegrown	Code repos, CI/CD, cloud, and endpoints through MDM
Posture and exposure	AISPM plus Exposure Management with fixes ready for Runtime Boundaries	AI-SPM with supply chain and misconfiguration findings	AI-SPM, AI-BOM, and attack surface mapping by blast radius
Inline action control	Native inline in Copilot Studio (GA) and Foundry	Hooks, AI and MCP gateways, SDKs, and EDR	Guardrail API, AI gateways, and pre-tool hooks
Session reasoning	Stateful engine across users, agents, and sessions	Contextual Policies across full sessions	Multi-turn analysis, tightens after untrusted content
MCP coverage	MCP Security on the Runtime Boundaries engine	MCP servers in the registry with tool and action policies	Risk scores against 23,000+ pre-analyzed MCP servers
Red teaming	Exposure validation of reachable attack paths	Multi-turn AI Red Teaming, $650 per test on AWS	RedGraph autonomous agent with replayable evidence
Framework mapping	OWASP and MITRE ATLAS	NIST AI RMF, EU AI Act, ISO 42001, OWASP, MITRE ATLAS	OWASP, MITRE ATLAS, NIST, EU AI Act, SAIL

Verdict: Zenity has the deepest native enforcement inside Microsoft’s agent builders. Noma reaches the most enforcement points without asking teams to change their stack. Pillar has the tightest loop between red teaming and guardrails, which matters most for teams that ship their own AI apps and want each finding to become a policy.

Where Each Platform Enforces Policy

Enforcement location decides what a platform can stop. Zenity enforces natively inside SaaS builders such as Copilot Studio, Noma enforces wherever an agent already passes a hook, gateway, SDK, or EDR sensor, and Pillar enforces through its guardrail API, AI gateway integrations, and pre-tool hooks on developer machines. Map your agents to these control points before a pilot.

Pillar’s gateway path shows how light the integration can be. In LiteLLM, Pillar plugs in as a generic guardrail that runs pre_call on the prompt and post_call on the response, and plr_mask replaces secrets and PII with placeholders before the model sees them. The guardrail block below follows LiteLLM’s documented example, with comments added.

guardrails:
  - guardrail_name: pillar-security
    litellm_params:
      guardrail: generic_guardrail_api
      mode: [pre_call, post_call]
      api_base: https://api.pillar.security/api/v1/integrations/litellm
      api_key: os.environ/PILLAR_API_KEY
      default_on: true
      additional_provider_specific_params:
        plr_mask: true      # mask PII, PCI data, and secrets before the LLM call
        plr_evidence: true  # return the matched evidence for audit
        plr_scanners: true  # return which scanner fired

Noma also lists LiteLLM among its enforcement points, so a team that already runs that gateway can trial either vendor on the same traffic. If you are still choosing a gateway, compare options in our LLM gateways guide and LiteLLM alternatives first, because the gateway decides which inline checks are cheap to add.

Coding Agents on Laptops: Which Platform Sees More?

Noma and Pillar both document deep endpoint coverage for coding agents, while Zenity describes lightweight monitoring for personal and coding agents. Noma discovers through EDR or MDM you already run and enforces through agent hooks. Pillar deploys a script through MDM, audits each agent’s configuration, and blocks risky actions in the agent’s own pre-tool hook.

Endpoint question	Zenity	Noma Security	Pillar Security
How it discovers	Lightweight monitoring for local agents	Existing EDR or MDM, no new endpoint agent for discovery	MDM script on macOS, Linux, and Windows
Agents named publicly	Claude, Codex, and Cursor among coding agents	Claude Code, Claude Cowork, Cursor, Codex, Windsurf, Kiro, Antigravity, OpenClaw	Full scans for Claude Code, Cursor, Codex CLI, Gemini CLI, OpenCode, Pi
Pre-action blocking	Detection and response for local agents	Through supported agent hooks, gateways, and APIs	Runtime Guardian in Claude Code, Codex CLI, and Cursor hooks
Config posture	Covered by AISPM	Secrets in instructions, unsandboxed execution, excessive agency	YOLO mode, approval bypass, disabled workspace trust, missing sandboxes
Tamper resistance	Not publicly documented	Not publicly documented	MDM-managed hooks for Codex and Cursor that developers cannot disable

Verdict: Pillar documents the most specific endpoint controls, including tamper-resistant hooks and offline decisions. Noma names the widest list of agents and avoids a new endpoint install for discovery, which suits teams with a crowded laptop image. Zenity is the weakest of the three on documented endpoint depth, so test it there before you rely on it.

Endpoint control matters because coding agents load MCP servers that carry real bugs. Our coverage of ToFu finding 253 bugs in 118 MCP servers and the FastMCP client RCE advisory shows why a pre-tool hook is worth more than a monthly scan.

Deployment and Data Residency

Pillar documents the most complete self-hosted option, Noma documents SaaS, hybrid, and on-prem deployments, and Zenity does not publicly document a self-hosted option. Data residency therefore decides many shortlists before features do. Any platform that inspects prompts and tool calls reads your most sensitive traffic, so ask where inspection runs and where logs live.

Self-hosted Pillar runs on Kubernetes, with Amazon EKS as the documented path, at least three GPU nodes and two general-purpose nodes, and your own PostgreSQL, Redis, and Kafka, per the Pillar deployment page. Telemetry is opt-in, and Pillar says a Fortune 300 manufacturer runs it fully air-gapped. Noma states that both its on-prem and SaaS deployments can keep models, training data, and security events in your environment. That claim comes from the Noma agent control plane page.

Question	Zenity	Noma Security	Pillar Security
Default delivery	SaaS	SaaS	Managed cloud
In your environment	Not publicly documented	On-prem and hybrid scanning documented	Self-hosted or hybrid, fully documented
What stays local when self-hosted	Not applicable	Models, data, and security events	Prompts, responses, tool calls, findings, and audit trail
Feature gap when self-hosted	Not applicable	Not publicly documented	Adaptive guardrails are cloud only
Infrastructure you supply	None	Not publicly documented in detail	Kubernetes, three GPU nodes, Postgres, Redis, Kafka

Verdict: Choose Pillar when security events and prompts must never leave your walls and you can run GPU nodes. Choose Noma when hybrid scanning is enough and you want the vendor to run the control plane. Treat Zenity as a SaaS purchase unless its sales team commits to residency terms in writing.

Pricing: What the AWS Marketplace Listings Reveal

All three vendors sell through sales-led contracts, but their AWS Marketplace listings publish real list rates. Zenity and Noma sell metered listings for AWS Security Hub Extended, a Security Hub plan with published pay-as-you-go partner pricing, and Pillar lists an annual platform contract. Those rates are the only public price anchors for this comparison.

Meter	Zenity	Noma Security	Pillar Security
Per tracked agent or asset	$130 per resource a month (observability, buildtime, runtime, CTEM)	$130 per asset scanned	Included in contract
Per million tokens inspected	$16 runtime protection; $2 Guardrails for AWS	$16 SaaS; $8 hybrid	Included in contract
Red teaming	No separate meter; Exposure Management validates attack paths	$650 per test	Included in contract
Contract shape	Usage-based, cancel any time; private offers on request	Usage-based, cancel any time	$175,000 per 12-month unit; unit size not published

Zenity and Noma publish identical AWS list rates for the two meters that drive most bills: $130 per tracked agent or asset a month and $16 per million tokens inspected in SaaS. The real price gap between them will come from private offers, how each vendor counts a resource, and Noma’s $8 hybrid token rate. Pillar’s flat contract inverts the math, because it costs more for a small estate and may cost less for a large one.

For 50 tracked agents and 100 million inspected tokens a month, Zenity and Noma SaaS both come to $97,200 a year at list, Noma hybrid to $87,600, and one Pillar unit to $175,000. At 200 agents and 500 million tokens, Zenity and Noma SaaS reach $408,000 and Noma hybrid $360,000. The calculation excludes Zenity Guardrails, Noma red team tests, and discounts, and Pillar does not publish how many agents one unit covers, per its AWS listing.

Research Teams and Threat Intelligence

All three vendors run research teams that publish agent vulnerabilities, and that research feeds their detections. Zenity Labs published the AgentFlayer zero-click attack class, Noma Labs disclosed GeminiJack and GitLost, and Pillar disclosed the Rules File Backdoor in AI coding agents. A strong research team is a useful signal of how quickly new attack techniques reach the product.

• Zenity Labs: AgentFlayer zero-click hijacks, a calendar invite that hijacked Perplexity’s Comet browser, and a critical Copilot Studio flaw, per the Series C release.
• Noma Labs: GitLost in GitHub agent workflows, GeminiJack in Gemini Enterprise, and a 10.0 severity RufRoot flaw in an MCP bridge, per Calcalist Ctech.
• Pillar research: the Rules File Backdoor in GitHub Copilot and Cursor, plus a threat feed built from millions of real AI application interactions, per its seed announcement.

Research output is a vendor claim about capability, so ask each team for the detection that shipped after its last disclosure. Government guidance points the same way: the NIST, NSA, and CISA incident response practices for AI agents assume you can isolate an agent fast, which is a runtime control these platforms sell.

Head-to-Head: Each Pair Compared

Most buyers shortlist two of the three, so the pairwise calls matter more than a single ranking. Zenity and Noma compete hardest, because both are Market Shapers with broad coverage and identical list rates. Pillar competes with each of them on a narrower front: self-hosting against Zenity, and red teaming depth against Noma.

Zenity vs Noma

Choose Zenity when most agents live in Copilot Studio, Agentforce, Microsoft 365 Copilot, or Foundry and you want enforcement native to those platforms. Choose Noma when coding agents on laptops and homegrown agents are as large a risk as SaaS agents, or when you need hybrid or on-prem deployment. Neither choice saves money at list, because the meters match.

Zenity vs Pillar Security

Choose Zenity for SaaS builder coverage, Microsoft integration depth, and the larger vendor. Choose Pillar when your team builds its own AI apps, wants RedGraph findings to become guardrails, and needs prompts inspected inside its own cloud account. Pillar’s flat contract also suits a large estate better than per-agent metering.

Noma vs Pillar Security

Both cover coding agents and homegrown apps, so the deciding factors are deployment and testing. Choose Noma when you want discovery through your existing EDR and enforcement across many gateways with the vendor running the control plane. Choose Pillar when everything must run self-hosted and tamper-resistant hooks on developer machines matter more than a wider list of named agents.

Which One Should You Choose?

Start from where your agents run and where your data may go, then compare the bill. The checklists below turn the comparison into a pilot plan. Run the same three tests on each finalist: block one destructive tool call, catch one indirect prompt injection that arrives through a document, and export one audit record with actor, tool, and policy reason.

Choose Zenity if

• Copilot Studio, Agentforce, Microsoft 365 Copilot, and ChatGPT Enterprise hold most of your agents.
• You want inline blocking native to Microsoft builders and signals inside Microsoft Agent 365.
• SaaS delivery is acceptable for prompt and tool call inspection.
• You prefer the vendor with the largest recent funding round and headcount of the three.

Choose Noma Security if

• Coding agents on laptops and homegrown agents on Bedrock, Azure, or Databricks need the same policy as SaaS agents.
• You want discovery through EDR or MDM you already run, with no extra endpoint install.
• Hybrid or on-prem scanning is a requirement, at $8 per million tokens on AWS list.
• ISO/IEC 42001 evidence and EU AI Act mapping appear in your audit checklist.

Choose Pillar Security if

• Prompts, responses, and findings must stay in your own cloud account or data center.
• Your AppSec team red teams in-house AI apps and wants findings to become guardrail policy.
• Developers run Claude Code, Codex CLI, or Cursor and you need hooks they cannot disable.
• A flat annual contract fits your budget better than per-agent and per-token meters.

When None of the Three Is the Right Buy

These platforms are built for estates with dozens or hundreds of agents across teams. They are the wrong first purchase when a single engineering team runs a handful of agents in code, when the gap is MCP tool access alone, or when agents still hold standing admin credentials. Fix the cheaper layer first in those cases.

• One app, one team: a guardrail API inside your code or gateway costs less than a platform. Start with the LLM gateway you already run.
• MCP tool access only: an MCP gateway with per-tool allowlists may close the gap; see the MCP explainer for the trust model.
• Standing credentials: a detector cannot undo a permission an agent should never have held, so scope tokens and service accounts first.
• Quality failures: agents that make mistakes without any attacker need evaluation and observability tools, which these platforms do not replace.

Frequently Asked Questions

Related Guides

For the wider landscape around these three platforms, see our AI agent security tools, AI agent governance buyer’s guide, MCP security tools and MintMCP vs Runlayer vs Lasso.

Continue with the 10 best MCP gateways, the MCP explainer, ToFu MCP tool security findings, FastMCP security advisories, the NIST and CISA agent incident practices, Red Hat MCP gateway news, Anthropic taking evals offline after agents overstepped, agent integration platforms, LLM gateways, the AgentOps tools map, and AI agent frameworks. Browse every post in the Agent Security and Governance and Compliance topics, or reach the desk through our contact page.

The Bottom Line

Zenity is the pick for SaaS and Microsoft agents, Noma for one policy across laptops, SaaS, and cloud, and Pillar for self-hosted inspection tied to red teaming. Zenity and Noma cost the same at AWS list, so negotiate on private offers and resource counting. Prove a block, an injection catch, and an audit export in staging before you sign.