AI agent security tools compared, scored on public evidence
SHORT ANSWER
This site compares identity security for AI agents first, then MCP gateways and four more identity topics: 17 products, 32 product assessments, and a written reason and source link behind every score.
Editorial assessment · Desk research from public vendor material · Reviewed 2026-09-29
Lead ranking
AI agent security and identity
SHORT ANSWER
No product covers all six criteria well. Okta scores highest overall, helped by its integration network and published plans. NewCore scores highest or joint highest on the three criteria about what happens during a call: short-lived credentials, per-call authorization and human approval, and Silverfort is strongest at finding agents nobody registered.
| Rank | Product | Total | Best for |
|---|---|---|---|
| 1 | Okta | 7.8 / 10 | Teams already on Okta that want agent identity from the same vendor |
| 2 | NewCore | 7.5 / 10 | Control over each agent call: no standing credentials, per-call policy, human approval |
| 3 | Silverfort | 7.2 / 10 | Finding agents across identity providers and clouds, then blocking actions inline |
| 4 | Aembit | 7.1 / 10 | Keeping credentials out of agents entirely, with a free tier to start |
| 5 | Microsoft Entra | 7.0 / 10 | Microsoft estates that want agents under Entra ownership and Conditional Access |
Featured ranking
MCP security
SHORT ANSWER
Docker's MCP Enterprise Gateway scores highest: it is the only product here that runs MCP servers in isolated containers and approves them before agents can reach them, and it applies policy by server, tool and call. NewCore and Aembit score highest at keeping credentials away from the agent, and Aembit at binding the agent to the person behind it. The checklist below applies whichever gateway you choose.
| Rank | Product | Total | Best for |
|---|---|---|---|
| 1 | Docker MCP Enterprise Gateway | 8.4 / 10 | Running third-party MCP servers under central policy, including air-gapped |
| 2 | Aembit | 7.6 / 10 | Brokering credentials for agents without them ever holding one, with a free tier |
| 3 | NewCore | 7.4 / 10 | Per-call policy and human approval on MCP calls, tied to an accountable owner |
| 4 | Silverfort | 6.1 / 10 | Adding an MCP gateway to an existing Silverfort identity deployment |
| 5 | Descope | 5.6 / 10 | Teams building and publishing their own MCP servers who need OAuth handled |
MCP security: gateways compared, with a best-practice checklist
More rankings
ITDR
Detecting and stopping attacks on identity systems, from Kerberoasting to forged tokens.
Highest score on this page: Silverfort (7.6 / 10)
Non-human identities
Service accounts, API keys, tokens and secrets: finding them, owning them, replacing them.
Highest score on this page: Oasis Security (7.5 / 10)
Workforce IAM
The identity provider employees sign in with, compared on integrations, sign-in and price.
Highest score on this page: Okta (8.5 / 10)
Identity visibility and hygiene
Seeing every identity and cleaning up stale, excessive and weakly protected access.
Highest score on this page: Veza (7.6 / 10)
Tools: Calculator · Compare side by side · Alternatives by vendor
How the scoring works
- Six criteria per topic, weighted by what a wrong answer would cost.
- A score out of 10 for each criterion, each with a one-line reason and a source link.
- Where a vendor's public pages say nothing, the cell says so and carries a "Gap in public material" tag.
- Totals are computed from the weights; nothing is adjusted by hand.
Latest news
- 2026-09-22 · OktaOkta lists Agent SSO as generally available
- 2026-09-22 · OktaOkta and partners publish a reference architecture for agent security
- 2026-09-15 · NISTNIST IR 8587 on token protection is final
From the blog
- 2026-09-29Identity security announcements, June to September 2026: a recap by themeBetween June and September 2026 the announcements that mattered for identity buyers fell into three groups: agent identity features from identity vendors, a new NIST reference on token protection, and changes in who owns which vendor. This post covers announcements from 15 June to 22 September 2026, each linked to its source.
- 2026-09-29What workforce identity costs in 2026: published prices comparedFive of the six workforce identity providers on this site publish per-user prices, from $3 to $17 per user per month for the plans listed, with very different minimums. NewCore does not publish pricing. Minimums and billing terms can change the real cost more than the headline price.
- 2026-09-23An AI agent security buyer's checklist: 12 questions to ask before a pilotBefore piloting an AI agent security product, get written answers to twelve questions about credentials, per-call checks, human approval, discovery, logging and availability. The questions follow the six criteria on our AI agent security page and the rules in the MCP specification.