Securing the Agentic Frontier: Varonis Expands Atlas with AI Gateway

MIAMI – November 09, 2026 — The enterprise perimeter has long been declared dead, but the rapid proliferation of autonomous artificial intelligence has effectively scattered its ashes. As organizations scramble to harness generative AI, a new crisis has emerged: "shadow AI" and the unchecked autonomy of local coding agents. In response, Varonis Systems today announced a significant expansion of its Atlas data and AI security platform, introducing Browser Protection, Endpoint Protection, and a dedicated AI Gateway.

The move signals a critical shift in the cybersecurity landscape. Security teams are no longer just fighting data exfiltration to public web interfaces like ChatGPT; they are battling a complex web of local machine learning models, third-party APIs, and autonomous agents executing code directly on employee workstations. By bridging endpoint visibility with runtime gateway controls, the data security leader is attempting to provide a unified net for an increasingly fragmented attack surface.

Taming the Agentic Frontier

The most pressing vulnerability driving this architectural shift isn't the casual employee asking a chatbot to summarize a confidential memo. It is the rapid adoption of developer tooling like Claude Code and Model Context Protocol (MCP) servers. These technologies grant AI agents the ability to interact with external tools, local file systems, and corporate databases.

While these tools exponentially increase developer productivity, they introduce terrifying new attack vectors. An AI coding agent running locally often has default access to read files in its current working directory. This means sensitive assets like .env.production files, AWS credentials, and private SSH keys are suddenly within the context window of a large language model. Furthermore, untrusted MCP servers downloaded from public marketplaces can be weaponized to execute arbitrary code or exfiltrate data through proxy command execution.

"The perimeter hasn't just dissolved; it's been replaced by thousands of autonomous micro-agents," noted one enterprise security architect familiar with the evolving threat landscape. "If a local coding assistant can read your production environment variables and send them to a compromised MCP server, your traditional data loss prevention tools are completely blind to the transaction."

To combat this, the new Endpoint Protection module is designed to discover local AI runtimes, coding agents, model weights, and MCP servers directly on laptops and desktops. Recognizing that security teams cannot manage yet another isolated agent, the platform has been architected to integrate with dominant endpoint detection and response (EDR) solutions, including CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender. This integration allows organizations to correlate AI-specific telemetry—like the sudden spinning up of an unauthorized local model—with broader endpoint activity, transforming a blind spot into a monitored environment.

The Battle for the AI Gateway

While securing the endpoint addresses local vulnerabilities, the enterprise still needs to govern how data flows to external model providers. This has ignited a fierce market battle over the "AI Gateway," a reverse proxy layer that sits between corporate users and external LLMs.

Historically, cloud hyperscalers and network edge providers have dominated the gateway conversation, focusing on caching, rate limiting, and API analytics. However, traditional data security posture management (DSPM) vendors are aggressively moving into this space, arguing that an AI gateway is useless if it doesn't understand the sensitivity of the data passing through it.

The newly launched Varonis AI Gateway aims to capitalize on this data-centric approach. By putting an LLM and MCP gateway in front of corporate AI traffic, security teams can route requests across different model providers, cap expensive token spend, and, critically, enforce data-aware guardrails on prompts and responses.

Coupled with the new Browser Protection—a lightweight extension that discovers unsanctioned AI web apps and applies guardrails to browser-based prompts and attachments—the company is attempting to capture AI interactions regardless of whether they happen in a sanctioned API, a shadow IT web app, or a local terminal. It is a direct challenge to network-centric security incumbents, betting that deep data classification capabilities will ultimately win out over simple traffic routing.

Beyond the Prompt: The Shift to Intent Verification

Perhaps the most forward-looking, and practically challenging, component of the announcement is the expansion of Atlas Agent Intent. As AI systems evolve from passive chatbots to autonomous agents capable of executing multi-step workflows, static, regex-based prompt filtering is becoming obsolete. Attackers can easily bypass static filters using indirect prompt injections—such as hiding malicious instructions inside a seemingly benign README file that an agent is instructed to analyze.

To address this, Varonis is introducing an "Agent Manifest" that defines the specific purpose of each AI agent. The platform then utilizes intent-based access control (IBAC) to monitor the agent's behavior at runtime, stepping in to block actions if the software drifts from its defined purpose.

"You can't control AI you can't see, and you can't see AI by watching one touchpoint at a time," said Ron Bennatan, VP of AI and Data Security Strategy at Varonis. "Atlas shows security teams the AI tools, agents, and token use across the business, and lets them stop an agent action when it goes beyond its guardrails. Companies can say yes to AI without losing control of their data."

While IBAC represents a necessary evolution in AI safety, its practical efficacy in the enterprise remains to be seen. Defining precise "intents" for dynamic AI agents without triggering a flood of false positives or breaking developer workflows is a monumental task. Security administrators will need to learn how to craft these Agent Manifests accurately, translating complex business requirements into verifiable behavioral bounds. If the process is too cumbersome, developers will inevitably seek workarounds, undermining the very security posture the system is meant to enforce.

Despite these implementation hurdles, the shift toward runtime intent verification is inevitable. The era of trusting an AI agent simply because it was launched by an authenticated user is over. As autonomous systems take on more critical business functions, the ability to continuously verify that an agent is doing exactly what it was designed to do—and nothing more—will become the foundational pillar of enterprise AI security. The vendors that can make this complex verification process seamless for both security teams and developers will ultimately dictate the future of the market.