Cloud-native access control company Portnox today unveiled expanded capabilities aimed at governing the artificial intelligence agents and other nonhuman identities now logging in to corporate networks, applications and infrastructure.

The new piece is an integration with Microsoft Corp.’s Defender. Portnox had already wired in CrowdStrike Holdings Inc. and SentinelOne Inc. Any of the three can now trigger an access decision.

If one of them reports a threat or sees a device slip out of compliance, the Portnox policy engine can cut the connection, drop the identity into quarantine or pull its access entirely, depending on what the customer’s rules say. Employees are subject to the same treatment.

The identities in question behave nothing like a human employee. Agents authenticate to systems, pull sensitive data and take actions on their own, continuously and at machine speed. Yet many enterprises still hand them static credentials, shared accounts and standing permissions, then verify identity only once, at login. Security teams are left guessing at what an agent is touching and whether its behavior has drifted.

The guessing has already had consequences. Research by VentureBeat in the second quarter found that 54% of enterprises have had a confirmed agent security incident. A larger share, 69%, admitted to sharing credentials across their agents.

“AI agents are becoming active participants in the enterprise, but many organizations are still relying on access models built for human users and managed devices,” said Portnox Chief Executive Denny LeCompte. “Every identity that can connect, access data or act must be continuously verified and governed. Portnox gives organizations the ability to immediately restrict access when trust changes, without waiting for an AI agent to create a larger security incident.”

Portnox describes what it is selling as a kill switch sitting at the network layer. Identity and privileged access management tools decide what an agent ought to be allowed to reach. Cutting the connection is a separate job, and the company’s argument is that it can be done before an identity provider has gotten around to revoking anything.

The mechanics run in three steps. One of the three endpoint platforms detects the risk. The Portnox policy engine weighs that signal against the customer’s access rules in real time. Enforcement follows automatically.

Field Chief Information Security Officer Garrett Gross said the gap the company keeps running into is “between knowing something’s wrong and actually doing something about it.” Plenty of products can report that an agent is behaving strangely, he said. Far fewer can act on it at the network layer without waiting for someone to approve a ticket.

Security and information technology teams also get an audit trail out of it, covering which identity connected, when and from where, what it was cleared to reach and which policy made the call.

Portnox is a venture capital-backed startup that has raised approximately $59.5 million, including a $37.5 million Series B round led by Updata Partners in April 2025.

Image: Portnox