Exaforce, the pioneer in agentic security operations, today announced Exaforce AI Security, a new capability on its Exaforce platform that gives security teams visibility and control over the AI agents and agentic applications operating across their environments. Announced in San Francisco, Exaforce expands beyond the SOC into AI security delivering runtime visibility and control of AI agents and applications from endpoint to cloud without deploying another security agent.
AI and agentic apps are hard to catalog, attribute, and secure. They are everywhere, hosted with a provider or running on a laptop, living as skills in code repositories and as MCP servers on devices. They replicate quickly; any employee can deploy a new agentic app, and so can an agent. They assume human identities and OAuth tokens, so deciphering agent activity from human activity in standard audit logs is guesswork. And they act fast, with the ability to rotate a key, merge a pull request and, with the right permissions, perform almost any activity a human can. Each action can look legitimate on its own but a series of them may not be.
"Everyone is struggling to rapidly identify and secure the adoption of AI apps & agents in the enterprise. Existing tooling was not built to rapidly ascertain AI adoption against its risks, and existing SaaS and endpoint security tooling," said Ankur Singla, Co-Founder and CEO of Exaforce. "Security teams need AI activity to land where identity, cloud, and endpoint data exist because they are interconnected and they need it without rolling out one more agent. We use that same data to comprehensively address this new threat surface."
In June 2026, attackers compromised Klue, an AI-powered competitive-intelligence app, and used its customers' own OAuth tokens to pull data from their Salesforce environments. Stolen OAuth tokens for Salesloft's Drift chatbot were used the same way at more than 700 organizations in August 2025. The Nx "s1ngularity" npm attack similarly demonstrated how attackers can turn developers' own AI coding agents against them, using Claude Code, Gemini CLI and Amazon Q Developer to hunt for credentials.
"AI agents are creating a new operating problem for the SOC: software can now act with human identities, permissions and authority, while operating at machine speed. The security challenge therefore moves beyond simply discovering agents toward understanding behavioral intent and enforcement," said Francis Odum, Founder & CEO, Software Analyst Cyber Research. "In our coverage, Exaforce is the first agentic SOC vendor correlating SOC with AI activity across identity, endpoint, cloud and code context."
Exaforce AI Security extends the Claude Compliance API integration Exaforce shipped in June 2026, adding other model providers including OpenAI, Gemini and Microsoft Copilot, OAuth-connected AI apps, and endpoint context, so the team that owns AI security and the team that runs the SOC work from one platform, through five capabilities.
Agentless Visibility delivers continuous inventory covering AI apps connected to company accounts, coding agents such as Claude Code and Cursor, hosted agents such as custom GPTs, MCP servers, skills, and IDE plugins, tied to people and permissions. Risks scores every agent, skill, MCP server, and plugin for risk and pairs with recommended fix for excessive permissions to unvetted servers.
Governance enforces safe AI use defining which AI apps, agents, and models are sanctioned and for whom, applying them as rules through identity, endpoint, and model-provider controls already in place. Threat Detection correlates actions of agents, agentic apps, and prompts with human identities, endpoint data, file access, and code context to derive intent and detect misuse, sensitive-data exposure, and active threats.
Threat Containment contains detected threats before damage by revoking session, deactivating model-provider API key, isolating device, or ending agent's process via agent kill switch, all through existing EDR, identity, and model-provider controls with autonomy settings. Usage monitoring provides visibility into token usage by users and anomaly detection to identify runaway AI token use, exploitation or misuse.
Under the hood, AI Security ingests endpoint data from EDR, audit and usage logs from model providers, and activity from productivity suites into Exaforce knowledge graph, alongside identity, cloud, SaaS, and code data the platform already ingests and correlates. Exaforce AI Security is generally available today on the Exaforce Agentic SOC platform, self-operated or through Exaforce MDR.
"Exaforce's entry into agent observability and control is a key development for SOC operations, moving them further toward the critical aspects of machine-vs-machine automation and defense," said Lawrence Pingree, Head of Research, SACR.
About Exaforce
Exaforce is the pioneer in agentic security operations. Its AI-native platform combines a real-time security knowledge graph with AI agents. It is supported by an MDR service that helps teams detect, triage, investigate, and respond to threats at machine speed. Backed by $200 million in total funding from HarbourVest, Peak XV, Mayfield, Khosla Ventures, and Seligman Ventures, Exaforce serves security teams at enterprises across healthcare, technology, financial services, and other high-target industries. The company is headquartered in the Bay Area with a growing global presence.
