Agents have access to your sensitive data, the open web, and the autonomy to take action. They read emails, files, and internal apps, then act on what they find at machine speed, with no discretion for malware or prompt injection during the session.
Menlo Agent Runtime Security (MARS) applies the same, trusted controls that have protected users now applied to the agents doing the work. That's threat prevention, file sanitization, data masking, least-privilege access, and policy, all governed from one control plane. And it's delivered via the Menlo Cloud, with no endpoint agent to install.
Gartner projects that by the end of 2026, 40% of enterprise applications will include task-specific AI agents, up from less than 5% in 2025. The controls meant to govern that work were not built for it. MFA, behavioral analytics, and user skepticism all assume judgment on the other end of the session. Agents have none of it. They interpret web and file content literally, so a hidden instruction becomes a command. They are data-hungry by design, so an over-permissioned agent is lateral movement waiting to happen. And the fastest-growing pattern is not the fully autonomous agent. It is a person running an assistant like Claude Cowork or Claude Code that holds standing access to email, files, and source code.
of enterprise workflows are browser-based, the same sessions AI agents now act through
is how agents execute instructions, without the judgment or hesitation that human-centric controls were built to assume
“The next billion users will be AI agents, not humans.”
The agent interacts with web content and data through MARS and receives a sanitized version. Nothing has to be recognized as malicious first, because the dangerous parts are removed rather than detected.
Web pages and documents are rendered and cleaned before an agent ingests them. Prompt injections and hidden page instructions, including invisible and white-on-white text, are stripped before the agent ever reads them, removing hidden instructions so they are unable to hijack an agent's goal.
Files pulled from document stores all run through Menlo File Security. Content Disarm and Reconstruction (CDR), antivirus, and sandboxing cover 220+ file types including archives and password-protected files, removing hidden instructions so that malware is never distrubuted to the rest of the organization.
Token-based authentication gives each agent its own identity and per-agent attribution. While policy can differ between a user and their agent, MARS provides one policy framework to cover both from a single control plane, with granular agent-specific controls where the two genuinely differ.
Menlo AI Adaptive DLP extends the data protections built for users to agents, masking sensitive information in real-time and restricting the data an agent can reach—within the organization and within site content. This ensures agents are unable to exfiltrate sensitive organizational data.
Learn how MARS can secure your people and agents today.
Govern AI agents at runtime across browser sessions, applications, files, and data without slowing enterprise adoption. Inside: where agentic risk concentrates, how to govern agents like users, and a six-step model for controlling what agents can reach.
MARS is not a separate product with its own console and its own policy language. It is browser isolation, Menlo File Security, AI Adaptive DLP, HEAT Shield AI, and policy management, applied to agent sessions as well as human ones. Security teams govern both workforces from one control plane, under one set of rules, at the speed agents operate.
Explore AI Agent Security
Standing access to internal systems plus a path to the open web is exactly the combination MARS is built for.
Per-agent identity and data masking keep proprietary code inside your control while the assistant keeps working.
Framework does not matter. Any agent can register with Menlo, and the exit path is what gets governed.
Frost & Sullivan named Menlo a Global Leader and "Company to Action" in the Frost Radar for Zero Trust Browser Security, estimating Menlo holds the second-largest share of the global market, and Google named Menlo its Cloud Security Partner of the Year for the second consecutive year. The platform secures 400 billion web sessions a year on cloud infrastructure built to absorb malicious code at machine speed, which is the scale agent traffic demands.
Frost Radar™ Global Leader & "Company to Action"
Global Zero Trust Browser Security, 2025
Google Cloud Security Partner of the Year
Second consecutive year
"Menlo has helped us strike the right balance between strong security and business agility."
See how MARS secures agent sessions from a single control plane.
