What Gartner says to look for in AI agent security

Hi John,

Your teams are already building AI agents, and security is expected to govern what it can’t fully see or control. Meanwhile, many vendors claim to solve the same problem. Gartner’s new Emerging Market Quadrant for AI Application Security helps you tell them apart, plotting the vendors Gartner sees as most relevant on potential for market disruption and potential to execute.

Zenity is named a Market Shaper, which Gartner places high on both measures. Gartner says Market Shapers go beyond the basics to analyze the full spectrum of agent behavior, including intent, memory, and tool use, and to compare what an agent was meant to do with what it actually does.

Why does this matter? Over a long session, a prompt injection can steer an agent away from what the user intended, a little at a time, toward unauthorized actions, privilege escalation, or data exfiltration. That’s intent drift, and catching it takes runtime security: continuous monitoring across the whole session and the ability to block unauthorized actions before data is exposed.

Inside the report:

• A vendor evaluation checklist: the three core capabilities Gartner defines (discovery and inventory, automated testing, runtime defense), plus optional extras like MCP traffic inspection and SIEM integration

• The four vendor groups Gartner defines: Market Shapers, Pace Setters, Pioneers, and Specialists

• Where the market is heading: intent drift detection, MCP-level access control, and coverage for coding and workspace agents

• Recommended actions for buyers in each group, from mission-critical agents to early-stage pilots

Use it to pressure-test your next vendor conversation.