Unlike proxy-, browser-, and API-based AI governance, Morphisec AIUC sees local models and MCP servers, governing them by identity, tool, and permission.
Morphisec, a provider of prevention-first security, today announced the general availability of AI Usage Control (AIUC), which discovers and governs the AI tools, autonomous agents, and machine identities running across enterprise endpoints. AIUC extends Morphisec’s patented in-memory prevention to AI governance and runs on Windows, Linux, and macOS inside the Morphisec Protector, the agent customers already use. There is no proxy, no cloud relay, and no second agent to deploy.
We see which identity drives which agent, which tools it has, and what it reaches for, and we govern it in real time, sanctioned or shadow, without reading a single prompt”
— Ron Reinfeld, CEO
Enterprise AI adoption has outpaced the controls meant to secure it. LangChain’s State of AI Agents research found that 51 percent of organizations already run AI agents in production, and Gartner projects that “by 2030, more than 40 percent of enterprises will experience security or compliance incidents linked to unauthorized shadow AI.” The exposure takes several forms: shadow AI, compromised AI, data leakage, and compliance risk across privacy and data sovereignty. The risk is not only unmanaged tools but unmanaged identities running managed ones: a sanctioned agent operating under an identity no one approved, or an approved identity driving a tool no one vetted. And unlike the software before them, agents act. They execute commands, move files, and chain tools on standing privileges, and because an agent cannot reliably separate an instruction from data, a poisoned email or web page can hijack a trusted one outright.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
Most AI governance products intercept traffic. They sit in a proxy, a browser extension, or an API gateway and inspect content on the way past. That architecture misses what never crosses the wire: local models, command-line agents, and Model Context Protocol (MCP) servers running directly on the machine. It raises privacy and data sovereignty questions precisely where regulators are looking. And it adds another agent or relay to an already crowded endpoint. EDR does not close the gap either, because it looks for malicious code, not for a sanctioned agent making a legitimate-looking request for data it should never touch. Identity platforms authorize a session, not each action at runtime.
“Everyone else is watching the traffic. We are surveilling the AI agents themselves,” said Ron Reinfeld, Chief Executive Officer at Morphisec. “Agents use credentials at a volume and in patterns no human workforce ever would. We see which identity is driving which agent, which tools that agent has been granted, and what it reaches for, and we govern it in real time, sanctioned or shadow.”
Available today, AIUC delivers:
• AI discovery. Inventories every AI tool, account, agent, browser extension, LLM service, and MCP connector, including shadow AI and the identities behind it.
• Identity-aware governance. Maps every AI action to a user, identity, and device, so teams enforce which tools run by role and catch sanctioned tools running under unsanctioned identities.
• Tool, skill, and permission control. The same agent and identity is benign with one tool and high risk with another: read-only access is not file system access. AIUC governs the tools and skills each agent may use, not just the agent itself.
• Data exfiltration control. Stops AI from moving confidential data off the endpoint based on what a tool is and where data goes, with no content inspection.
• Audit-ready compliance. Inventories and enforcement logs mapped to the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2.
• Runtime guardrails. Least-privilege policies block risky AI actions, such as reaching for credentials, before they run.
AIUC-1, an independent standard billed as “SOC 2 for AI agents,” launched in 2025 and now sits in the Cloud Security Alliance STAR registry. Morphisec maps to AIUC-1 controls across all six of its pillars.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
