Unlike proxy-, browser-, and API-based AI governance, Morphisec AIUC sees local models and MCP servers, governing them by identity, tool, and permission.
NEW YORK, NY, UNITED STATES, July 29, 2026 /EINPresswire.com/ — Morphisec, a provider of prevention-first security, today announced the general availability of AI Usage Control (AIUC), which discovers and governs the AI tools, autonomous agents, and machine identities running across enterprise endpoints. AIUC extends Morphisec’s patented in-memory prevention to AI governance and runs on Windows, Linux, and macOS inside the Morphisec Protector, the agent customers already use. There is no proxy, no cloud relay, and no second agent to deploy.
Enterprise AI adoption has outpaced the controls meant to secure it. LangChain’s State of AI Agents research found that 51 percent of organizations already run AI agents in production, and Gartner projects that “by 2030, more than 40 percent of enterprises will experience security or compliance incidents linked to unauthorized shadow AI.” The exposure takes several forms: shadow AI, compromised AI, data leakage, and compliance risk across privacy and data sovereignty. The risk is not only unmanaged tools but unmanaged identities running managed ones: a sanctioned agent operating under an identity no one approved, or an approved identity driving a tool no one vetted. And unlike the software before them, agents act. They execute commands, move files, and chain tools on standing privileges, and because an agent cannot reliably separate an instruction from data, a poisoned email or web page can hijack a trusted one outright.
Most AI governance products intercept traffic. They sit in a proxy, a browser extension, or an API gateway and inspect content on the way past. That architecture misses what never crosses the wire: local models, command-line agents, and Model Context Protocol (MCP) servers running directly on the machine. It raises privacy and data sovereignty questions precisely where regulators are looking. And it adds another agent or relay to an already crowded endpoint. EDR does not close the gap either, because it looks for malicious code, not for a sanctioned agent making a legitimate-looking request for data it should never touch. Identity platforms authorize a session, not each action at runtime.
“Everyone else is watching the traffic. We are surveilling the AI agents themselves,” said Ron Reinfeld, Chief Executive Officer at Morphisec. “Agents use credentials at a volume and in patterns no human workforce ever would. We see which identity is driving which agent, which tools that agent has been granted, and what it reaches for, and we govern it in real time, sanctioned or shadow.”
Available today, AIUC delivers:
• AI discovery. Inventories every AI tool, account, agent, browser extension, LLM service, and MCP connector, including shadow AI and the identities behind it.
• Identity-aware governance. Maps every AI action to a user, identity, and device, so teams enforce which tools run by role and catch sanctioned tools running under unsanctioned identities.
• Tool, skill, and permission control. The same agent and identity is benign with one tool and high risk with another: read-only access is not file system access. AIUC governs the tools and skills each agent may use, not just the agent itself.
• Data exfiltration control. Stops AI from moving confidential data off the endpoint based on what a tool is and where data goes, with no content inspection.
• Audit-ready compliance. Inventories and enforcement logs mapped to the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2.
• Runtime guardrails. Least-privilege policies block risky AI actions, such as reaching for credentials, before they run.
AIUC-1, an independent standard billed as “SOC 2 for AI agents,” launched in 2025 and now sits in the Cloud Security Alliance STAR registry. Morphisec maps to AIUC-1 controls across all six of its pillars.
AIUC is available now as a standalone module and in the Anti-Ransomware Assurance Complete bundle, backed by the company’s Ransomware-Free Guarantee. Morphisec will demonstrate AIUC at Black Hat USA 2026, held August 1 to 6 in Las Vegas. Participants can book a briefing at https://www.morphisec.com/events/blackhat-2026/ or visit https://www.morphisec.com/ai-hub/.
About Morphisec
Morphisec provides prevention-first security against cyber attacks that others don’t, from endpoint to cloud. Morphisec stops ransomware, supply chain attacks, zero-day exploits, and now malicious AI. Thousands of organizations trust Morphisec to protect millions of endpoints, servers, and workloads. Learn more at www.morphisec.com.
Jeff Anderson
Morphisec
+1 617-826-1212
email us here
Visit us on social media:
LinkedIn
X
Legal Disclaimer:
EIN Presswire provides this news content “as is” without warranty of any kind. We do not accept any responsibility or liability
for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this
article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
Media gallery
