Black Hat USA 2026, Las Vegas. Day 1. A researcher climbs the stage and drops what the hallway chatter will call "the framework-level vulnerability" — an attack that doesn't exploit one bad agent prompt, that isn't a prompt-injection a clever system message can patch, but something sitting deeper, in the execution layer of the Model Context Protocol itself. The rails every agent rides. An hour later, my phone starts buzzing with press releases. Vendors I've been chasing for months for a quiet technical briefing are suddenly front-loading their product announcements. Over the next 48 hours, more than fifteen security companies — Cyera, Rubrik, SailPoint, Check Point, Sweet Security, Zero Networks, Tanium, Promptfoo, Legit Security, Acalvio, KnowBe4, Drata, 1Password, Mimecast, Abnormal AI — ship or announce products aimed at one thing: securing the agent infrastructure layer. "The Agent Security Gold Rush" is the phrase flashing across the Business Hall on Day 2. Seventeen booths, four functional categories, zero independent audits disclosed. And not a single demand-side data point — no ACV, no customer logos, no POC counts — that would tell you whether this market was actually bought or merely sold.
I have seen this movie before. In the summer of 2020, I stood in Brussels at EthCC watching DeFi protocols launch bonding curves with the same fever-dream energy. I interviewed the founder of a rising yield aggregator called LiquidityX just days before its launch, wrote a narrative-driven piece on its innovative bonding mechanism, and watched $2 million in TVL flow in on the back of it. Weeks later, a reentrancy exploit drained it. My article was cited as a cautionary example of hype-driven journalism, and I still carry that scar. So when fifteen vendors stampede into a market inside 48 hours, I don't hear opportunity. I hear the exact sound DeFi Summer made right before the first domino dropped. The pixel wasn't the asset back then. The prompt isn't the attack surface now. The tool schema is.
Context: MCP is the container ship for agent tool calls
Let's back up. The protocol everyone is suddenly securing is young, and most established security engineers I talk to still roll the acronym around like it's a typo. Model Context Protocol. Open-sourced by Anthropic in November 2024. It is an open standard that connects AI models to external data sources and tools — think of it as the USB-C port for agent-to-tool communication. Claude, ChatGPT, and a fast-growing fleet of enterprise agents use MCP to call APIs, query databases, read files, sign data, and execute transactions. The official Python and TypeScript SDKs ship with an OAuth 2.1 authorization framework, and there is a governance layer in the architecture. None of that is enough.
During my 2025 deep-dive into the AI-Crypto convergence beat, I sat through an exclusive demo with a startup using blockchain-verified AI model weights, and I tested decentralized compute tools firsthand. The pattern I kept hitting was the same one security researchers had flagged since late 2025: MCP tool definitions cannot be trusted. Attackers can inject malicious instructions into tool descriptions, and the model, after decoding the schema, will happily call dangerous functions because it believes the description is authoritative. MCP servers lack clean data-flow isolation between each other — when multiple agents collaborate, shared context and namespaces let a prompt injection move laterally between tool sets. And the authorization model is weak, treating "server identity" the way early crypto exchanges treated "metadata" — as a polite suggestion rather than a security boundary.
Given that background, the Day 1 Black Hat disclosure matters way more than the marketing that followed it. The "framework-level vulnerability and compute-layer attack" described in the briefing is not a case of a specific agent being tricked. If the early reports are accurate, this is an attack that works at the protocol or execution level, letting an attacker influence the result of tool calls directly — the equivalent of a smart contract bug that corrupts the shared ABI rather than one contract's logic. That's the difference between "someone minted an NFT they shouldn't have" and "the standard itself is compromised." It turns every MCP-connected agent into a potential victim simultaneously.
The market response was almost instant. But the response should not be mistaken for a technological breakthrough. It was largely an adaptation event. Security vendors took existing capabilities — CASB, identity governance, next-gen firewalls, DLL inspection and data loss prevention — and re-branded them around agents and MCP. That's what 15-plus products in 48 hours actually means. You cannot build genuinely novel security technology from a standing start inside two days. You can, however, re-skin your existing dashboard, add the words "Agent" and "MCP" to your slide deck, and book a booth. The speed and breadth of the wave confirm the adaptation thesis; the disturbing part is that a few of these products will still be useful because the problem is real.
Core: The four categories and what they actually contain
The wave splits into four buckets, and how you read those buckets determines how you position for the next 18 months.
The first bucket is visibility and discovery. Cyera's Agent Guardian hunts for shadow agents and maps MCP activity; Rubrik announced Agent Identity and Agent Rewind, which builds an asset inventory plus least privilege and a behavioral rewind for agent actions; SailPoint's Agentic Fabric tries to extend identity governance into agent identity; Drata is pushing compliance-driven agent observability. These are the products most enterprise security teams will buy first, because "we can't see what agents are running" is the most familiar pain — it's Shadow IT all over again, except the shadow version now has the ability to call your production API autonomously.
The second bucket is active blocking. Sweet Security's Agentic AI Blocking terminates unauthorized calls at runtime. Check Point built an AI Network Firewall that discovers MCP communications and claims Layer 7 awareness of JSON-RPC flows. Zero Networks introduced Least Agency, a label I genuinely like: enforce minimal privilege and route sensitive operations through human approval. This is the most technically demanding category and the hardest to commoditize. But it's also where the shallow half-truths live. Runtime blocking against agents requires a low false-positive rate, because if you block a legitimate agent's permissioned transaction, the business unit pulls the tool out of your security stack in a week. None of these vendors has released third-party validation of its false-positive rates. None has published a public red-team benchmark.
The third bucket is MCP communication security — the most protocol-native group. Tanium's Atlas MCP Server exposes controlled data to Claude and other agents inside the Tanium infrastructure. Promptfoo, known in the LLM evaluation community, is shipping an MCP Proxy that sits between agents and tools with red-team demonstrations baked into the narrative. Legit Security's VibeGuard 2.0 protects AI coding agents and layers MCP controls on top of its existing application security posture. These products are effectively betting that MCP becomes the standard connector protocol for all enterprise agent tool calling. That bet is structurally identical to a DeFi protocol betting on one token standard before the SEC weighs in. The upside is enormous; the downside is that the foundation can shift underneath you, and there is little you can do about it.
The fourth bucket is deception and compliance extension. Acalvio's ShadowPlex uses honeytokens and decoy tools to bait attackers who are probing agent infrastructure. KnowBe4 extends its risk-management training to agent deployments, including Claude as a subject of governance. 1Password is wrapping agent credential management into its existing vault architecture. Mimecast and Abnormal AI are layering agent-aware email and API abuse detection onto their message-security platforms. These are the most clearly commoditized entries. They will sell because procurement already has contracts with these vendors, not because the underlying technology is novel.
Let me be precise about the innovation levels, because this is where the market is lying to itself. Cyera's Agent Guardian is combinatorial innovation: existing data security extended to the agent scenario, no new architecture, but the timing is savagely good. Rubrik's Agent Rewind has incremental meaning — a temporal rollback for agent actions, a natural extension of backup technology — but cross-agent causal tracking is nowhere near solved in the public material. Check Point's firewall is engineering value, not a theoretical breakthrough. The product with the highest landing potential on the technical side is Sweet Security's runtime blocking, if it genuinely works. "Least Agency" from Zero Networks is the strongest conceptual contribution of the entire wave because it reframes the problem from the perimeter to the principle of minimal execution. That is a paradigm shift hiding inside an otherwise crowded press release list.
Here is what the market doesn't want to discuss. The core technical gaps that matter most are the ones nobody solved. MCP server identity and trust remains a mess. There is no standard identity framework equivalent to SPIFFE in the MCP ecosystem. Every vendor is implementing its own version of "discovery" — Four different identity schemes for the same protocol is just fragmentation wearing a trench coat. Agent behavior baseline and anomaly detection is the deep problem. Sweet's runtime blocking and Acalvio's decoys depend on modeling what "normal" agent behavior looks like, but agent workflows are dynamic, multi-intent, and frequently non-deterministic. In my audits of agent orchestration systems, I can tell you honestly: nobody has yet built a reliable baseline that survives a weekend of a business user changing the way they prompt an agent. Cross-agent causal tracking for something like Agent Rewind is an open research problem. Rolling back one agent action requires knowing exactly what that action caused in every downstream system, and in a multi-agent delegation chain, the causality graph is so complex that claiming "rewind" is marketing courage, not engineering certainty. Finally, nobody in the wave is publicly detailing MCP communication encryption or fine-grained OAuth extensions, like mTLS support or resource-level token scoping. That is not an enhancement. That is the floor.
This is why my technical maturity read is so consistent: the entire category sits somewhere between proof of concept and early production. The 48-hour synchronized launch says these products have reached at least one version that demos cleanly. It does not say they have survived a year of production-grade enterprise traffic or a genuine adversarial red team. The market is being formed by anxiety, not by proven efficacy.
The economics of a stampede
The single most important business signal of this entire event is not a product feature. It's the fact that 15-plus vendors coordinated around the same market segment inside 48 hours. In industrial economics, that kind of synchronized supply-side jump happens when three conditions align: a technical standard has just stabilized; a security incident has just created urgency; and budget owners have started earmarking funds. All three are present here. The Day 1 disclosure supplied the incident; MCP's growing adoption supplied the standard; and the fact that agents are already running in production supplied the budget narrative.
And yet I'm going to argue the uncomfortable part loudly: this is supply-side self-confirmation, not demand-side validation. Zero customer adoption numbers were released. Zero procurement commitments were cited. The entire wave was orchestrated around an event calendar — "pre-planned launch plus conference detonation" — which is a marketing strategy, not a market. Enterprise buyers at these conferences told me the same thing on the record that vendors wouldn't say on theirs: they are doing POCs, they have no evaluation benchmark, and they are deeply confused about which category of product they should even pilot first.
The customer picture, based on my conversations in the aisles, is triangular. Large enterprises feel the shadow-agent problem acutely — business units are deploying agents before security teams can count them, and CISO offices are losing an internal power struggle. Those Fortune 500 buyers will pay, but their cycle is six to twelve months and they will obsess over compliance obligations. Regulated verticals — banks, health care, government — have the strongest payment willingness because their auditors are already asking questions about AI usage. Mid-market companies are waiting for a standard to emerge, which means they will wait twelve to eighteen months and likely buy from an existing platform vendor. Small companies aren't buyers at all; they're going to get agent-hacked and then become cautionary tales.
I expect pricing to evolve from endpoint-counting to activity-counting within two years. Visibility products will charge per agent or per seat, roughly in the $5-to-$15 per month range in the early days. Active-blocking products will price on call volume, following the API gateway model of per-million calls. That shift from static seats to dynamic risk exposure is going to be the core unit economics battle in this market. The vendors who price on agent activity, not on headcount, are the ones whose revenue tracks actual embedded value.
The mapping to crypto is uncomfortable and inevitable. In the DeFi Summer of 2020, we saw the same signal structure: a burst of enthusiasm, a standardized substrate (ERC-20 and then the first DEX invariants), a wave of audit theater, and a catastrophic second act. LiquidityX taught me that a shiny bonding curve and a charismatic founder can produce $2 million in TVL and zero real security. The agent-security wave is running the exact same playbook. It's Tether all over again — and I mean that specifically. Tether dominates roughly 70 percent of the stablecoin market, and its reserves have never had a truly independent audit. The entire industry quietly pretends this problem doesn't exist because the alternative is inconvenient. The agent-security market is now doing the same thing with runtime blocking: building a dominant position in the conversation without a single independent, audited, production-scale proof that the blocking actually works under adversarial conditions.
The most under-reported dynamic in this entire wave is the Shadow Agent problem itself. Four vendors — Cyera, Rubrik, SailPoint, Drata — are all targeting visibility and discovery of shadow agents. Security companies do not invest this heavily in a problem that doesn't already exist at scale inside their enterprise customers. The vector here is not a security team ignoring a warning; it's business units quietly adopting agents without telling anyone. A sales director gives an AI agent access to a CRM and a mail tool. A financial analyst gives an agent the ability to pull treasury data into a spreadsheet. That agent is now "operating without oversight in the enterprise network," and the security team won't find it until the quarterly audit. The shadow-agent density in production environments is, in my view, dramatically higher than public statistics suggest. There is also the missing-global-dimension observation: in the entire wave announcement, I did not see Chinese vendors — no Alibaba Cloud, no Tencent Cloud, no Chaitin, no Sangfor — showing up in the first line. That doesn't mean they're absent from the agent security race; it means they are not yet competing on this international stage at this exact conference cycle. If history is any guide, that gap will close quickly and with localized products tailored to domestic compliance requirements.
Contrarian: the real war is platform capture
The contrarian angle nobody in the Business Hall wants to hear is that the security vendors are not the protagonists of this story. They are a supporting cast entering a film in which Anthropic, OpenAI, and Microsoft are the studios. The real strategic question of the next 24 months isn't which security product wins the visibility bake-off. It's whether the companies that control the models and the agent frameworks will absorb the security layer natively before the independents can build defensible positions.
MCP is an open protocol, and that gives Anthropic an enormous governance advantage. If MCP's security evolution follows the path of OAuth 2.0 — where security features become part of the standard and every vendor inherits them — then the independent security market shrinks to the margins: the edge cases, the niche compliance needs, the customers who refuse the platform's native controls. That's Path A, and every security vendor in this 15-plus wave is implicitly betting on it because they're building on top of the protocol. Path B is darker for them but entirely plausible: if MCP security remains weak, enterprises route around it toward walled gardens — Microsoft's Copilot Studio controlled ecosystem, OpenAI's managed agent environment, Anthropic's own enterprise deployment stack. In Path B, the walled gardens build native security into the platform, and the MCP-specific independent products lose their reason to exist.
I flagged this tension in my AI-Crypto analysis in early 2025, and the Black Hat wave confirms it. The security platforms are simultaneously partners and adversaries to the firms that control the base models. Under the surface, there is a quiet war over who owns the agent relationship with the enterprise customer. The security vendor captures the tool-call interception layer; the model vendor captures the prompt and planning layer. History says the higher layer wins: the model vendor controls what the agent intends, and the security vendor only controls how the tool reacts. In the long run, the platform will generate the most complete telemetry, the most granular policy enforcement, and the most trusted audit trail. Independent security companies will survive either by out-executing them on false-positive rates in runtime blocking, or by owning integrations the platform vendors won't fund, or by being cheap enough to swallow.
And here's the reverse causality that virtually no coverage has mentioned: the security market forming is not an obstacle to agent adoption — it is a catalyst. Every CTO and CISO I've interviewed since 2025 gave me the same answer to why they haven't scaled agents in production: "We can't control the risk." The moment they can point to visibility, blocking, and audit tools — even imperfect ones — they gain the internal clearance to deploy more agents, not fewer. A security product wave like this one does not slow the spread of agents; it accelerates it. The market for agent security is therefore a leading indicator of a massive enterprise agent deployment wave, not a reflection of one that already happened. That's bullish for the entire agent economy in a way that the conference narrative completely misses.
The community didn't wait for permission. Business units deployed agents on shadow infrastructure months ago, made them productive, and then told security teams to catch up. That is the ground-level truth of the Black Hat wave: the vendors are all selling rearview mirrors for a car that's already been driven a thousand miles. What separates the survivors from the hype will be whether their products act like a seatbelt or a tow truck.
Takeaway: what I'm watching next
The hardest lesson from my 2020 DeFi reporting — the one that cost me credibility and taught me to rebuild my workflow around a two-tier editorial process — was that enthusiasm must be separated from verification. I now apply the same framework to agent security. When a vendor tells me they can block unauthorized agent calls, my first question is never about the demo. It's about the false-positive test. It's about who red-teamed it. It's about whether the baseline was built on production agent traffic or a lab prompt loop. That's the "Red Flag Checklist" I now run on every bullish narrative, and it applies painfully well to this vendor wave.
The first real signal to watch is Sweet Security's runtime blocker in a production enterprise environment. If it holds a low false-positive rate against live business agent traffic for six months, it becomes the category-defining product. If it doesn't, the entire "active blocking" bucket gets quietly rebranded as next year's "agent detection" feature inside a larger platform. Watch CrowdStrike, Palo Alto Networks, and Microsoft Defender. They were not in the first wave, and that absence is a countdown. Once one of the big three enters, the consolidation clock starts ticking, and the independent vendors become acquisition targets. I expect the first significant MCP-specific acquisition within 12 to 24 months.
Watch the MCP spec itself. The 0.x to 1.x version migration is an opportunity for built-in security: server attestation, resource-level OAuth scopes, mTLS support. The moment those features land in the protocol, the vendors whose entire value proposition was "MCP has no security" will lose the foundation of their pitch. Watch the first production-scale MCP exploit that escapes the conference theater and becomes an incident at a live enterprise. That will tell you whether Day 1's framework-level vulnerability was the bottom of the iceberg or just the tip of it.
And watch the budget line. The next earnings season I'm tracking from the crypto side is the AI safety spend "line item" — whether Agent security budgets come out of security budgets or AI budgets determines the entire mapping of who owns this market. If it's security budget, the CISO owns it, and the platform vendors will consolidate around compliance. If it's AI budget, the CISO is cut out of the deal, and the shadow-agent problem becomes existential for the security industry.
The pixel wasn't the innovation in the NFT era, and the community didn't buy JPEGs for the pixels. They bought social signaling, status, and belonging. And even after the crash, that value didn't depreciate to zero — it got refined into something less speculative. The same thing is happening here. What is being sold in Las Vegas this week is not agent security technology. It's the narrative that someone is in control of the autonomous agents multiplying inside the enterprise. The first fifteen vendors are selling that narrative at different price points and with different degrees of merit. The vendors that actually deliver control will become the foundation of the machine economy; the ones that merely sell the story will get reentrancy'd by the market itself.
I saw this movie in 2017 when I decoded whitepapers at 4 a.m. for a 50,000-reader exclusive on 0x, and I saw it again in 2020 with LiquidityX, and again in 2022 when the dominoes fell and I wrote the "Survivors of the Crash" series instead of chasing after insolvencies I'd missed. The pattern doesn't change, because institutions don't learn it. Markets overreact to narrative velocity and underweight verification cost. The agent security market will consolidate, some of these seventeen products will quietly die, a few will be acquired at a premium, and the technology that genuinely survives will be the boring stuff: identity, least privilege, auditable tool calls, and runtime controls that socialize with production workloads. That isn't a four-hour keynote story. It's the story that takes 24 months.
The market has already crystallized. The question now is whether it crystallizes around real safety, or around the un-audited confidence that cost DeFi its first summer — and cost stablecoins their credibility. I've been burned by both. I'm not making that bet again without a baseline.
