AI Defense Stack

Agent & MCP security

Astrix AI Agent Security: agent and non-human identity security platform

Astrix AI Agent Security is an agent and non-human identity security platform from Cisco. It is a commercial product offered as: SaaS. Pricing model: not published.

  • Last reviewed
Visit Astrix AI Agent Security (opens in a new tab)
Commercial Layer 7: Agent and tool access

Best for

  • Existing Astrix customers, and Cisco identity customers following how its agent inventory and credential controls are being folded into Cisco products
  • Identity teams whose main agent risk is long-lived secrets and over-scoped service credentials rather than prompt content

Ownership

Cisco announced on May 4, 2026 that it intended to acquire Astrix Security; a June 29, 2026 update says it has completed the deal. Cisco plans to integrate Astrix's capabilities into Cisco Identity Intelligence. Source, checked October 21, 2026: blogs.cisco.com (opens in a new tab)

Consider instead if

  • You want to buy an agent security platform on its own today. See Zenity or Straiker.
  • You want an agent identity product still sold standalone, built on an access graph that maps what each agent can reach. See Veza AI Agent Security.

What Astrix AI Agent Security does

Astrix treats AI agents as one more kind of non-human identity, so its focus is the credentials and permissions an agent holds, not the content of its prompts. Discover keeps a live inventory of agents, MCP servers, non-human identities and secrets. Secure flags excess permissions and weak settings, gives each agent a human owner, and can revoke access or rotate a leaked secret, with fixes run from Slack and alerts sent to SIEM or SOAR tools. Deploy issues short-lived, just-in-time credentials through its Agent Control Plane. Next to Veza, which sizes each agent's reach through its Access Graph, Astrix leans on the credential lifecycle. Buying it is harder now. Cisco completed its purchase in June 2026, Astrix ended standalone sales of new licenses on June 30, 2026, and Cisco plans to fold it into Cisco Identity Intelligence.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Cisco (Astrix Security) Source, checked October 21, 2026: blogs.cisco.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: astrix.security (opens in a new tab)
Ownership
Cisco announced on May 4, 2026 that it intended to acquire Astrix Security; a June 29, 2026 update says it has completed the deal. Cisco plans to integrate Astrix's capabilities into Cisco Identity Intelligence. Source, checked October 21, 2026: blogs.cisco.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: astrix.security (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
SaaS Source, checked October 21, 2026: aws.amazon.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: astrix.security (opens in a new tab)
Website
astrix.security Source, checked October 21, 2026: astrix.security (opens in a new tab)
Documentation
Not documented in the sources we checked
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Astrix AI Agent Security fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Astrix AI Agent Security covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L2 Discovery Discovery and posture Also covers Documents a real-time inventory of AI agents, MCP servers and non-human identities, including shadow agents. Keeps a real-time inventory of AI agents, MCP servers and non-human identities, including shadow and unregistered agents
L8 Monitoring Monitoring and response Also covers Documents detection of and response to threats such as compromised credentials and out-of-scope agent actions. Detects and responds to threats such as compromised credentials and out-of-scope agent actions

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Astrix AI Agent Security, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM06 Excessive Agency Finds agents with excessive privileges and issues short-lived, scoped credentials. Finds AI agents and non-human identities with excessive privileges, vulnerable configurations and abnormal activity, and helps remediate them; Provisions agents with short-lived credentials and just-in-time, precisely scoped access through the Agent Control Plane; Revokes agent access after a policy violation and rotates secrets on a schedule or after a leak; Assigns a human owner to each agent, brings unmanaged agents under governance and retires idle ones

Not mapped in our analysis: LLM01, LLM02, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Astrix AI Agent Security FAQ

Can new customers buy Astrix on its own?

Not according to Astrix's site, which says standalone sales of new licenses ended on June 30, 2026 and that existing customers keep their service and support.

Who owns Astrix Security?

Cisco. A June 29, 2026 update to Cisco's announcement post says it has completed the acquisition of Astrix Security.

Is Astrix open source?

No. It is a commercial product, and we found no public source repository for it.

How does Astrix differ from Veza?

Both treat agents as identities. Astrix's pages stress the credential lifecycle: short-lived, just-in-time credentials, secret rotation and revoking access after a violation, plus an inventory of agents, MCP servers and secrets. Veza's pages stress access paths and blast radius through its Access Graph. Astrix no longer sells new standalone licenses.

Key facts you can cite

We have no commercial relationship with Cisco (Astrix Security).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.