Varonis Atlas Extends AI Detection & Response (AIDR) Everywhere AI Is Used

AI access is no longer constrained by application workflows. Employees use AI everywhere, creating a complex web of tools and agents. Every new connection is another path to sensitive data, and another opening for prompt injection, data leakage, and rogue agent behavior.

Now, we're excited to share that Varonis Atlas is extending AI Detection & Response (AIDR) to more places where AI is used, including browsers and endpoints, and adding new controls for models, MCP servers, and agents. These new capabilities enable organizations to combat shadow AI, runaway spend, unfettered tool access, and rogue agents.

Varonis Atlas already maps the chain of access from users and AI agents to the tools, human and non-human identities, permissions, and sensitive data they can reach, expose, and damage. With enhanced AIDR, Atlas detects when something goes wrong and stops it in real time.

What we're adding to Varonis Atlas:

• Varonis Browser Protection and Endpoint Protection: Govern AI access, protect sensitive data, investigate usage, and stop AI misuse wherever employees use it.
  ‍
• Atlas AI Gateway: Controls model costs through token control and governs agent tool use.
  ‍
• Agent Intent: Defines and enforces agent boundaries.

Together, they make Varonis Atlas the most complete AI security platform on the market, letting organizations safely adopt AI at speed without losing control of their most precious asset: their data.

AI is already in use across organizations — in more places than any single tool can see or control. AI adoption isn't slowing down, and security shouldn’t be the reason it does. With one unified view of how AI is used, what it can reach, and what it costs, organizations can prevent data exposure, runaway spend, and out-of-policy agents while protecting the return that makes AI worth implementing.

With the new capabilities added to Varonis Atlas this week, we're solving four of the biggest AI security challenges:

• Shadow AI and misuse: Employees use AI tools, including personal accounts on corporate devices, that security hasn't authorized and can't control.
  ‍
• Unfettered tool access: Agents and MCP servers reach tools, APIs, and applications with broad standing permissions and no central oversight.
  ‍
• Runaway AI spend: Model usage spreads across providers and spikes unexpectedly, with no consolidated view of usage or cost.
  ‍
• Agent deviations: Agents can drift from their intended purpose, take destructive actions, and put sensitive data at risk.

Browser and Endpoint Protection address shadow AI and misuse. The AI Gateway addresses tool access and spend. Agent Intent addresses agent deviations.

Stitching together point solutions for each problem won't give you a clear picture of your AI environment or the data it touches, and it adds yet another tool to manage. AI security is data security, and it can be governed from one platform.

Varonis Atlas: 6 new and enhanced capabilities

Teams can now secure AI in more places, control spend, govern AI tool use, and prevent agent deviation. Let's take a closer look at what's new in Atlas.

Browser Protection and Endpoint Protection

Employees use AI in the browser and on their devices, often through personal accounts and tools security hasn't approved. That creates blind spots where sensitive data can leak and prompt injection can go unnoticed. Varonis Browser Protection and Atlas Endpoint Protection extend AIDR to both, discovering shadow AI and enforcing guardrails wherever employees use it.

1. Varonis Browser Protection

Varonis Browser Protection detects browser-based AI use and shadow AI, and enforces runtime guardrails on prompts and responses across entire sessions.

Employees use tools like ChatGPT, Claude, and Gemini in their browsers. When something goes wrong, there is no record of what was asked, answered, or uploaded. Browser Protection goes beyond a block list. It audits, redacts, blocks, and quarantines at the prompt level, including personal account use on corporate devices.

• AI discovery: Automatically detect shadow AI, block unsanctioned sites, and monitor sanctioned ones.
  ‍
• AI activity monitoring: Monitor prompts and responses for misuse and classify sensitive data, including attachments.
  ‍
• AI runtime guardrails: Prevent sensitive data leakage and access, prompt injection, and misuse.
  ‍
• Investigate with full context: Record every interaction in a single timeline for investigations and compliance.

Browser Protection deploys as a lightweight browser extension, with no separate integrations to build or maintain.

2. Atlas Endpoint Protection

Atlas Endpoint Protection detects AI use and shadow AI on endpoint devices like laptops and desktops. The Atlas endpoint agent enforces runtime guardrails on prompts, responses, and tool calls across entire sessions. Where Browser Protection covers web-based AI, Endpoint Protection covers local AI applications, model files, MCP servers, and SDKs.

• AI discovery: Automatically detect shadow AI, AI applications, model files, MCP servers, AI browser extensions, and AI code libraries and SDKs on endpoint devices.
  ‍
• AI activity monitoring: Identify sensitive content in prompts and responses and detect tool calls.
  ‍
• AI runtime guardrails: Prevent sensitive data leakage, prompt injection, intent deviation, and misuse.
  ‍
• Investigate with full context: Record every interaction for investigations and compliance.

Customers can also use their existing EDR, such as CrowdStrike, Microsoft Defender, or SentinelOne, to feed shadow AI discovery into Atlas.

Atlas AI Gateway

Every prompt costs tokens, and every agent tool call is a path to data and systems. With model usage spread across providers and agents reaching tools through MCP servers with broad permissions, spend climbs and access goes unchecked. With the new LLM Gateway and MCP Gateway, the Atlas AI Gateway becomes one control point for both, so you can see and cap what models cost and govern which tools agents can use.

3. LLM Gateway

The LLM Gateway provides visibility into model costs and token usage, with policies to rein in spend across 95 providers and more than 3,000 models.

• Complete visibility into spend: See which models and tokens are being used, by whom, and for what use cases, with a clear view of spikes and trends.
  ‍
• Spend controls: Set policies on model and token usage for users, groups, and use cases. For example, set a $500 weekly budget for your dev team’s Claude Code usage, with alerts as spend approaches the limit.
  ‍
• Model-to-task policies: Define which models are used for which use cases, such as drafting sales emails, and apply the policy seamlessly.

4. MCP Gateway

Agents and MCP servers call tools, APIs, and other agents and MCP servers with no central control, creating a web of tool calls that is nearly impossible to govern. The MCP Gateway is one control point for agent tool access, enabling you to decide which tools can be used, by whom, and what actions those tools are allowed to take.

• Control who can call what: Validate identity through your IdP, grant tool access by group, and use delegated credentials so agents act with the user’s permissions. For example, a developer can use Claude Code to query Salesforce and Atlassian through MCP, while Atlas limits the agent to approved read-only tools and blocks potentially destructive actions.
  ‍
• Make every tool call accountable: Tie each call to a real user identity and record it in an investigation timeline alongside prompts.

Agent Intent

The question is no longer “Can the user access this?” It's whether this agent, in this context, for this purpose, using this data, should be allowed to take this action right now. Agent Intent answers that question by defining what each agent is for and enforcing intent controls at runtime, stopping out-of-policy actions before they happen. Agent Intent with Atlas has two components:

5. Agent Manifest

A declared record of an agent’s purpose and limits, defined by its author: what it is for, who owns it, what data it may touch, and what it must never do. The Agent Manifest lets teams state boundaries explicitly, backed by runtime guardrails that prevent drift. It covers:

• Ownership and context: Owning team, business unit, production status, criticality, and approved business domain.
  ‍
• Operating expectations: Autonomy level, expected users, human oversight, and primary use case.
  ‍
• Expected workflow: What the agent should do step by step, and what it must stop and ask about.
  ‍
• Data boundaries and prohibited actions: Per-action rules to control actions like bulk export, credential or secret access, public sharing, and external sharing.

6. Agent Intent-Based Access Control (IBAC) 

Runtime enforcement that compares every agent tool call against the agent’s intent, whether inferred automatically or documented in the manifest, and decides: allow, block, alert, require approval, and more.

Agent IBAC works with or without a manifest, because it can infer an agent’s purpose automatically. For high-risk agents, or agents with powerful tool or sensitive data access by design, the manifest makes intended behavior explicit, including what the agent must never do. It also answers the questions auditors and CISOs will ask: who is this agent acting for, what was it supposed to do, and what did it actually do?

The complete AI security platform

AIDR is just one piece of Varonis Atlas — the first end-to-end AI security solution. With AI-SPM, which proactively protects and secures AI systems, applications, and agents, and AI Governance, which meets compliance and third-party risk management requirements, Atlas lets you adopt AI quickly without choosing between speed and safety.