The tools built to find shadow IT answer one question well: which application is this person using? For a decade that was the right question. Someone put company data in Dropbox, and the job was to notice the domain, score the app, and decide whether to allow it.
Shadow AI looks like the same problem and is not. The thing you need to know is not which app an employee opened. It is what an agent did once it was running: which tool it called, with what arguments, as whose identity, and in what order. An app catalog cannot answer that, because the unit of record is wrong.
You can see the mismatch in how the large security vendors have approached it. Every one of them mapped AI onto the chokepoint they already owned, and the resulting products are very good at the shadow IT question.
What the established vendors built
Three companies show the pattern, taken oldest first. Each built a business on shadow IT years before anyone said shadow AI, and each arrived at AI by extending the machinery it already had, which is the sensible thing to do and also the source of the problem.
Palo Alto Networks is twenty one years old, founded in 2005, and it started with a firewall. Older firewalls judged traffic by its port number, which any application could lie about, so Palo Alto's read the traffic itself and worked out which application had actually sent it. That shipped in 2007. AI Access Security, announced May 7, 2024, is the same capability aimed at AI: the firewall recognizes traffic belonging to any of 600 or more AI applications, and their data loss prevention engine reads the text of a prompt before it leaves. It works only where one of their enforcement points sits in the path, and at launch the prompt inspection covered around 30 of those 600 apps.
Zscaler is nineteen years old, founded in 2007, and it started by moving the corporate web filter into the cloud. All of an employee's internet traffic routes through Zscaler's own network first, wherever that employee happens to be, and that position is the product. The AI Security Suite, launched January 27, 2026, recognizes AI applications in that traffic and reads prompts as they pass through. AI Broker, announced June 9, 2026, extends the same inspection to what agents generate, including MCP calls and agents talking to other agents. Because everything already flows through them, Zscaler sees AI use across thousands of companies at once.
Netskope is fourteen years old, founded in 2012, and it started with a problem the others had not solved. When an employee uses a cloud service, the company's account and the employee's personal account look identical from outside: same website, same domain, same encrypted connection. Netskope Active, released in January 2014, could tell them apart by inspecting who was actually logged in. That distinction is exactly the right one for AI, because a personal ChatGPT account and the corporate tenant look the same to a domain filter. Netskope One AI Security, launched March 11, 2026, added an Agentic Broker that sits in front of MCP traffic and decodes the tool requests and responses inside it.
These are good products. They are also all answering the same question they were designed around: which application is this person using. Watching an agent takes more than that. You need the tool it called, the arguments it passed, the identity it acted under, and where that call sits in the sequence of calls around it. A catalog of AI applications gives you the first item on that list and leaves the rest unanswered.
The limitation is the chokepoint, not the calendar
All three inspect traffic crossing a network boundary they control. That produces two consequences neither marketing nor engineering can argue away.
The first is certificate pinning. Zscaler's own guidance states they cannot inspect TLS traffic from applications that pin certificates, and recommends bypassing or blocking it. Palo Alto documents the same constraint and the same remedy, an exclusion list. Every AI client that ships its own certificate store is outside the inspection path by design.
The second is that a large share of agent activity never crosses a network boundary at all. MCP's stdio transport runs the server as a child process on the same machine. Nothing listens on a port. Netskope deserves credit for saying this out loud: their AI Report 2026 notes that their MCP figures, showing users up 250% and transactions up 375% in ten weeks, represent remote MCP use only, where the agent reaches a server hosted elsewhere rather than on the local machine. That is an honest disclosure of a real boundary, and it applies to the whole category.
Zscaler's response is the most telling. On June 9, 2026 they announced Endpoint AI Security specifically for local models, AI-powered IDEs, and developer extensions. You do not build that product if the cloud proxy already sees those things.
The pattern is not that these companies do not understand AI. It is that a system designed to classify applications gets extended to classify AI applications, and the extension inherits the original unit of record. A catalog of 3,400 AI apps tells you which app. It does not tell you which tool call.
What the newer companies are doing differently
Cyera, founded 2021, launched Agent Guardian and Cyera Endpoint at Black Hat on August 3, 2026, and it is worth studying precisely because it is not a gateway. Cyera starts from the data: classify what is sensitive at rest, map which identities and agents can reach it, then watch runtime access. Cyera Endpoint puts an agent on the laptop and reports which AI tools are running locally and their use of bash, code execution, and MCP calls, covering Claude Code and ChatGPT Desktop by name.
That catches the case a gateway structurally cannot, and it answers a question a gateway cannot answer either: not just which tool the agent called, but what the underlying store actually contains. The tradeoff is software installed on employee machines, with the privacy conversation that comes with it, and enforcement that acts on data access rather than brokering each call. Neither product has a published availability date.
Zenity, founded 2021 by two former Microsoft cloud security engineers, launched its AI Security Platform for Autonomous Agents on July 27, 2026. Their heritage is low-code and no-code security, which is why they handle Copilot Studio and Agentforce agents well. The gateway piece evaluates each call before execution against agent intent, identity, requested action, and prior activity, rather than a static allow list. They also bolt registry scanning onto the inventory so shadow servers surface next to known ones. That second mechanism exists because their gateway, like every gateway, only sees calls routed through it. They also have to keep earning their place against Microsoft, AWS, and ServiceNow, all of which ship agent control planes of their own.
Omnafy takes the tool call as its design center rather than the application. The record it keeps is the call, the server it went to, the identity it went as, and where it sits in a sequence. That last part matters more than it sounds, because the interesting failures are chains where no single call is alarming and the sequence is. A library of approved servers gives the log something to compare against, so a call to something nobody approved is visible when it happens rather than at audit time.
Being built around MCP rather than extended toward it buys specific things. Policy evaluates the actual arguments to a tool, not a domain. Credentials can be issued per call instead of living in an environment variable, because there is an interception point designed for it. And when the 2026-07-28 spec removed sessions and moved method and tool names into headers, that changed the thing the product already treats as primary rather than introducing a new traffic type to classify. It carries Zenity's limitation for the same reason: an agent talking directly to a server it was pointed at, or a stdio server running against a local file system, appears in an Omnafy log no more than in anyone else's proxy. The library narrows that, since a server missing from it has no approved route, but narrowing is not closing.
The useful way to read this
Gateways govern the agents you know about. Discovery tools find the ones you do not. Anyone selling you either half as the whole answer is describing a product rather than a problem.
What the newer companies get from starting after MCP existed is not better engineers or more urgency. It is that the tool call was the design center from the first commit, so per-call identity, argument-level policy, and ordered audit are properties of the architecture rather than features added to a classifier. The established vendors are converging on the same primitives, and they have distribution, telemetry, and inline position that no startup can match. The interesting question over the next two years is whether the unit of record is easier to change than the install base.