ThreatLocker launches Zero Trust AI Control for corporate agents

Moving from info to action

Businesses are increasingly moving beyond using AI for simple information retrieval. Instead, they are deploying agentic AI, which are tools designed to take active roles in day-to-day operations by performing tasks within business systems.

This shift creates a significant security challenge for IT departments. Many current safeguards rely on the AI system following its own internal rules, which may not be sufficient to prevent unauthorized actions or data breaches.

As a result, organizations need a way to manage these tools more strictly. ThreatLocker launched its Zero Trust AI Control on November 4, 2026, to address the need for external oversight of autonomous software.

How the control system works

Zero Trust AI Control functions by applying external limits to what an AI agent can do inside a corporate environment. It allows security teams to decide exactly which applications, services, and systems an agent is permitted to reach during its operation.

A key feature of this tool is that the limits stay in place even when an agent interacts with other software. This includes scripts or browser-based services that the agent might call upon to complete a specific task for a user.

The system operates on a default-deny model. This means an AI agent is blocked from reaching everything in the network by default, and is only granted access to the specific resources it needs for its defined job.

Governing complex workflows

In a modern enterprise, a single request to an AI agent can trigger a chain of actions across many different parts of an IT estate. ThreatLocker designed its tool to govern this entire workflow from the beginning to the end.

The software tracks what agents can execute and connect to as they move between various applications. This prevents an agent from wandering into sensitive areas that are not relevant to the task it was originally assigned to perform.

Security teams can start by using pre-built policies provided by the company. They can then adjust these settings to fit their specific environment, which helps reduce the amount of manual work required to secure AI activity.

Integrating with existing security

ThreatLocker positions this new tool as part of a broader suite of security controls. It is intended to be used alongside ThreatLocker Allowlisting and Web Content Control to create a comprehensive defense strategy.

By combining these tools, security teams can decide which AI applications are allowed into the environment in the first place. They can also determine what specific actions the approved agents are allowed to perform once they are active.

This approach addresses a wider debate in cybersecurity regarding how to contain software that acts with increasing autonomy. It moves away from traditional user-based permissions toward a more complex model of managing software behavior.

The changing security landscape

The launch reflects a fundamental change in the security landscape. Because AI agents are now being used to take actions across organizations, they require a different type of oversight than standard software or human users. Because the restrictions are placed outside the AI's own deployment, they can maintain safety boundaries even if the agent acts in an unexpected way.

Danny Jenkins, the CEO and Co-Founder of ThreatLocker, shared his view in comments accompanying the launch. He noted that the challenge has changed because agents are no longer just providing information. He stated that companies need a way to adopt AI without handing over the keys to their environments.

ThreatLocker, which focuses on zero trust cybersecurity products, serves more than 70,000 organizations globally. The company is based in Orlando, Florida, and maintains a presence in Dublin, Dubai, and Brisbane. The firm aims to provide the tools necessary for businesses to balance AI adoption with robust security boundaries.