The Endpoint Wars Just Restarted (Rise of the AI Agents)

Antivirus was round one. EDR was round two. AI agents just kicked off round three... and this time, the incumbents aren't asleep.

Nearly $400M of Seed and Series A money went into early-stage endpoint security startups in five weeks this summer. Three rounds of $100M+ each.

In the twelve months before that, Palo Alto bought its way into the same fight. CrowdStrike bought its way in twice. SentinelOne bought its way in. Microsoft built its way in.

Endpoint security was supposed to be locked up. Two vendors control roughly 40% of an ~$18B market, and nobody wants another agent on the box. Simple fact. Yet suddenly everyone with a term sheet or a balance sheet is treating the endpoint like open territory.

They're onto something. Here's why, who's racing, and how I think it ends.

The endpoint gets rewritten when the unit of work changes

Endpoint security has been refounded exactly twice. Both times, the trigger was the same: the unit of work on the machine changed.

Round one, the unit of work was files. So we got antivirus. Scan the file, match the signature, sold to IT Operations as hygiene. Symantec and McAfee built empires on it.

Round two, the unit of work became behavior. APTs lived off the land, moved laterally, and left breadcrumbs scattered across processes, memory, and network connections... no recognizable file to scan. Operation Aurora made the point publicly in 2010, when nation-state code sailed past every signature engine on earth, including Google's. Catching that class of attack meant collecting and correlating massive endpoint telemetry in something close to real time.

George Kurtz was McAfee's Worldwide CTO in 2011 when he watched the guy next to him on a plane wait 15 minutes for a McAfee scan to finish before he could use his laptop... his own product. He left with Dmitri Alperovitch, McAfee's VP of Threat Research, and started CrowdStrike. Eighteen months later Stuart McClure, McAfee's other CTO, left with chief scientist Ryan Permeh and started Cylance. The last endpoint war was launched twice from the same office of the same stalled incumbent. Remember that. It comes back later.

Why couldn't the AV giants just respond? B/c EDR wasn't a feature. It was a complete architecture change... a lightweight sensor streaming telemetry to cloud analytics... landing at the exact moment the industry was fighting through its own on-prem-to-cloud transition. Retrofitting a signature engine for that is nearly impossible. Even Carbon Black, an EDR pioneer with on-prem roots, got passed by cloud-native CrowdStrike. Architecture was destiny.

And EDR won on a buyer shift as much as an architecture shift. AV sold to IT Ops. EDR sold to the SOC... a desk that barely existed in 2011 and grew up around the EDR console. New threat, new budget line, and the incumbents' customer relationships parked at the old desk. The tech shift and the buyer shift hit at the same time. That's what made CrowdStrike's growth explosive. It's also why vendors with better-than-remembered technology died anyway. They were aimed at the wrong desk.

Round three's new physics

The unit of work is changing again. It's becoming intent... humans handing goals to software that plans and acts on their behalf. Agents on the endpoint read files, run shell commands, call APIs, and chain tools together at machine speed, using the human's own permissions.

That one fact breaks the assumption every prior generation was built on: the assumption that malicious activity looks different from legitimate activity. When an agent operating under Bob's credentials moves data, every log says Bob. Every individual action is authorized. The sequence is the breach.

The threat catalog is rewriting itself in real time:

And this is live fire. Researchers have shown agent skill files that exfiltrate SSH keys and cloud credentials during preprocessing... before the AI model reads a single token, which means the model's own safety reasoning never gets a vote. The first large audit of a public agent-skill registry found more than a third of ~4,000 skills carried a security flaw, with 76 confirmed malicious. And the coding-agent frameworks themselves are stacking up CVEs: allowlist bypasses, pre-trust execution, sandbox modes that turn out to be inert in default configuration.

My oversimplified view: approved software just got hands. Nothing new was installed. Nothing looks malicious. The trust decision your security team made last year about that IDE, that browser, that SaaS app... it's now wrong, and the tooling that made the decision can't see why.

Fair pushback: doesn't EDR already see this? An agent reading SSH keys and posting them out is a process tree, a file access, and a network event. Classic telemetry. Living off the land 2.0. Valid... the mechanics are fully visible.

But behavioral detection always ran on rarity. Word spawning PowerShell stood out b/c it was weird. Agents make the weird normal. A coding agent legitimately reads .env files, spawns shells a hundred times an hour, and calls APIs all day... the malicious chain and the productive chain are byte-identical at the process layer. Block one and you break the other. The signal that separates them moved up a layer, out of the syscalls and into the language: what the README said, what the tool call meant, whether the action matched what the human actually asked for. Process telemetry has no field for "who authored this instruction."

And the response window closed. Detect-then-respond assumed dwell time. An injected agent chain finishes in seconds... in the preprocessing case, before the model runs at all.

Watch the incumbents' wallets on this one. Defender's newest capability inspects the agent loop instead of the process. CrowdStrike says prompts are the new malware. If yesterday's sensors answered the question, none of those products would exist.

The market is forming faster than the category

Gartner says 40% of enterprise applications will ship with task-specific AI agents by the end of this year, up from under 5% a year ago. Verizon's DBIR found employees regularly using AI on corporate devices jumped from 15% to 45% in one year... two-thirds of it through personal accounts the security team has never seen.

Run the top-down math. Gartner pegs AI software spend at ~$453B this year, up ~60% from 2025... hold that growth rate at even half and it crosses $1T within three years. Put a quarter of that on or through the endpoint, apply security's good 'ol ~5% attach rate, and you get a ~$6B market today growing toward ~$15B. For scale: Gartner has the entire endpoint protection market at ~$18B, headed to ~$26B by 2028 at ~11% a year. The new category would be approaching half the size of EDR by then... growing 3x faster.

One honest caveat, b/c it's the swing variable in every model I've built: this math assumes agentic work keeps landing on the device. If inference centralizes in the cloud behind gateways, the endpoint share shrinks and the whole category deflates. Where inference runs is the quiet bet underneath every loud one.

Five bets on the same problem

Strip the marketing off the new wave and the products cluster into five distinct approaches. No names here... the approaches matter more than the logos, and most of these companies will end up building all five anyway.

The background check. Vet every piece of software, every package, every AI tool before it gets a desk. Admission control. Old-timers will recognize this as allowlisting, a category that died of operational pain 15 years ago. The new bet: AI can finally do the vetting work that used to require a human review queue, at fleet scale, without blocking the business.

The supervisor. Watch the work as it happens... human or agent... at the screen and workspace level, judge the intent behind each action, and grab a wrist before something dumb completes. DLP and insider-risk DNA, rebuilt with small on-device models fast enough to beat the action. The hardest ML problem of the five. False positives will make or break it.

The checkpoint. Inventory every agent, attribute every action back to a responsible human, and intercept the action itself: allow, block, or hold for approval before systems and data get touched. This is the EDR playbook run one layer up... a sensor, an intelligence feed, inline enforcement... aimed at tool calls instead of processes.

The inside man. Instrument the agent runtime itself. Hooks inside the harness, watching preprocessing and tool dispatch that OS-level sensors never see. The credential-theft research above is the entire sales pitch: if your sensor sits at the OS, the data is already gone by the time you look.

The observer. Skip enforcement, win on visibility. A free install on a developer laptop that captures everything agents do... every prompt, file, process, and connection... and tells the CIO what all that AI spend actually bought. The bottoms-up motion, b/c developer machines are where agent density actually lives today.

Common threads across all five: endpoint-resident, prevention-leaning, and billing the same CISO. Hold that prevention thought... it comes back. And note that each approach's roadmap is the other four's product. This category will consolidate before it finishes forming.

The incumbents came armed this time

The big difference from 2011:

Palo Alto --> acquired Koi (Feb 2026) and named the category itself: "Agentic Endpoint Security." Koi feeds an already-assembled Prisma AIRS platform... AI gateway, agent identity verification, red teaming, runtime enforcement, and model scanning under one roof.

CrowdStrike --> acquired Pangea (Sept 2025) and shipped it as Falcon AIDR, GA since December: one lightweight sensor spanning endpoints, apps, agents, MCP servers, AI gateways, and cloud, with a live inventory of the agent fleet... Claude Code, Cursor, Copilot, and the shadow agents nobody approved. Their words: prompts are the new malware.

SentinelOne --> acquired Prompt Security (~$250M) and folded it into Singularity: discovers every AI tool and code assistant in use including shadow AI, enforces policy and redaction across 15,000+ AI services in real time, and sits inline with Copilot, Cursor, and Claude Code so secrets and IP never leave the prompt.

Microsoft --> built it into Defender for Endpoint. Auto-discovers local AI agents and MCP servers, then inspects the agent loop itself... the user prompt, the tool call before it runs, the tool response after... auditing or blocking prompt injection and high-risk actions before they execute. Coding assistants, CLI tools, desktop AI apps. Riding the Defender license your fleet already has.

For calibration: the AV giants took the better part of a decade to mount a real answer to EDR. These four answered round three in months, mostly with M&A. The honest asterisk... bought is a long way from integrated. Much of this is preview-stage, ecosystem-shaped, and carrying real integration debt. But "the incumbents are asleep" is a thesis nobody should be underwriting. They are wide awake and shopping.

There's also a player that didn't exist last cycle: the AI platforms themselves. Anthropic, OpenAI, and Google are building sandboxes, permission policies, credential vaults, and gateways natively into their agent runtimes. In round two there was no "OS vendor of the threat" to worry about. In round three, the companies shipping the agents also ship controls... and whether they open their harnesses to third-party instrumentation or close them decides how much room is left for everyone else.

Meanwhile the analysts are already circulating a category name: Endpoint Control and Prevention. When the name shows up before the revenue, a land grab is on.

Why round three won't play like round two

Four asymmetries. Most of them cut against the romantic version of this story.

1. The incumbents aren't McAfee. McAfee in 2011 was slow, signature-bound, and architecturally stuck. Today's leaders are healthy, cloud-native, acquisitive, and already deployed on 40% of the world's endpoints. Distribution wins ties, and they have it.
   
   

2. No buyer shift... yet. Every dollar in this war, challenger and incumbent alike, is aimed at the same CISO wallet that already pays for EDR. Round two's growth catalyst was the new desk. Round three doesn't have one. Unless it's forming right now: per IBM's CEO study, the share of large organizations with a Chief AI Officer went from 26% to 76% in a single year, and that desk controls AI transformation budget no security vendor currently owns. Whether an AI-security line item crystallizes there, or stays inside the CISO's existing envelope, is the single biggest variable in how big round three's winners get.
   
   

3. Prevention is back. About damn time... and also, we've seen this movie. Cylance ran the prevention-first thesis in round two, sold to BlackBerry for $1.4B, and faded, while detect-and-respond built a ~$100B company. This wave re-runs Cylance's bet wearing better AI. Maybe reasoning engines finally make prevention operable without blocking the business. That's a genuinely new variable. But the burden of proof sits exactly where it sat in 2013.
   
   

4. The challenger math has no middle. The prices paid to enter this race quietly amputated the $1-3B strategic exit... which is how most good security companies actually end. This wave is priced for platform outcomes or nothing. Everyone at the table is playing for the CrowdStrike outcome, in a market where the CrowdStrike outcome happened once.
   
   

How it probably ends

Base case: incumbent absorption. The endpoint hates agent sprawl. Nobody wants a fifth sensor on the box, and the absorption visibly started with February's acquisition. Most of this wave ends up inside four platforms, at prices that will look great or grim depending entirely on how fast the sellers grew first.

The breakout case: a new platform emerges. This needs at least one of two things: the buyer shift materializes (an AI office with its own security budget), or an incumbent stumbles the way McAfee did. Both happened at once in 2011... which is precisely why the CrowdStrike outcome is so rare. I wouldn't bet the base case against it. I'd bet a position on it.

The deflation case: the layer moves. Agentic work centralizes behind managed cloud platforms, the platforms' native controls prove good enough, and "AI endpoint security" ends up a smaller market than the money assumed. Nobody building or funding in this space talks about this one. That's usually a sign it deserves a probability.

The wildcard: a frontier lab writes the check. Google didn't buy Wiz b/c it loved security... it bought the trust layer that makes enterprises comfortable running in Google's cloud. Run that logic one layer down. If agents become how work gets done, the lab that owns the agent control plane sells more agents. A Wiz-sized outcome with a frontier lab as the buyer is genuinely on the table. But remember what Wiz had before Google called: ~$500M ARR and the de facto multicloud franchise. Nobody pays $30B for a roadmap. This one needs crazy adoption first... and a buyer willing to secure its rivals' agents as neutrally as its own.

Four tells will show which way it's breaking, well before the outcomes do:

→ Does a distinct AI-security line item start appearing in CISO budgets?

→ Does senior product and research talent start leaving the healthy incumbents? Nobody left McAfee until it was stuck. Watch who leaves where.

→ Do the AI platform vendors open their harnesses to outside instrumentation, or close them?

→ Does real agent density spread beyond developer laptops to the general fleet?

The bell already rang

The endpoint gets refounded when the unit of work changes. The unit of work is changing... from files, to behavior, to intent.

Round one took a decade to play out. Round two took about five years. Round three went from zero to four incumbent acquisitions and a nine-figure funding wave in roughly fifteen months.

Whatever logo ends up on the winner, the war is on.

Building, buying, or betting on the endpoint's third act? I'd like to compare notes. You know where to find me.