We are pleased to be recognized as a rated vendor in KuppingerCole's 2026 Leadership Compass on zero trust platforms.

For Unosecur, the inclusion comes as identity security is taking on a wider role in enterprise access. Employees remain part of that problem. So do non-agentic machine accounts and AI agents that can act across cloud services, SaaS applications, developer tools, and business data.

This article does not reproduce KuppingerCole's assessment, rankings, quotations, or report graphics. You can read the official Leadership Compass through KuppingerCole. 

Why do zero trust platforms increasingly depend on identity?

NIST defines zero trust architecture around an absence of implicit trust based on network location or asset ownership. Access depends on explicit authentication and authorization before a session reaches an enterprise resource.

That principle becomes harder to enforce when access is spread across systems that maintain different accounts, permissions, credentials, and activity records.

A cloud role may have accumulated rights it no longer needs. A service account can remain active after its original workload changes. An AI agent may receive authority through tools that were approved at an earlier point, even though its current task requires a much smaller scope.

The security question therefore extends beyond successful authentication. You need enough context to decide what an identity should be allowed to do at the point where access matters.

That is where identity governance and runtime policy meet.

How does Unosecur approach identity security?

Unosecur's identity fabric connects existing identity providers, cloud environments, SaaS applications, and on-prem systems through a common governance layer. Its purpose is to correlate ownership, permissions, activity, and access paths so a security team can make decisions with context that would otherwise remain split across products. 

The architecture overlays the systems already in place. Existing IAM, IGA, PAM, cloud, and security products can continue serving their own control points while Unosecur builds a shared view of identity activity around them. This is the core control-plane position defined in Unosecur's approved product messaging.

The distinction matters for zero trust platforms. Visibility alone cannot reduce excess privilege. A useful control layer has to connect observed behavior with an access decision.

Unosecur uses activity to identify permissions that exceed actual use. That evidence can support tighter policy, temporary elevation when additional rights are justified, and an audit trail after the change.

This makes least privilege an ongoing control process rather than relying solely on periodic review.

Extending the control model to machine and agent access

Machine access creates a different operating problem from employee access. Non-human identities can include service accounts, workload identities, API keys, OAuth tokens, and other non-agentic credentials. They often persist because an application continues to run even when its original access assumptions have changed.

AI agents introduce their own enforcement point. They can call external tools and act using delegated authority, which means AI agent security has to account for the action an agent is attempting at that moment. Unosecur addresses that path through the MCP Auth Gateway.

The gateway sits between an MCP client and the tools reached through MCP. A tool call passes through this control point before execution. That placement allows the access policy to apply when an agent acts, rather than treating an earlier connection or consent event as sufficient authorization for every subsequent request.

This is also where MCP security connects with the wider identity model.

The MCP Auth Gateway can restrict tool access using least-privilege policy. Just-in-time grants can provide temporary authority with an expiry. Keyless transactions keep credentials within the gateway rather than placing them inside the agent. Runtime checks can evaluate intent and sensitive data as calls move through the control point. Those mechanisms address a specific Zero Trust problem: an authenticated agent may still attempt an action outside the access its present task requires.

What does the Leadership Compass inclusion mean?

We are pleased to join KuppingerCole's 2026 Leadership Compass on zero-trust platforms, as it gives us an opportunity to explain how Unosecur fits within this security model.

Our work centers on the identity control layer. Unosecur correlates access context across an enterprise estate, uses activity to identify excess privilege, and provides enforcement mechanisms in which a policy decision can change the outcome.

The scope now includes AI Agents and non-human identities and agents because enterprise authority no longer belongs only to people. As software gains more freedom to act, access controls need to account for what it can access and what it is doing with the rights it holds.

That is the role we see for identity security in modern Zero Trust: turn identity context into enforceable decisions while the action still matters.

‍