AI agents and MCP: what six SASE and SSE vendors state in October 2026

A year of AI security marketing was about chat: what employees paste into assistants and which tools they use. Agents change the question. An agent does not only send text to a model; it calls tools, reads files, opens tickets and runs commands, often through MCP servers that hold their own credentials. A control that only reads prompts sees the request, not the action. So the useful reading of a vendor page in October 2026 is whether it describes controls on the action itself.

Cato Networks states it maps agents, MCP servers and skills, profiles agent actions and risk, and inspects agent prompts, responses and tool calls; its agentic AI page adds that it discovers agents across systems, tools and MCP interactions and applies runtime controls to stop unsafe actions before execution.

Source: Cato Networks: AI security · Read 7 Oct 2026

Source: Cato Networks: agentic AI security · Read 7 Oct 2026

Zscaler states its AI Gateway applies inline DLP and Zero Trust to every model, agent and API call, and that it secures agentic communications through MCP and A2A brokers. Its AI Asset Management page lists MCP servers among the assets it auto-discovers.

Source: Zscaler: AI security · Read 7 Oct 2026

Fortinet states FortiAIGate checks prompts, outputs and agent tool calls before they reach users or systems, and catches prompt injection, jailbreaks and data leaks in Model Context Protocol tool traffic.

Source: Fortinet: FortiAIGate · Read 7 Oct 2026

Netskope describes an Agentic Broker that acts as a proxy to detect and decode MCP traffic, blocks unauthorized MCP communication to remote MCP servers and enforces least-privilege access, with an MCP inventory category in its App Catalog.

Source: Netskope: Agentic Broker · Read 7 Oct 2026

Cisco's Secure Access page describes discovering and registering every agent, mapping each to its human owner, intent-aware authorization for every agent interaction, short-lived least-privilege tokens, and detecting and quarantining compromised agents with inline runtime monitoring. MCP is not mentioned on the pages we read.

Source: Cisco Secure Access · Read 7 Oct 2026

Palo Alto Networks lists Agent Identity Security, AI Runtime Security and an AI Gateway among the Prisma AIRS modules and says the platform governs AI agents at scale. The word MCP does not appear in the AI Access Security or Prisma AIRS overview text we read, and we did not open the AI Gateway sub-page.

Source: Palo Alto Networks: Prisma AIRS · Read 7 Oct 2026

Naming MCP on a product page is not proof of depth, and leaving it out is not proof of absence. What it does tell you is where each vendor is pointing its message. If your developers already run coding agents with several MCP servers, the vendors that name MCP have at least committed to the topic in public, and you can hold them to it in a pilot. If your agent risk is mostly about service accounts and access, Cisco's identity framing may map more directly to how you already think about the problem.

Either way, three questions decide it. Can the control see the tool call before it runs? Can it block or change that call, not only log it? And can it tie the action back to the person or system the agent acts for? Ask each vendor to show all three on one of your own agents.

In the quiz, picking AI agents and MCP servers as a worry triggers the check Controls AI agent and MCP traffic. Vendors whose pages name MCP controls meet it; Cisco and Palo Alto Networks partly meet it on the strength of their agent controls. The full notes and sources for each vendor are on the profiles.

Our reading has gaps worth naming. We did not open Palo Alto Networks' AI Gateway sub-page or its agentic browser announcement, so MCP handling there may be described in more detail than the overview pages show. We read the main AI security pages for each vendor, not their documentation portals, where agent controls are often described more precisely. If you are comparing agent controls seriously, ask each vendor for the documentation page that describes MCP and tool-call handling, and check its date.