Varonis launches Atlas, an AI security platform for agents, LLMs and their data
Varonis made Atlas generally available on 17 March 2026: AI inventory, AI-SPM, LLM pen testing, runtime guardrails and compliance mapping in one platform.
On 17 March 2026, data security company Varonis announced general availability of Varonis Atlas, which it describes as an end-to-end platform for discovering, testing, guarding and governing AI systems inside an enterprise. This is a product launch, not a security incident. It's still worth a developer's attention because it shows what security teams will soon ask of teams that ship LLM features and agents: an inventory, red-team results, a gateway in the request path, and an audit trail.
What happened
Varonis announced Atlas from Miami as a product built on its existing Data Security Platform. The company groups the features into three stages:
- Find: AI inventory and shadow-AI discovery covering agents, models, tools, MCP servers and supporting infrastructure. It also includes AI security posture management (AI-SPM) for misconfigurations and sensitive-data exposure, and AI pen testing that sends adversarial prompts such as prompt injection, jailbreaks and policy bypass to live LLM endpoints.
- Fix: runtime guardrails delivered through an AI gateway that inspects prompts, responses and agent actions in the request path. Compliance reporting maps AI systems to the EU AI Act and the NIST AI Risk Management Framework, and third-party AI risk assessment uses AI bills of materials (AIBOMs).
- Alert: activity monitoring that records prompts, responses, agent actions and guardrail decisions, plus AI detection and response (AIDR) with SIEM and SOAR integration.
Varonis lists integrations including Microsoft 365 and Copilot, ChatGPT, Google Workspace, Google Cloud, AWS, Azure, Databricks, Salesforce, Box and ServiceNow. Atlas is available now with a free trial. The announcement didn't include pricing. Ron Bennatan, VP of AI and Data Security Strategy at Varonis and a co-founder of AllTrue.ai, argued that most AI security tools are "fragmented and data-blind," and that Atlas stands apart by linking AI activity to data sensitivity and access permissions.
Who is affected
- Existing Varonis customers, who can add Atlas on top of the data classification and permission mapping they already run.
- Platform and ML engineering teams at companies whose security groups are choosing an AI security platform. Your services may end up behind its gateway or under its scans.
- Teams subject to the EU AI Act that need documented inventories and risk assessments.
What it means for developers and engineering teams
Whatever product your company picks, AI security platforms in this category tend to impose the same things on engineering teams, and it's easier to design for them early:
- A gateway in the path. Runtime guardrails work by proxying LLM calls. If your app calls model providers directly from many services, routing them through one internal gateway or SDK wrapper makes it much easier to adopt any guardrail product. It also helps with cost tracking and switching providers.
- Inventory means metadata. Discovery tools look for model endpoints, agent frameworks and MCP servers. Agents and MCP servers that are declared in code or infrastructure-as-code, with owners and the data scopes they touch, will show up correctly instead of being flagged as shadow AI.
- Least privilege for agents. The data-centric pitch is that what an agent can read matters more than what it is asked. An agent with a service account that reads every SharePoint site is a data-leak risk whatever its guardrails say. Narrow tool and data scopes are something you control directly.
- Logs of prompts are sensitive data. Full prompt and response capture creates a new store of confidential material that needs its own retention and access controls.
Treat vendor claims of "end-to-end" coverage carefully. Ask how a platform handles self-hosted models, streaming responses, tool calls in agent loops, and latency added in the request path.
What to do now
- Centralize LLM calls behind one internal client or gateway, so a guardrail or logging layer can be added in one place.
- Write an AI inventory for your services: models used, providers, agent tools, MCP servers, data sources and owners.
- Scope agent credentials to the minimum data each tool needs, and prefer per-user delegated access over broad service accounts.
- Run your own prompt-injection tests in CI against staging endpoints before a platform team does it for you.
- Define retention for prompt and response logs and restrict who can read them.
- If you're evaluating Atlas or a competitor, use the free trial against a non-production agent and measure added latency and false positives.