Cursor's certifications are real — SOC 2 Type II, ISO 27001 and 42001 — but the risk lives in the gap between plans: Privacy Mode off by default on individual accounts, a ZDR carve-out for Claude models, and a 2025–2026 CVE run aimed at the agent and MCP trust model. The nine controls to set before rollout.

Four of the nine credible runtime security vendors were acquired in thirteen months, and the survivors raised mega-rounds. What runtime enforcement actually does, the incidents that made it a budget line, and how to compare who's left — empty cells included.

Five AI security independents were absorbed by platforms in eighteen months; the rest raised mega-rounds. The ranked top 10 for 2026, the capability table, and the question that now matters more than features: platform module or standalone specialist?

Cowork is the agent; Enterprise is the leash. The same file-reading, browser-driving agent ships on a $20 personal plan and a governed enterprise one, and the deltas that matter are a BAA that covers neither, a local-history gap, and a browser default that flips September 10.

Not one dedicated AI-security startup publishes pricing. We checked them all on September 5, 2026 — here is every verified public price point that does exist, from $0.10-per-thousand hyperscaler guardrails to HiddenLayer's $5M marketplace unit, plus the four pricing models behind the quote wall and the TCO questions procurement should ask.

Gartner's first Market Guide for Guardian Agents is gated, so the market is navigating by vendor press releases. Here's the independent map: who's confirmed in the guide, who ships the capability anyway, and why the label already means two different things.

Restricted SharePoint Search retires January 31, 2027 and Microsoft won't migrate your config. A literal week-by-week sprint built on Microsoft's own Secure & Governed Data Foundation workflow — assess, contain with RCD, fix permissions, harden — plus an honest cost section.

Perplexity's security page says "HIPAA-aligned" — not compliant — its API docs list only a HIPAA gap assessment, and no public BAA exists. Its own enterprise terms reportedly ban PHI without one. What the SOC 2 claim actually covers, where the ISO 27001 evidence isn't, and the safe-use rules for healthcare teams.

Anthropic signs a BAA for Claude Enterprise, the first-party API, and Claude Code with ZDR — but not for consumer plans, and not for Claude Cowork, which ships inside the same HIPAA-ready Enterprise bundle. The decision tree, the one-way activation switch, and the DLP work the BAA doesn't do for you.

Two open standards, one Army RFI, and an EU annex that reads like a dataset spec. The AI bill of materials went from standards-body hobby to procurement artifact in eighteen months. What it holds, who wants it, and how to build one that doesn't rot.

Microsoft's own docs mark DLP and sensitivity labels as unsupported for ChatGPT Enterprise — Purview audits it but can't block anything. That table, the Edge-only browser scope, and the 19-app catalog turned into a surface-by-surface extend-or-buy decision framework.