Deploy the AI Agent Security agent

Nothing in AI Agent Security works until the Pathfinder agent is on your endpoints. Discovery, monitoring, auditing, and policy enforcement all depend on it. An endpoint without the Pathfinder agent is one where AI agent activity is invisible and cannot be controlled, so the scope of your deployment is the scope of your visibility.

First-run experience

On the home page, select the AI Agent Security tile. (An EPM tile also appears here.)
The first time you open the product, an introduction explains what AI Agent Security does.
Select Get started.
Choose whether to test on a single machine or roll out to a group:
- Single machine. You stay in AI Agent Security and continue the installation there.
- Group. You are sent to the AI Agent Security page in EPM to complete a multi-step rollout.

Deploying to a group through EPM

On the AI Agent Security page in EPM:

Download the certificate.
Configure MDM enrollment of the Pathfinder agent on the endpoints.
Select the computer groups where the Pathfinder agent should be deployed.
Select Continue. You are returned to AI Agent Security, where discovery begins on the computers where the Pathfinder agent was deployed.

Because EPM customers already have the package manager installed on their endpoints, this path has fewer steps.

Deploying from AI Agent Security

You can also install the Pathfinder agent from AI Agent Security itself. Go to Settings > Deployment and select Deploy an agent. The wizard walks through four steps for the operating system you choose:

Trust the CA: choose how your tenant's root certificate reaches each machine.
Create a key: create the deployment key the agent presents when it enrolls.
Install and enroll: run the install command, or download the installer for your software distribution tool, with the key already filled in.
Test: run a short AI coding session and confirm that it appears in AI Agent Security.

This path has more steps than the EPM page, because it does not assume the package manager is already on the endpoint. For each step in detail, see Windows manual install and Mac manual install.

Supported deployment surfaces

The Pathfinder agent runs on Windows 11, Windows Server 2022 and later (x64), and macOS 14 (Sonoma) and later. Other operating systems are not supported.
The initial focus is user laptops.

What happens after deployment

Once the Pathfinder agent is installed, AI Agent Security discovers the AI agents running on those machines and populates the dashboards and inventory.