Most “AI security” products still watch prompts. Descope is watching the identity of the thing that can call your tools.
On Oct 15, Descope shipped Agentic Identity Hub 3.0. The release turns employee-built and employee-adopted agents into first-class identities: requested, justified, approved, owned, and enforceable at runtime across gateways, MCP servers, and APIs (per Descope). SiliconANGLE frames the same launch as a shadow-AI inventory problem. Both reads are right. You cannot put policy on an agent you never named.
The onboarding path is the product. An Agent Onboarding Portal makes employees ask for an agent through a self-service catalog and declare what it will connect to, including data sources and Model Context Protocol servers. Nothing provisions until a reviewer signs off. Every approved agent gets an accountable owner and scoped access. Descope says the workflow is fast enough that teams should not route around it. That is the only claim that matters in a bake-off. If approval takes a week, ShadowGPT wins again.
Runtime is where suites usually lie. Hub 3.0 plugs into Policy Enforcement Points — gateways, MCP servers, APIs — and evaluates policy on every request. Native gateway integrations and a Policy Engine v2 add explicit Deny rules, ordered evaluation, and organization-wide guardrails on top of team policy (per Descope). For agents the company did not build, including Claude, Cursor, ChatGPT, and third-party MCP servers, Descope sits in front via MCP gateways such as the Agentic AI Foundation’s open-source agentgateway project (per SiliconANGLE). That is the right architecture: identity at the choke point, not instrumentation fantasies inside someone else’s client.
Kill the static secret. Version 3.0 adds SPIFFE workload identities, private_key_jwt client authentication, mTLS with certificate-bound tokens, and Agent SSO via identity assertion grants (ID-JAG / Cross-App Access). An admin can revoke an agent from one place without reissuing a heap of client secrets. That is table stakes for agent sprawl. Shared long-lived credentials are how yesterday’s SaaS breach becomes tomorrow’s agent incident.
Scale claims, carefully labeled. Descope says millions of agents connect to 1,000+ Descope-protected MCP servers. SiliconANGLE reports the Hub handles authentication and access control for hundreds of MCP servers and more than 1 million agent identities. Those are vendor operating metrics, not ARR. Funding: a $35 million seed extension in September 2025 took total capital to $88 million, with Notable Capital, Lightspeed, Dell Technologies Capital, and Unusual Ventures among investors (per SiliconANGLE). Valuation: Undisclosed. ARR: Undisclosed.
The threat model Descope is selling against. SiliconANGLE cites Verizon’s 2026 Data Breach Investigations Report: regular AI use on corporate devices has reached 45% of employees, and roughly two-thirds of them sign in with a personal account. Descope cites a Gartner prediction that the average Fortune 500 will have more than 150,000 agents in use by 2028, up from fewer than 15 in 2025, with only 13% of organizations believing they have the right AI governance. Predictions are not inventories. Still, the direction of travel is obvious to anyone who has watched a business unit stand up an MCP server on a Friday.
Best-of-breed vs platform. Okta, Microsoft Entra, and SailPoint will all claim agent identity by renewal season. Descope’s wedge is being an identity provider purpose-built for agents and MCP, with open standards and a governance catalog that ships now. That wedge dies if the suites ship “good enough” agent SSO inside the IdP you already pay for. It lives if agent sprawl outruns suite roadmaps the way API sprawl did a decade ago.
The read. Shadow AI stopped being a browser DLP story the day employees started standing up agents with tool access. Descope is pricing the problem correctly as identity. Until ARR shows up, treat the $88 million raised as permission to race the platforms — not proof it already won.