Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

When I joined Persona's Marketplace team as the product manager in August 2025, we had around 25 integrations. Our goal was to make Persona a seamless fit in every customer's stack: easy to get started with and even easier to grow with. Less than a year later, we've tripled the size of our marketplace to include more than 75 integrations. Here's how we've approached our Marketplace strategy this year.

As organizations rush to deploy AI agents across enterprises to handle HR cases, write and execute code, and manage customer interactions, they very often need to grant them access to sensitive systems and data.

Privileged access has become significantly more complex over the last few years. Security teams are managing Windows and macOS devices, administrators rely on native tools to do their jobs, network infrastructure continues to expand, and operational technology environments are becoming increasingly interconnected. At the same time, manual approval processes and fragmented controls often create more friction than protection.

AI agents are no longer just answering queries or summarizing documents. They are booking meetings, pulling customer data, triggering workflows, and even making decisions across systems. And they don’t ask for permission every time. That’s where the real problem starts. Because once an AI agent is connected to your tools, APIs, and internal systems, the question isn’t what it can do, it’s what it should be allowed to do.

Data Loss Prevention (DLP) is all about keeping your business data safe from getting leaked, lost, or accessed without admin permission. It protects, identifies, analyzes, and blocks unauthorized data transfers within the network and through connected devices and outbound emails. DLP enforces company policies, preventing users from sharing confidential information. It further allows organizations to set USB restrictions to protect sensitive information at every stage of operations.

The notification of the Digital Personal Data Protection (DPDP) Rules, 2025, marks a major turning point in how businesses in India collect, use, and safeguard personal data in the digital ecosystem. Together with the Digital Personal Data Protection (DPDP) Act, 2023, these Rules create a rights-based, consent-driven framework that places citizens at the centre of data processing while still enabling responsible innovation and growth in the digital economy.

We believe trust is earned through demonstration and transparency, not promises. That’s why we worked with Trail of Bits, an independent security firm that has spent years reviewing the code behind widely-used software from cryptography libraries to critical open-source infrastructure. Persona regularly undergoes independent third-party audits across our security, privacy, and product programs.

Picking the best endpoint security for business depends on your org's size, stack, and how much in-house security muscle you actually have. CrowdStrike Falcon leads on pure detection, Microsoft Defender wins on value for M365-heavy shops, miniOrange is the strongest choice for mid-market businesses that need identity-first device security without the enterprise price tag, and IBM MaaS360 covers the UEM-first crowd that needs mobile + BYOD sorted from a single console.

Anthropic released a pre-built KYC Screener agent last month. It runs a four-step workflow on onboarding records to extract structured data from KYC documents, evaluate that data against a firm's KYC rules, screen named parties, and escalate exceptions to a compliance file for human review. The Anthropic template is purpose-built for meeting basic KYC compliance requirements during onboarding, and it lowers the cost of getting it right.

AI agents are increasingly accessing APIs, databases, SaaS applications, MCP servers, and other services without human intervention. As these autonomous systems become part of enterprise infrastructure, organizations need reliable ways to verify their identity before granting access to sensitive resources. Traditional authentication methods such as API keys and bearer tokens were designed for applications and users, not autonomous agents operating continuously across distributed environments.