Watching announcements from the last eighteen months, one observation stands out. Cybersecurity publishers, API management specialists, data platforms, cloud providers and AI-native players are developing capabilities that address the same set of issues. Their objective: control calls to language models, enforce security policies, manage costs and govern agents, while tracing their interactions and curbing dependence on a single vendor.
All are seeking, through different approaches, to become the control point between the information system and AI.
In the history of IT infrastructure, this kind of convergence has often presaged the emergence of a new software category. But it can also signal something else: a race in which each player tries to impose its own control plane, risking to recreate around AI the fragmentation that AI Gateways were precisely designed to solve.
Cybersecurity Vendors Seek to Protect Agents
Cybersecurity platforms were designed to protect users, endpoints, servers or applications. The rise of AI agents introduces a new category of digital entities: they hold access rights, use technical identities, query data and execute actions autonomously. They therefore become a new attack surface in their own right.
The case of Palo Alto Networks epitomizes this shift with a tight timeline. In March 2026, the vendor launched Prisma AIRS 3.0, featuring a module “AI Agent Gateway” that was initially in limited access. By late April, it announced plans to acquire Portkey, one of the most established AI Gateway vendors; the acquisition closed on May 29. Six weeks later, on July 22, it announced the general availability of Prisma AIRS AI Gateway, which directly incorporates Portkey’s technology.
In its communications, Palo Alto Networks cites a figure intended to illustrate the acceleration of the phenomenon. According to data observed by the vendor, the share of enterprise network traffic attributable to the MCP protocol rose from 11% at the end of 2025 to over 41% by mid-2026. A figure provided by the vendor, to be read as an indicator of trend rather than an independent market metric.
CrowdStrike follows a different trajectory, focusing on agent identity. In June last year, the vendor rolled out “Continuous Identity for AI Agents,” a Falcon feature built on SGNL technology acquired for $740 million. The principle is to continuously reassess an agent’s rights, action by action, rather than granting permanent access. CrowdStrike is not aiming to become an AI Gateway itself. It is betting on an ecosystem strategy, with integrations to multiple gateways, including Kong, LiteLLM, Databricks, Microsoft Azure, TrueFoundry and Google Cloud.
Cisco is moving on a closely related ground with Duo, which now treats the agent as a distinct identity object, with its own authentication rules and lifecycle. Zscaler, finally, presented in June 2026 what it claims to be the first complete Zero Trust platform for AI-enabled agents, with an “AI Broker” for agent access and an “AI Access Graph” to map the connections between identities, applications and data. A direct extension of its historical networking logic to agent-to-agent flows and MCP calls, harder to intercept than typical user traffic.
These different trajectories share one logic: each cybersecurity vendor is trying to extend its historic control point to cover agents. The AI Gateway thus becomes one of the new interfaces of the Zero Trust approach, where one verifies not only who is authorized to act, but also what the agent can do and in what context.
API Management Specialists Seek to Prevent Being Bypassed
For API management players, the challenge is different. For fifteen years, API Gateways have held a strategic place in IT systems: a large portion of application exchanges passes through them, and architecture teams define authentication, rate limiting, monitoring and routing there.
AI could threaten this position. If developers call language models directly without going through the existing infrastructure, a growing portion of exchanges might escape governance platforms already in place. API specialists thus seek to extend their reach rather than letting a parallel infrastructure emerge.
The Kong example is representative: the vendor positions its AI Gateway as a plugin extension on its existing Kong Konnect platform. Application flows continue to pass through the same infrastructure, but are now also directed toward language models, with the same authentication and quota mechanisms already in place for traditional APIs.
Google is steering Apigee in a similar direction, tying it into the new agent platform that the group launched in April 2026 by renaming Vertex AI to Gemini Enterprise Agent Platform. The shift goes beyond a name change, as it also absorbs Agentspace and reorients the entire platform toward building, deploying and governing agents rather than merely training models.
Other API Management specialists, such as Gravitee, Tyk or WSO2, are following a comparable path by adding LLM routing capabilities, MCP governance and inference-cost tracking to their existing platforms.
The underlying principle is the same in all cases: reuse the API-oriented mechanisms (authentication, quotas, logging, observability) rather than rebuilding them from scratch for AI. AI does not create a parallel infrastructure; it extends the existing architecture.
Data Platforms Seek to Bring Agents Closer to Data
A third family pushes forward with a different approach: data platforms. The belief is that AI’s value lies not only in the model, but ultimately in the data the model can access.
Snowflake provides an initial illustration. At the end of May 2026, the company announced the acquisition of Natoma, a specialist in MCP protocol governance. Two months later, it launched Cortex AI Gateway to control interactions of agents with models, tools, MCP servers and the company’s data.
The solution targets both Snowflake-native agents and those developed on third-party platforms such as Claude Code or Cursor, and it integrates with Okta, SailPoint and 1Password for identity management.
Databricks follows a comparable trajectory with Unity AI Gateway. Built on Unity Catalog, the service translates the governance mechanisms already applied to data—permissions, traceability and auditing—onto models and agents. It adds AI-specific features such as spending controls, provider routing and prevention of personal data leakage.
Databricks already counts thousands of customers using Unity AI Gateway, including Rivian, Asana and Edmunds. According to the vendor, more than a quadrillion tokens have traversed the gateway over the last twelve months.
The vendor also chose an open approach by integrating security specialists—CrowdStrike, Palo Alto Networks and Zscaler—into Unity AI Gateway. The aim is to allow companies to keep their existing security tools while applying them to interactions with models, agents and tools. An ecosystem approach that contrasts with platforms seeking to consolidate all security functions internally.
The successive announcements from Snowflake and Databricks show that agent governance is becoming a new battleground for Data & AI platforms. Their advantage is the ability to extend the governance policies already applied to data to models and agents, without necessarily adding a separate governance layer.
Hyperscalers Move Forward in a Fragmented Fashion
A fourth family of players, the hyperscalers, tackles the problem from a different angle: integrating AI governance functions into their own environment rather than selling them as a standalone product.
AWS has launched Amazon Bedrock AgentCore Gateway, which provides a single access point for agents to reach tools, MCP servers and other agents via A2A. The platform can also route requests to different model providers and connect services such as Salesforce, Slack, Jira or Asana.
Microsoft combines two complementary components. Azure API Management provides the AI Gateway functions, while Entra Agent ID, generally available since May 2026, assigns a dedicated identity to agents and enables access control, including when they are built on third-party platforms.
Google has taken a more integrated route. With the launch of Gemini Enterprise Agent Platform, which succeeds Vertex AI, the company bundles building, deploying and governance of agents in a single platform, rather than presenting the AI Gateway as a standalone module.
The advantage of this approach is clear for an IT department already committed to a single cloud: identity, billing and a portion of observability stay within the same environment, with no extra layer to manage. The trade-off is equally real: in a multicloud context, these three approaches do not substitute for one another, and a company using AWS, Azure and Google Cloud simultaneously may end up with three distinct AI governance mechanisms rather than a single cross-cutting layer.
AI-native Players: Pioneers of the AI Gateway
A final category emerged directly with AI applications. Players such as LiteLLM, Helicone, OpenRouter or Portkey built their offerings around needs that arose with LLMs: routing requests among multiple models and providers, tracking consumption, managing keys and costs, or observing agent interactions.
Portkey, however, illustrates the challenge for these specialists to maintain their independence as the market consolidates. Acquired by Palo Alto Networks in May 2026, the vendor shows how functions developed by AI-native players can be gradually integrated into broader cybersecurity, API Management, data or cloud platforms.
What This Convergence Reveals
The convergence of these five families of players suggests that the AI Gateway is becoming a strategic layer for AI governance. But this convergence will not necessarily yield a single gateway: the market could instead see multiple components that can cooperate.
For CIOs, the question will thus be where to place the main control point and how to make the other components interact with it. In the absence of coordination, the multiplication of offerings could paradoxically recreate a new fragmentation of AI governance.
