CyberArk (Idira) manages privileged agent identities and just-in-time access. Willow governs employee AI tools with MCP discovery, approved capabilities, device policies, and runtime approvals.
An engineering organization rolls out Claude Code, Cursor and a set of internal agents. Most of the risk is not a rogue super-admin. It is the everyday drift: an MCP server added from a public repository, a skill copied from a forum, a write tool exposed when read access was enough. Security needs to see that drift on every laptop, steer people toward approved tools and stop consequential calls until someone approves them.
Willow was built for that work. It discovers local MCP servers, skills and plugins, applies allow, warn and block rules on the device, and gives employees an approved catalog of servers, toolkits and skills through company groups. Publication checks review what the organization distributes, and approval before selected tool calls keeps consequential actions under human review. Discovery, enforcement, distribution and audit sit in one product.
CyberArk approaches agents as privileged identities. Palo Alto Networks completed its acquisition of CyberArk in February 2026, and the platform now carries the Idira name, combining privileged access management with machine and agentic identity security. Idira Secure AI Agents scans SaaS, cloud and developer environments for agents, grants them access only for the duration of a task, and logs their actions.
Both products put a control point between agents and MCP tools. The difference is the job each one is built for. Idira starts from the privileged access program and treats each agent as an identity to vault, broker and revoke. Willow starts from the employee and the AI capabilities they use, and governs those capabilities from installation to every call.
The overlap sits at MCP tool access. Around it, the products diverge. Willow pairs that access control with device policy, an approved catalog, publication review and guards inside the coding clients and browsers employees use. Idira pairs it with vaulting, just-in-time privilege and a privileged access program built for infrastructure. For MCP tool calls routed through Willow's Gateway, admins can require human approval on every invocation of selected tools. Runtime guards inspect requests and responses passing through the Gateway.
An agent's behavior is shaped before it ever requests access. An MCP server added to Cursor, a skill installed in Claude Code or a CLAUDE.md file with standing instructions all change what it will try to do. Willow's Scan Agent inventories those capabilities on each device and enforces policy rules there.
Findings become allow, warn and block rules scoped to everyone, specific groups, users or devices. A block rewrites the MCP entry to a local Willow endpoint or renames the skill file, and the agent restores the original when the rule is removed. Willow can also push approved agent configuration to Claude Code, Claude Desktop, Codex, Cursor and GitHub Copilot, currently in beta, so every developer starts from a governed setup.
Removing standing privilege reduces blast radius. Adoption still needs approved tools people want to use. Willow groups decide which MCP servers, toolkits and skills each employee can use, organizational skills sync from GitHub and bundle into plugins, and SCIM keeps users and groups aligned with the identity provider.
Willow's build-time guards check tool selections, embedded prompts, skill text and command definitions before a toolkit or plugin is published. If the content violates a configured policy, the publish is blocked. A well-brokered credential cannot make a harmful skill safe; publication review stops it before it spreads.
Willow supports tool-level availability and human approval before selected tools run. A team can keep read operations open, disable write tools, and require confirmation for a sensitive invocation. Approval applies to every call to a tool marked for it, and runtime guards inspect each call before it reaches the MCP server and each response before it returns. That puts least privilege for AI agents at the level of individual actions.
Willow's Guard Hooks evaluate every user prompt and file-tool call in Claude Code, Cursor and Codex before the agent acts; they fail open on a timeout or outage. Prompt Guard applies the same guards to ChatGPT, Claude, Gemini, Microsoft 365 Copilot and DeepSeek in Chrome and Edge. The extension is in beta and an admin turns interception on.
Request logs record the user, agent, server, tool, outcome and guard decision for each request Willow handles, and Radar scores AI security risk across identity, shadow AI, data exposure, agents and monitoring. Machine users carry accountable human owners, and the Vault keeps connector secrets out of configurations. Willow deploys as SaaS, hybrid or full on-premises.
Idira fits organizations that already run CyberArk for privileged access and want agents under the same program:
Idira also underpins Palo Alto Networks' Agent Identity Security add-on for Prisma AIRS AI Gateway, which federates enterprise identity providers through Idira. Teams standardizing on Palo Alto Networks may meet these capabilities through either product.
As of 28 October 2026, Willow lists a $0 Free plan and Enterprise pricing per human seat, billed annually, with volume tiers. Enterprise includes shadow AI discovery across the fleet, runtime guardrails, browser prompt guards and SCIM, and Willow can be purchased through AWS Marketplace. Willow deploys as SaaS, hybrid or full on-premises, with no runtime dependency on Willow SaaS in the on-premises model.
Idira does not list pricing; its pages route buyers to a demo or a free agentic identity assessment. Palo Alto Networks states that CyberArk solutions remain available as a standalone platform after the acquisition.
In organizations with an established CyberArk program, a combined model is reasonable. Idira keeps brokering privileged access for agents that reach production infrastructure and databases. Willow governs the employee layer: which MCP servers, skills and plugins run on each laptop, which approved tools each group receives, which shared capabilities pass review, and which tool calls need a person to approve them.
Where both control MCP tool access, assign one owner per server to avoid duplicate policy. For organizations without a CyberArk deployment, Willow covers discovery, device enforcement, distribution, approvals and audit for employee AI in one product.
Idira brings privileged access discipline to agents. Willow brings governed AI adoption to employees: what runs on each device, what people receive, what needs review and what every call did. To see Willow on your own tools, book a demo or start on the Free plan.
Yes. Palo Alto Networks completed its acquisition of CyberArk in February 2026, and the platform now carries the Idira name, described as built on CyberArk's legacy and powered by Palo Alto Networks. Existing CyberArk customers keep using the platform.
Yes. Idira access policies restrict which MCP tools a given agent may run. Willow controls tool availability per server instance, can require human approval on every call to a selected tool, and also governs the MCP servers and skills installed locally on employee devices.
No. Willow is not a PAM platform. It governs employee AI tools, skills and tool calls, with machine users, a Vault for connector secrets and full audit. Organizations with PAM requirements for infrastructure can keep Idira for that layer.
Willow Guard Hooks evaluate prompts and file-tool calls in Claude Code, Cursor and Codex, and the Scan Agent discovers their MCP servers, skills and plugins. Idira authenticates Claude-built agents and provides just-in-time access through MCP servers via its Agent Identity Broker.
Yes. Full on-premises deployment runs every Willow component in the customer's Kubernetes cluster, with no dependency on Willow SaaS at runtime.
Give them a Basecamp. Go from AI chaos to AI work, in minutes.
