Workforce AI Security Enterprise: web, desktop, code assistants and agents

What is Workforce AI Security Enterprise?

Enterprise is the broader of the two tiers of Check Point Workforce AI Security. Check Point's administration guide describes it as "comprehensive discovery, governance, and protection across all environments - web, desktop, and developer tools", and its tier table lists Enterprise coverage as web, desktop, MCP and IDEs. Check Point's marketplace listing describes "complete coverage across web and desktop AI applications, developer code assistants, agentic tools and more, including discovery, governance and protection".

In short, Enterprise does everything Essentials does for AI in the browser, and extends it to the device, the developer's editor and the agent. For how the four stages work, see how Workforce AI Security works.

Desktop AI applications

More AI now runs outside the browser: desktop chat apps, AI assistants built into desktop software, and command-line tools. Browser-based controls cannot see these, which is the main reason organisations choose Enterprise.

Enterprise adds the Workforce AI Protect Agent, which Check Point describes as providing full monitoring and protection with real-time access and DLP enforcement. It runs on Windows and macOS and:

• Monitors desktop AI applications (Check Point's guide names ChatGPT Desktop and Claude Code among the apps it discovers)
• Monitors browser-based AI activity as well
• Detects MCP server connections and agentic workflows

The same policies apply wherever the AI is used, so a rule that redacts customer data from prompts covers the desktop app as well as the website.

Coding assistants and IDEs

Developers are often the heaviest AI users in an organisation, and what they paste into an assistant can include source code, configuration files, API keys and connection strings. Check Point names GitHub Copilot and Cursor as code assistants that Workforce AI Security covers, and its discovery documentation also mentions editors such as VS Code that use AI coding assistance and MCP servers.

With Enterprise you can:

• See which coding assistants and AI-enabled editors are in use, and by whom
• Detect source code and credentials in prompts, and redact or block them
• Treat approved, organisation-licensed assistants differently from personal ones
• Control the MCP servers and tools those assistants can reach

Our guide to AI coding assistant security covers the wider controls, such as secret scanning and repository permissions, that sit alongside this.

AI agents and MCP

AI agents are a fast-moving part of the picture. An agent can read files, query systems, send messages and make changes with the permissions of the person who set it up, often through the Model Context Protocol (MCP). Enterprise covers this in two ways.

Discovery. A dedicated Agents view lists the AI agents and MCP servers in use. Check Point's read-only Agentic Endpoint Discovery scan builds an inventory of AI apps and agents on devices, and integrations with some SaaS agent platforms, such as Microsoft Copilot Studio, bring agents built there into the same inventory.

Agent policies. Administrators can allow or restrict MCP tools and operations, apply URL and file reputation checks and content moderation, and block risky agent actions at runtime. Check Point's onboarding includes a ready-made "Agents Limited - No Delete" policy, which lets agents work but blocks delete operations: a good example of controlling what an agent does rather than banning it.

Prompt attack detection. Check Point's guide also documents a Prompt Attack feature that analyses MCP tool definitions and the inputs and outputs of tool calls for signs of prompt injection. When we checked, it was in Early Availability and ran in detect-only mode, so it records events rather than blocking them. We confirm the current position when we quote.

See MCP security for the risks and best practices. If your concern is agents your organisation builds and runs itself, rather than agents your staff use, look at Check Point AI Agent Security, which is a separate product.

Who Enterprise suits

Enterprise is the better fit when any of these apply:

• You have developers, data teams or IT staff using coding assistants or AI in their editors
• Staff use desktop AI apps, or you cannot rule it out without checking
• People are connecting AI agents to email, files, ticketing or code repositories, or installing MCP servers themselves
• You need one view of AI use across browser, desktop and agents for audit or regulatory reasons
• You handle data where leakage through any channel matters: client files, health data, financial records or source code

If you are unsure, a short discovery exercise usually settles it. Our Essentials vs Enterprise guide has a set of questions to work through.

Deploying Enterprise

Enterprise uses the browser extension plus the desktop agent, distributed through your existing device management. Check Point's guide includes deployment appendices for common platforms, including Microsoft Intune. A typical sequence:

1. Inventory first. Optionally run the Agentic Endpoint Discovery scan, which Check Point says has no user impact and does not collect usage data, to see which AI apps and agents are installed.
2. Register managed platforms so corporate and personal AI accounts can be told apart.
3. Pilot the agent and extension with a group that includes developers, using Check Point's recommended discovery defaults for access, chats and agents.
4. Write policy from evidence: approve tools, set redaction for source code, credentials and personal data, and restrict risky MCP operations.
5. Roll out in waves across the organisation and review reports on AI usage, agent activity and enforcement.

Check Point also documents its AI Network Firewall and Check Point SASE as additional enforcement points if you already use them.

How Forever Systems helps

Enterprise touches more of your estate, so the planning matters. We can help you:

• Scope which users need Enterprise coverage, and confirm entitlements against Check Point's current terms
• Plan the desktop agent rollout through your device management, starting with a pilot
• Work with your development leads on sensible rules for coding assistants and MCP, so security does not stall delivery
• Review discovery results and reports with you as the rollout progresses

Pricing depends on the number of users and the term. See how Workforce AI Security is licensed and ask us for a quote. To talk about Enterprise, contact us.