Smartflow vs. Neo: Endpoint vs. Request Path

Neo puts a lightweight sensor on each employee device. The sensor inventories the agents, extensions and MCP servers on that device, ties each action to a human or an agent, and decides there whether the action proceeds. Smartflow sits on the request path: applications and agents send their model calls and MCP tool calls through it, on the customer's own infrastructure, and policy applies before the call executes. Neo governs where a person and an AI tool meet. Smartflow governs the path between any agent and the models and tools it reaches, including agents that never run on an employee device.

This page is about Neo Security at neo.ai, the agentic software control company.

The short version

Both products act before an agent's action completes, at different points.

Neo's sensor is on the laptop, so it sees what an agent does there: the file it reads, the command it runs, the MCP server it loads, including actions that never cross a network. Smartflow is on the request path, so it sees every call routed through it from any origin, including agents in production systems that no employee device touches.

Each placement has a cost. Neo finds what is installed without anyone wiring anything to it, and its documented reach is the workforce endpoint. Smartflow discovers nothing on its own: a call has to be pointed at the gateway. In exchange, its coverage follows the call. An enterprise with agents on laptops and agents in production will likely want both.

Feature Comparison

The endpoint and the request path

Neo makes its case for the endpoint in a published comparison of seven approaches to securing an agent. A credential read or a destructive command "never crosses the network," Neo writes, so stopping it takes enforcement on the device. A gateway sees prompts, responses and requested tool calls. It does not see the file read that follows.

That is accurate for Smartflow. When Claude Code is pointed at Smartflow, the model's tool requests come back through the gateway, so Smartflow's record includes every command Claude Code was asked to run. Commands Claude Code runs directly in the terminal do not pass through MCP. Stopping a file read on a laptop takes a control on the laptop.

The reverse is just as specific. Many agents never run on an employee device: an agent inside a production service, a scheduled job calling a self-hosted model, an agent inside an air-gapped enclave. Neo's published material covers the workforce endpoint, from macOS, Windows and Linux to WSL and Claude Cowork VMs. It does not document coverage of server-side or cloud-hosted agents. Smartflow governs those agents when their calls are routed through it. It runs on the customer's infrastructure, on-premises or air-gapped. Configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else.

Neo makes its policy decisions on the device. In its words, "Nothing needs to leave the device." Each Copilot decision then lands "in the Neo console next to events from every other AI tool," Neo writes, and its AWS Marketplace listing classifies the platform as software as a service, deployed on AWS. The listing names no region, so a buyer with a residency requirement should ask.

Who decides, and what the record shows

Both products can stop an action and wait for a person. Neo's policies can pause an action "for verified human approval," and the decision is kept in its audit trail. Its pages do not say who receives the request or how the approver's identity is checked.

In Smartflow, an action that needs a person pauses as an approval ticket. The ticket is pending until someone with approval rights approves or denies it, it is redeemed once when the action runs, and it expires after 24 hours. With step-up, set per action, the approver re-verifies their identity before the approval counts, and the record shows who decided.

Attribution is one of Neo's strengths. Every action is tied to the human or agent that caused it, along with the application, endpoint and intent behind it. For an agent acting on its own, AIDA issues the agent its own credential, so the agent is a party in the record. An agent can then be revoked without disabling an employee. Each Smartflow decision is hash-chained, time-stamped under RFC 3161 and written to the customer's own SIEM. Examination packages for FINRA 3110, HIPAA, SOX and the EU AI Act are generated from those records.

Where Neo is strong

Neo's discovery on the workforce endpoint is broad and continuous. It inventories agents, plugins, MCP servers, extensions, models, CLIs and embedded AI functions on endpoints "managed or not," plus AI built into SaaS apps. It maps them against Neoverse, a knowledge base of what agentic software can do and the risk it carries, "included with every deployment for no additional cost."

It sees what a gateway does not: the credential read, the file access and the local command that never leave the machine. Its hooks run in Claude Code, Claude Cowork, Codex, Cursor and Copilot. When a Neo hook is removed or edited, the sensor restores it. Coverage is moving fast: coding agents inside WSL and Microsoft 365 Copilot on Windows and macOS in October, and Claude Cowork VMs announced in November. The sensor is 25MB and needs no kernel module or reboot. SecOps teams build policy by asking Neo questions, and a rollout can start in audit mode.

The founding team comes from SentinelOne and EasySend. Nicholas Warner, CEO, is the former President and COO of SentinelOne. Shlomi Salem, CPO, was VP of Research at SentinelOne. Eran Shirazi, CTO, co-founded EasySend and was its CTO. Neo launched on July 20, 2026 with $100M in funding, was named to the 2027 Fortune Cyber 60, and its site displays AICPA SOC, GDPR and HIPAA badges. For a security team whose first question is what AI is running on employee machines and what it is doing there, Neo answers it directly. Smartflow does not compete on that question.

When to choose Smartflow

• Agents beyond the endpoint: applications and agents in production, on self-hosted models or inside an enclave, governed on the request path from any origin
• An approver on the record: the action pauses as an approval ticket for someone with approval rights, step-up is set per action, and the record shows who decided
• Enforcement inside your boundary: the control plane runs on your infrastructure, including air-gapped, and records go to your own SIEM
• Examination evidence: packages and a model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, generated from enforcement records

Running both

The two compose because they enforce at different points. Neo covers the workforce endpoint: what is installed, what agents do on the device, and the file reads and commands that never cross a network. Smartflow covers the request path: every model call and MCP tool call routed through it, from laptops and from systems no employee device touches, with the approval ticket and the record. When a coding agent runs under both, Neo governs what it does on the machine. Smartflow governs what the agent sends to the model and the tool calls that reach your systems. The cost is two policy surfaces to keep aligned. The benefit is that each product covers the ground it was designed for.

Common questions

What does Neo install? A 25MB endpoint sensor for macOS Monterey 12+, Windows 10 1607+ x64 and Linux, with no kernel module, reboot or OS hooks. Neo says nothing needs to leave the device.

What does Neo discover? Agents, plugins, MCP servers, extensions, models, CLIs and embedded AI functions, on endpoints managed or not, plus AI built into SaaS apps.

Can Neo stop an action before it completes? Yes. At the endpoint, a policy can allow, block or redirect an action, or pause it for verified human approval. Teams can begin in audit mode, then move selected rules into enforcement.

Does Neo cover agents on servers or in the cloud? Its pages describe the workforce endpoint, including WSL and, as announced, Claude Cowork VMs. Coverage of server-side or cloud-hosted agents is not documented.

Does Smartflow replace Neo? No. Smartflow discovers nothing on its own, and commands Claude Code runs directly in the terminal do not pass through MCP. Smartflow enforces policy on the calls routed through it and records each decision.

Related reading

Smartflow for Claude Code · Govern shadow AI · Agent governance · AIDA agent identity · Human-in-the-loop · Tamper-evident audit log · MCP security · Examination readiness · Smartflow vs. WitnessAI · All comparisons

Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.

Neo sources: neo.ai, neo.ai/platform, /why-neo, /about, /solutions/technology, /news/neo-launches-100m, /news/neo-named-2027-fortune-cyber-60, the Neo blog posts /blog/where-to-secure-an-ai-agent, /blog/hooks-self-protection, /blog/ai-coding-agents-wsl, /blog/claude-cowork-integration, /blog/microsoft-365-copilot-security, /blog/saas-apps-becoming-ai-agents and /blog/backdoored-model-steals-keys, and Neo's AWS Marketplace listing.