Elisity launches CLI for customer-run AI security agents

Elisity has launched an open command-line interface that lets customers run their own AI agents on its microsegmentation platform. The product is aimed at security and network teams managing Zero Trust access policies.

The new Elisity CLI offers 466 commands tied to the company's Cloud Control Centre API, along with reporting tools for Zero Trust posture scores, site metrics, and traffic and threat vectors. It supports output in JSON, table, YAML, and CSV formats and includes separate profiles for production, staging, and lab environments.

Security teams can use the interface to script discovery tasks, manage least-privilege access policies, and pull posture reports. They can also connect their own AI orchestrators to the platform to check whether segmentation controls remain effective over time.

Elisity chose a command-line interface rather than a Model Context Protocol server because it runs only when called and uses the caller's own credentials and permissions. State-changing commands require human approval, and delete actions require separate confirmation.

The company presented that approach as a response to concerns about always-on privileged connections between AI tools and security systems. It pointed to researchers' disclosure of CVE-2025-6514 in mcp-remote, which it described as the first documented remote code execution attack against an MCP client, after a malicious server was able to run operating system commands on the connected machine.

At the center of the system is Elisity IdentityGraph, which correlates identity data so devices are identified using a broader set of information rather than IP addresses alone. According to the company, that design allows customer-built agents to act on established identity data while leaving final approval for changes to a human operator.

The CLI also includes an operating guide and a command glossary for AI agents such as Claude and ChatGPT. Those materials are intended to help an agent call an actual command rather than generate one that does not exist.

Customer uptake

The launch comes as use of Elisity Intelligence, the company's optional AI feature set, rises among existing customers. Elisity said the number of customer organizations using that service increased by 77% between April and June.

According to the company, the heaviest use of Elisity Intelligence is in policy work, device lookups, and the overview dashboard. Nothing in the system operates autonomously: administrators decide what is enabled, and all recommendations require human approval before any change is made.

Customers already using Elisity products include GSK, Main Line Health, and MultiCare Health System. The company said MultiCare has used the new CLI to continuously test whether Zero Trust least-privilege policies still block lateral movement.

"Most of the industry is asking customers to trust a black-box AI agent with their network. We're doing the opposite. Our CLI hands customers the keys, so they point their own AI agents at the platform and automate exactly what they choose, with a human approving anything that changes state. And because it all runs on identity through Elisity IdentityGraph, an agent knows what a device actually is, not just a guess off an IP address. That's the difference between automation you can audit and automation you just hope works," said James Winebrenner, Chief Executive Officer, Elisity.

One customer described the software as a way to replace periodic checks with continuous validation. MultiCare Health System uses Elisity in a healthcare setting where system availability carries operational risk beyond IT.

"Every segmentation program eventually reaches the same question: Are these policies still enforcing the outcomes we designed them to achieve? Historically, the answer came from periodic audits and the assumption that nothing had changed. With the Elisity CLI, we can continuously validate our Zero Trust least-privilege policies against realistic adversary techniques. If a policy drifts or no longer prevents lateral movement, we know within minutes instead of discovering it during an incident. In healthcare, operational resilience matters because downtime is not just an IT problem. Automating these tests gives us continuous assurance that our controls are performing the way we expect them to. Security isn't about believing your controls still work. It's about proving they do," said Elrod.

Elisity sells identity-based microsegmentation tools to healthcare systems, manufacturers, and critical infrastructure operators. Its platform is designed to discover users, workloads, and devices and enforce Zero Trust least-privilege access policies on existing network infrastructure without requiring agents, new hardware, or a network redesign.

The CLI is available to customers now through Elisity account teams.