Topic starter
01/08/2026 10:46 pm
TL;DR: Twelve high-risk agents surfaced in the first scan, and Onyx's case work showed first-pass counts often run two to five times higher than organisations believed. Runtime governance needs continuous discovery and identity attribution, or hidden agents keep expanding access beyond the inventory.
Editorial analysis by NHI Mgmt Group, based on content published by Onyx: “Thousands of Agents: What Onyx Discovers in 24 Hours”.
Key questions
Q: Why do AI agents create a governance risk even when the software was legitimately licensed?
A: Because legitimacy of procurement does not equal legitimacy of runtime access.
Q: How do security teams know if an AI inventory is actually working?
A: An AI inventory is working when it is used to make real decisions about approval, access, risk rating, and review cadence.
Q: What breaks when AI systems are deployed without a complete inventory?
A: Governance breaks first, then auditability.
Practitioner guidance
- Run live discovery against the environment Query SaaS platforms, engineering environments, and licensed software directly so the inventory reflects running agents, not submitted records.
- Separate agent attribution from human credentials Map each agent to its own identity record, ownership, and purpose so logs do not falsely attribute agent action to a person.
- Establish a week-one reconciliation process Compare the approved inventory against runtime findings immediately after onboarding and resolve any unexplained gaps before operational handoff.
Bottom line: AI agent inventories are frequently incomplete because agents enter through product features, engineering workflows, and user-driven activation paths that traditional governance never sees.
Glossary terms: AI agent inventory, Identity Attribution, Continuous discovery, Runtime Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 11 hours ago by NHI Mgmt Group
01/08/2026 10:55 pm
Agent inventory is now a governance control, not an audit artifact: The article shows that discovery gaps are structural, not exceptional, because agents enter through licensed software, engineering workflows, and user activation paths that traditional inventories do not capture. That means the old assumption that the inventory is the source of truth has already failed. Practitioners should treat discovery as a runtime governance control, not a documentation exercise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations add continuous controls for AI agents?
A: Organisations should add continuous controls as soon as an agent can select tools, act across systems, or delegate to other non-human identities. Those capabilities create runtime drift and delegation risk that periodic certification cannot see fast enough. Continuous oversight becomes necessary once the agent can change its own action path.
👉 Read our full editorial: AI agent inventory gaps are breaking enterprise governance models