Topic starter
01/08/2026 10:46 pm
TL;DR: The number of AI agents discovered in customer environments typically lands two to five times higher than what organisations believe is present, with one hospitality deployment showing a more than fivefold gap and twelve high-risk agents uncovered in the first scan, according to Onyx. Inventory accuracy, attribution, and continuous visibility are now governance prerequisites, not optional audit work.
Editorial analysis by NHI Mgmt Group, based on content published by Onyx: “Thousands of Agents: What Onyx Discovers in 24 Hours”.
Key questions
Q: What breaks when AI systems are deployed without a complete inventory?
A: Governance breaks first, then auditability.
Q: Why do AI agents create a governance risk even when the software was legitimately licensed?
A: Because legitimacy of procurement does not equal legitimacy of runtime access.
Q: How do security teams know if an AI inventory is actually working?
A: An AI inventory is working when it is used to make real decisions about approval, access, risk rating, and review cadence.
Practitioner guidance
- Run live discovery against the environment Query SaaS platforms, engineering environments, and licensed software directly so the inventory reflects running agents, not submitted records.
- Separate agent attribution from human credentials Map each agent to its own identity record, ownership, and purpose so logs do not falsely attribute agent action to a person.
- Establish a week-one reconciliation process Compare the approved inventory against runtime findings immediately after onboarding and resolve any unexplained gaps before operational handoff.
Bottom line: AI agent inventories are frequently incomplete because agents enter through product features, engineering workflows, and user-driven activation paths that traditional governance never sees.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
Agent inventory is now a governance control, not an audit artifact: The article shows that discovery gaps are structural, not exceptional, because agents enter through licensed software, engineering workflows, and user activation paths that traditional inventories do not capture. That means the old assumption that the inventory is the source of truth has already failed. Practitioners should treat discovery as a runtime governance control, not a documentation exercise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations add continuous controls for AI agents?
A: Organisations should add continuous controls as soon as an agent can select tools, act across systems, or delegate to other non-human identities. Those capabilities create runtime drift and delegation risk that periodic certification cannot see fast enough. Continuous oversight becomes necessary once the agent can change its own action path.
👉 Read our full editorial: AI agent inventory gaps are breaking enterprise governance models