Topic starter
23/03/2026 3:52 pm
TL;DR: Most enterprises underestimate AI agent populations by an order of magnitude because discovery tools miss OAuth tokens, API keys, endpoint traces, and unofficial MCP servers, leaving shadow AI as a NHI governance problem rather than an inventory problem, according to Astrix Security. Visibility, not just scanning, becomes the control boundary when agents are deployed outside managed IT paths.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Your AI Agent Inventory Is Wrong. Here’s How to Fix It.”.
Key questions
Q: What fails when AI agents are not visible in enterprise inventories?
A: When AI agents are invisible, organisations lose the ability to assign ownership, understand credential use, and evaluate access scope before risk accumulates.
Q: Why do AI systems create NHI governance problems?
A: AI systems often rely on service accounts, tokens, APIs, and delegated permissions that behave like non-human identities.
Q: What are the signs that shadow AI agents are escaping discovery controls?
A: Common signs include identity traces without formal registration, endpoint-level activity from local agents or MCP servers, and broad permissions with no clear owner.
Practitioner guidance
- Map discovery to identity correlation Connect platform integrations, NHI fingerprinting, and endpoint telemetry into one inventory so agents can be tied to owners, credentials, and resource scope.
- Track shadow AI from identity traces Use OAuth tokens, API keys, SaaS traces, and endpoint indicators to identify agents that were never formally registered but are still active.
- Review local MCP server exposure Inventory unofficial or deprecated MCP servers on employee endpoints and determine whether they are local, remote, maintained, or abandoned.
Bottom line: AI agent discovery is failing because conventional tools are not built to connect identity traces across platforms, endpoints, and SaaS environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 8:37 pm
AI agent discovery is now an identity governance control, not a tooling convenience. The article shows that enterprises are not merely missing assets, they are missing the governance context that makes those assets manageable. When an agent can be deployed outside IT, authenticate through tokens, and run continuously, the inventory problem becomes a lifecycle problem. Practitioners should treat discovery as the first enforceable boundary for non-human access.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
👉 Read our full editorial: AI agent discovery exposes the NHI visibility gap in enterprise IAM