Notifications
Clear all
Topic starter
25/06/2026 1:25 am
TL;DR: AI agents are proliferating inside SaaS tools and autonomous workflows faster than identity teams can provision, review, or even detect them, leaving shadow agents outside conventional IdP, inventory, and access governance processes, according to AuthMind. The core problem is that existing identity controls assume an agent will be registered before it matters, but many now appear only in network traffic and runtime behaviour.
NHIMG editorial — based on content published by AuthMind: LLM Discovery Gap No One Is Talking About
Questions worth separating out
Q: How should teams discover AI agents that never appear in the IdP?
A: Use continuous runtime observation instead of relying on provisioning events alone.
Q: Why do provisioning records fail to show shadow AI agents?
A: Provisioning records only show what was intentionally registered, while shadow AI agents may be created inside SaaS platforms, through personal accounts, or by other agents at runtime.
Q: What do security teams get wrong about agent inventory and ownership?
A: They often assume that once an agent is found, a single inventory record is enough.
Practitioner guidance
- Build a runtime discovery path for AI identities Correlate network flows, model communication, and east-west activity so agents can be detected even when no IdP object or provisioning event exists.
- Separate agent inventories from user identity inventories Track AI agents as their own governance class, with ownership, scope, and lifecycle records that do not depend on a human account session.
- Classify agents by observed behaviour Distinguish session-oriented copilots from autonomous workflows that can spawn sub-agents, call APIs, and retrieve secrets before assigning control requirements.
What's in the full article
AuthMind's full article covers the operational detail this post intentionally leaves for the source:
- How its network-traffic models identify LLM communication even when no identity record exists.
- The behavioural signals used to separate user AI agents from autonomous agents.
- Examples of east-west traffic patterns that indicate sub-agent creation and secret retrieval.
- The operational logic for mapping discovered agents back to a human owner.
👉 Read AuthMind's analysis of shadow AI agent discovery and runtime visibility →
Shadow AI agents in SaaS: what identity teams are missing?
Explore further
25/06/2026 10:49 am
Shadow AI is a discovery failure, not just a governance gap. The article shows that agents can be created inside SaaS tools, by users, or by other agents without ever entering the identity stack. That means the programme did not simply miss a review cycle, it lacked a mechanism to observe the identity in the first place. The practitioner conclusion is that discovery must be treated as a control domain of its own, not a by-product of provisioning.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should organisations govern autonomous agents differently from copilots?
A: Autonomous agents need stronger oversight because they can call tools, retrieve secrets, and generate sub-agents without the same session-bound limits as a copilot. Governance should reflect that difference in monitoring, approval, and scope controls rather than using one generic policy for every AI capability.
👉 Read our full editorial: AI agent discovery gaps are exposing shadow workflows in SaaS
