Scan: Find every agent, wherever it lives

Start with the first question every governance leader should be able to answer: What's in my fleet? For most organizations, the honest answer is “more than we think.” 91% of organizations already use agents, yet only 10% have a mature nonhuman identity strategy. There are roughly 45 nonhuman identities for every human, and fewer than half of CISOs know where their agents are or what they can access.¹⁴

The shadow fleet is real, and it looks mundane. A developer wires an agent into a CRM over a weekend and leaves the company in March; the agent keeps running under their credentials. A business team buys a SaaS tool with an embedded agent nobody registered. A proof of concept from last year still holds a live database key. You can't write rules for agents you can't see, which is why scanning must be active: Continuous discovery across your entire IT landscape, cloud, on-premises, SaaS and beyond, surfacing internal agents, third-party agents, cloud agents, and the shadow and unclassified agents nobody registered. So nothing stays hidden.

Scan every agent, wherever it lives: continuous discovery across the entire IT landscape, so nothing stays hidden

What “Scan” requires in practice

An agent registry: Every agent, AI function and embedded cognitive capability, including agent-to-agent connections. Registration is automated, not voluntary
Identity: Agents are workloads with unique identities, never borrowed human credentials.
Vendor-agnostic registry: Maintain a unified view of AI agents across platforms and technologies. Keep your control plane independent and impartial, regardless of where agents are built or deployed.
Ownership: A named, accountable human owner per agent, enforced in the registry
Operational trust signals: Beyond “exists”: live behavior, evaluation coverage and quality and safety trends per agent and across the fleet
Token consumption: Track how many tokens each agent consumes, with visibility into usage trends across your AI fleet. Spot unexpected spikes that may signal inefficient or abnormal agent behavior.

Shadow agent detection completes the picture: Continuously discover unmanaged agents, hidden workflows and dormant credentials, then decommission them before they become blind spots. McKinsey's blueprint for agentic AI at scale recommends exactly this kind of formal agent registry, with documented purpose, scope, and named owners.15 Regulators point the same way: EU AI Act traceability duties assume you can enumerate and reconstruct what your AI does.¹⁶

Once you can see the fleet, a second question naturally follows: What should each of these agents be allowed to do? That's where we go next.