--- title: "AI Security Posture Management: Finding Shadow Agents You Did Not Deploy" description: "Shadow agents are born as consents and tokens, not cloud workloads. Here is how to discover them through identity, record posture, rank by authority and offer a faster sanctioned route." author: "Declan Osei" category: "Attack Surface & Threat Modeling" date: 2026-10-29T06:05:05.904Z canonical: "https://agenticcyber.co/blog/ai-spm-and-shadow-agents-finding-the-agents-you-did-not-deploy" --- # AI Security Posture Management: Finding Shadow Agents You Did Not Deploy ![trees sunrise, shadow, nature](https://cdn.pixabay.com/photo/2018/11/05/14/29/trees-sunrise-3796183_1280.jpg?w=1200&q=75) > Shadow agents are born as consents and tokens, not cloud workloads. Here is how to discover them through identity, record posture, rank by authority and offer a faster sanctioned route. Picture a Tuesday. A manager in marketing wires a no-code assistant to the team drive. Four minutes later it holds a token and can read hundreds of files, yet the security team has no record of it. Nobody was careless. The platform made it trivial. AI security posture management (AI-SPM) is the discipline that closes this blind spot. In practice it means three jobs: locate agents that arrived outside the formal process, document what each can touch, and repair the worst exposure first. Nothing here endorses a product. ## Two ideas that get blurred The term comes from cloud security, where posture work means keeping a live asset list, comparing settings with a baseline and ranking the deviations. AI-SPM stretches that to models, agent applications, and the data and tools wired to them. Vendors draw the boundary in different places, so read the scope statement before you sign. A shadow agent is simply one the security team does not know exists. It usually arrives through one of five doors: - A no-code assistant builder bundled with an office suite. - A coding helper or editor extension that can reach repos and secrets. - A browser add-on or desktop app that reads files and takes actions. - A prototype that outlived its trial period. - A SaaS product that switched on an agent feature without announcement. The developer-tooling slice has its own treatment in [shadow AI detection](/shadow-ai-detection-finding-unsanctioned-agents). Here the lens is wider. ## Why the problem grows on its own Building an agent costs little and connecting one costs less. The IT ticket that used to slow things down is gone, and consent screens are a click away. A forgotten spreadsheet just sits there. An agent acts under a real identity, so both its errors and its compromise travel far. Breach data hints at the scale. A law-firm summary of IBM's 2025 Cost of a Data Breach report says incidents involving shadow AI made up 20 percent of breaches studied, seven points above sanctioned AI models, and that 63 percent of organisations lacked an AI governance policy ([Baker Donelson summary](https://www.bakerdonelson.com/ten-key-insights-from-ibms-cost-of-a-data-breach-report-2025)). These are second-hand figures from a 2025 report. Check IBM's own [report page](https://www.ibm.com/reports/data-breach) before quoting them to a board. ## Discovery begins with identity No scanner finds "agents" directly, but every agent leaves authentication traces. Check each trail below, and combine several because each has gaps. TrailWhat to look for OAuth consentsGrants in the identity provider and SaaS suites with read-everything or send scopes Keys and service accountsRecent credentials that carry no owner tag Network egressCalls to model-provider domains in proxy or DNS records ExtensionsAdd-ons installed in managed browsers and editors Cloud accountsProjects hosting model endpoints or agent runtimes For the record to store about each hit, see [inventory before controls](/attack-surface-management-for-ai-agents-inventory-before-controls). ## Posture means fields, not a roll call A roll call of names tells you almost nothing. Each entry needs the attributes that decide risk: who owns it and whether they still work here; which connectors it has and which of them write; what classes of data it reads; whether it runs on a shared key, a service account or a delegated user token; where its secrets live; whether its activity lands in your audit trail; and where a person approves consequential steps. Agree on that schema before shopping. Any tool you buy should fill it, and whatever it leaves blank becomes your manual work. ## Rank by authority, then hand people a faster door ## Rank by reach and offer a quicker route Sort findings by what an agent can do, not by how new it looks. Four yes-or-no traits make a workable score: it can write, it sees sensitive data, it can contact outsiders, its identity was never reviewed. An agent with three or four goes to the front, and it is also the best candidate for the deeper testing described in [red team scoping](/ai-red-teaming-scope-attack-categories-and-reporting-for-agents). A blanket ban only breeds more shadows. Give people a sanctioned lane instead: a brief request form, a vetted platform list, a standard identity setup with narrow, short-lived credentials, and an approval time they can plan around. If the official lane takes weeks, the four-minute lane wins. Treat approval time as a security metric. ## What the tools actually see Read vendor documentation for scope. Microsoft's description of AI security posture in Defender for Cloud, for example, says it discovers AI workloads running on named cloud services such as Azure OpenAI, Azure AI Foundry, Azure Machine Learning, Amazon Bedrock and Google Vertex AI, and builds an AI bill of materials from them. The same page says agent discovery for Foundry and third-party cloud agents moved behind a separate Agent 365 licence from 1 July 2026 ([Microsoft Learn, AI security posture management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-security-posture)). That page reflects one vendor's product at the time of reading, so verify the current state. The lesson is about shape. These tools find what runs on cloud AI services you already use. A no-code builder in a productivity suite, or a consent a user granted to a plugin, lives in the identity layer and may never show up in a cloud-workload scan. ## Buy identity governance before posture tooling The common instinct is to purchase an AI-SPM platform to solve shadow agents. For this particular problem, that is usually the wrong first purchase. Shadow agents are born as consents and tokens, so the control that sees them first is the one that governs consent. Start with the setting that controls who may grant what. Microsoft's guidance on user consent notes that by default users may consent to apps for permissions not needing administrator approval, and recommends allowing user consent only for apps from verified publishers ([Microsoft Entra, configure user consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent)). Other identity providers have equivalents. Tightening that one setting turns many silent grants into visible requests. Then add a posture product for the part it does well: cloud-hosted agents and AI pipelines your teams build deliberately. The order matters because a posture tool cannot rank an agent it never discovers. Most of your agents sitting on a small number of cloud AI platforms that the tool covers natively is the one setup that changes this. In that case the platform sees nearly everything, and posture tooling can come first. Test the claim with a hundred-line experiment: create a throwaway no-code agent in your suite and see whether the tool notices it. ## Close ten findings, then automate Choose the ten highest-ranked agents and act on each: name an owner, narrow the scopes, rotate shared keys, turn on logging, or shut it down. Next, script the queries that surfaced them, for example a weekly digest of new broad-scope grants. An incomplete inventory that triggers repairs is worth more than a flawless one that never leaves the spreadsheet. Add an expiry rule for orphans. Suspend an agent after a month without an owner, and delete it with its credentials after another month in suspension. Because this is company policy, obtain management approval before enforcing it. The [lifecycle article](/non-human-identity-lifecycle-for-agents-owners-expiry-and-offboarding) covers owners, expiry and offboarding. ## A five-day starter plan - Export every OAuth grant and sort by breadth of scope. - List service accounts and keys that have no owner tag. - Check proxy logs for model-provider traffic, grouped by department. - Message the owners of the top findings and ask what each agent is for. - Decide per agent: keep, narrow or retire. Ask first, because some of them carry real work. ## Limits, privacy and review Discovery inspects staff activity and logs, so bring in legal, privacy and HR before you monitor browsers or review personal tools. Any statement a vendor makes about coverage is the vendor's claim until independent tests support it. Qualified security professionals should sign off on production risk decisions. You will never find every agent. You can find those with the most authority and stop new ones from being invisible by default. ## Questions about AI security posture management ## FAQ ### What is AI-SPM? AI security posture management applies continuous inventory, configuration checks and gap ranking to models, applications, agents and their connected data and tools. Vendors define the scope differently, so read what each product covers. ### Can AI-SPM tools find every shadow agent? No. Many discover workloads on cloud AI services. Agents created in SaaS builders or through user consents sit in the identity layer and need consent and grant reviews. ### Should we block unsanctioned agent builders? Blocking alone creates more shadows. Publish a fast sanctioned path with scoped, short-lived credentials, and measure how long approval takes. ### Who should be involved before monitoring employee tools? Legal, privacy and HR. Discovery reviews logs and activity that may touch personal use. --- Source: https://agenticcyber.co/blog/ai-spm-and-shadow-agents-finding-the-agents-you-did-not-deploy