The question an AI agent discovery tool answers
Ask most security teams 3 questions: how many AI agents are working here, who is responsible for each one, and what can they reach? Few can answer. Agents arrive one team at a time: an assistant in Copilot Studio, an agent switched on in Salesforce, a reconciler on AWS, a script on a finance workstation. Most never reach a list that security, IT or compliance can see.
AgentFort Discover is an AI agent discovery tool that builds that list from evidence instead of surveys. It finds the agents already running, including shadow AI that nobody approved, and records where each one runs, what it uses and who owns it. Discover is the first half of AgentFort's Identity control: you can't give an agent an identity, an owner or limits until you know it exists. For the vendor-neutral method, read our guide to discovering AI agents and shadow AI and the wider AI agent security guide.
Five places agents leave evidence
Every agent needs a definition, a model to decide, permissions to act and somewhere to run. Each leaves traces in systems you already have, but no single source sees everything. A platform knows an agent exists, but not what else it can reach. Your identity provider knows what an account can do, but not that an agent is using it. Discover joins the pieces into one entry per agent, with the evidence behind it, so you can see what is confirmed and what is only suspected.
| Where agents leave evidence | What it tells you | Where Discover reads it |
|---|---|---|
| Where they're defined | Which agents a platform knows about | Read-only connectors: Microsoft Copilot Studio, Salesforce (Agentforce), AWS, Google Cloud |
| Where they get their brain | Which program calls a model | Cloud model logs, sidecar proxies, OpenTelemetry traces, the optional sensor |
| Where they get their hands | What each agent can reach | Your identity provider, such as Microsoft Entra ID |
| Where they're built | Who built it, and agents not yet running | Code repositories on GitHub |
| Where they run | The cloud account, host, pod and process | Cloud connectors and the optional sensor |
Read-only connectors and an optional sensor
Discover starts by asking the platforms that already know their agents, through read-only connectors.
Many agents aren't registered anywhere. For those, an optional lightweight sensor runs on hosts and Kubernetes pods. It sees which process calls a model, and exactly where that process runs. Cloud model logs, sidecar proxies and OpenTelemetry traces add what the hosts can't see. Your identity provider then shows what each agent can reach, and your code repositories show who built it.
How Discover confirms an agent: the agent loop
A model call alone doesn't make an agent. Discover looks for the agent loop: the model asks for tools, and the tool results go back to it. When it sees that loop, the agent is confirmed, down to its pod and process.
The recorded demo uses Northwind, an illustrative company, to show the discovery workflow. Support Triage was confirmed this way in the support team's Kubernetes cluster. In all, Discover found 14 entities and sorted them into plain categories:
- Platform agents built in Copilot Studio, Agentforce, AWS or Google Cloud.
- Custom agents your engineers run in your own accounts, containers and servers.
- Shadow AI: software using AI services that no platform, project or owner accounts for.
- AI features that answer but don't act, such as a marketing copy writer.
- Agents in development: projects in your repositories not yet seen running.
- Tools: the services agents connect to.
Risk flags, and asking instead of guessing
Discover flags risks as it finds them:
- Shadow AI, like Northwind's summary script on a finance workstation, calling a model that nothing accounts for.
- No owner: nobody answers for what the agent does.
- Broad access: more than the job needs, such as an assistant that can send email as anyone in the company.
- Shared login: one set of credentials used by several agents, so you can't tell who did what.
- No identity: the agent has nothing of its own to hold it to account.
A shared name isn't proof that two pieces of evidence belong to the same agent. When Discover can't be sure, it asks a person instead of guessing. A single click links the running agent to its code and its owners.
Discover records that an agent exists and what it connects to. It never stores prompts, answers or the data your agents handle. Security at AgentFort covers how each control handles data.
What Discover doesn't do, and what you still need
Discover finds and describes agents. It doesn't block a call or change an agent's permissions; the other controls do that. Its coverage follows what you connect: the platforms above, the logs you share and the hosts where you run the sensor. It also can't decide who should own an agent. A person still has to accept ownership and review each shadow AI flag.
- Connect every platform where teams build agents, not only the main one.
- Run the sensor where agents run on your own hosts and clusters.
- Name who reviews shadow AI flags and who may accept ownership.
- Review agents in development before they reach production.
How Discover connects to the other controls
The inventory is the input for everything else. AgentFort Identity starts from it: every agent Discover found already has a plan for where its identity comes from and who owns it. AgentFort Access then limits each identified agent to the operations its job needs. AgentFort Data Protection inspects the data moving through its calls, and AgentFort Isolation contains it if it is manipulated. Visibility keeps a live inventory of agents, owners and connected business systems.
See what's running in your business
We are recruiting design partners for bring-your-own-cloud evaluations. Request a demo to see Discover against the kinds of platforms and clusters you run, or apply as a design partner to deploy it in your own environment and shape what we build next. The launch post, Find the AI agents at work in your business, walks through a first inventory in more detail.
Video transcript
Here's how AgentFort Discover finds the AI agents running across a company. Agents leave evidence in five places: where they're defined, where they get their brain, where they get their hands, where they're built, and where they run. First, read-only connectors ask the platforms that already know their agents: AWS, Google Cloud, Salesforce and Copilot Studio. Many agents aren't registered anywhere. So a small sensor on each host and pod sees which process calls a model, and exactly where it runs.
A model call alone doesn't make an agent. Here, the model asked for tools, and the results went back. That's an agent loop, so Support Triage is confirmed, down to its pod and process. Cloud model logs, sidecar proxies and OpenTelemetry traces add what the hosts can't see. Your identity provider shows what each agent can reach. Your code repositories show who built it. Risks are flagged as they're found: no owner, broad permissions, or shadow AI, like this script on a finance workstation calling a model that nothing accounts for.
A shared name isn't proof, so Discover asks. One click links the running agent to its code and its owners. Every agent: where it runs, what it uses, and who owns it. That's AgentFort Discover.
Frequently asked questions
Do I need to reroute AI traffic to discover AI agents?
No. AgentFort Discover starts with read-only connections to systems you already use: Microsoft Copilot Studio and Entra ID, Salesforce, AWS, Google Cloud, GitHub, and the model logs your cloud already keeps. Nothing is rerouted, no team has to register an agent, and agents keep working exactly as they do today. The optional sensor for your own hosts and pods stays inside your environment.
What is the difference between an AI agent and an AI feature?
An AI feature uses a model to answer or draft but takes no action, like a tool that writes marketing copy. An AI agent decides and acts: it sends email, updates records or issues refunds. AgentFort Discover labels each one separately, so your team can start its review with the agents that act, because those are the ones that can change something in your business.
What happens when a new AI agent appears?
When a new agent appears, AgentFort Discover tells you, and it can notify the tools your team already watches. The new entry comes with the evidence behind it and any risk flags, such as no owner or a shared login. Someone can then review it, accept ownership, and move it on to an identity and access limits.
Is shadow AI always a security problem?
Shadow AI is rarely malicious. It is usually a team solving a real problem, such as a finance script that sends spreadsheets to a public AI service for summaries. The problem is that it is invisible: you can't protect, budget for or explain to an auditor something you don't know exists. Discovery turns it into an entry with an owner who can decide what happens next.