How to Find Shadow Agents in Your Enterprise

Last week I wrote about shadow agents - AI agents employees spin up.......connect to company data.....and automate work with.......while IT never knows they exist !!!!!!!!!!

The question that came back: 'How do I even find them?'

Here is the checklist I would run in any enterprise:

1. OAuth and SSO grants. Pull every third-party app grant in your identity provider. Look for AI tools holding access to mail, files, calendars, and CRM data.

1. Expense reports and card statements. Shadow agents run on subscriptions. Search for the AI vendors and automation platforms - including the ones on personal cards.

1. Automation platforms. Audit every Zapier, Make, n8n, and Power Automate account tied to a work email. A flow with a trigger and a company credential is an unmanaged worker.

1. Browser extensions and installed apps. Your MDM and extension inventory will surface copilots and agents nobody approved.

1. API keys. Scan for keys created outside your cloud organization - in code repos, side projects, and SaaS tools that ask users to bring their own key.

1. Then ask - Run a two-week amnesty: any team that registers an existing agent gets a sanctioned path, not a sanction. One honest week finds more than six months of scanning.

The pattern: tools find the plumbing. People tell you the truth.

And the goal was never to shut these agents down. Most of them are doing real work that deserves a sanctioned path - an identity, an owner, a permission set.

Discovery first. Registry second. Control third.

What would you add to the list?

Jared Killoran, Sameer Lal, CA, CMA, PMP, Aditya Anne, Aimal Khan, Bala Vaithyalingam, Carly Taylor, Michael Charles Borrelli, David Corrigan, Hermann Dagys, Howard Diesel, Imad Jawadi, Inna Tokarev Sela, Jason Schenker, Gopinath Sridharan, Favio Vazquez, Felipe Flores, Faraz Rasheed, Fernando Sanchez, Faisal Abid, Linda Haviv, Laura Grace Ellis, Luciano Martins

💾 Save this post
♻️ Repost
➕ Follow Ash Srivastava for daily insights on Data and AI Governance

#AIGovernance #AgenticAI #ShadowAI #EnterpriseAI