Audit your agent estate: find unapproved agents, map permissions, and contain risk

Your approved-agent count is not your agent estate. A Fortune 500 customer found 18,000 active AI agents on endpoints in August after approving only 300; CrowdStrike used the gap to introduce Falcon Guardian at Fal.Con 2026. A safe agent estate needs continuous discovery, identity, permission mapping, and enforced containment, not just an approval count. If you own agent lifecycle controls, start with the difference between what is approved and what is actually running.

CrowdStrike did not disclose how many of the 17,700 agents in the Fortune 500 customer's gap were shadow AI. The gap is the audit trigger: shadow AI, forgotten pilots, vendor runtimes, and credentials that outlive the project. The audit below gives the estate an owner, a permission map, and a containment decision.

Discovery and identity expose what is running

Discovery finds what is running. Identity tells you who owns it, which vendor built it, and which runtime hosts it. Without both, you are counting processes, not agents.

In a TrustedTech report, 67% of senior decision-makers use shadow AI tools, versus 31% of employees who acknowledge using unauthorized AI applications. The spread puts the highest-risk agents outside the governance process. Treat every endpoint, cloud workspace, and developer laptop as a potential agent host.

Do not stop at discovery and call the audit complete. A visible estate is still an at-risk estate. Continue to permission mapping before you treat the estate as safe.

Permission mapping defines the blast radius

Operators should begin by inventorying agents, identifying each instance, and linking it to the permissions it effectively holds. Effective permissions are the union of what the agent can read, write, execute, and exfiltrate, including inherited service accounts and temporary tokens.

CrowdStrike's platform watches more than 160 million agent instances on enterprise networks and has cataloged more than 1,800 separate agentic applications. The scale is a warning: your inventory will include applications you do not recognize. Record the credential scope, not just the tool name.

Containment turns visibility into control

In VentureBeat's July 2026 Agentic Security and Identity tracker, 18% of 116 enterprises isolated their highest-risk AI agents, while 8% combined enforcement with isolation. Most estates are still running high-risk agents with the same access as ordinary workloads. Containment is the part of the audit that changes incident response.

During the Fal.Con 2026 demonstration, Falcon Guardian detected 12 related malicious attempts on other agents and prevented all of them from leaking credentials. Test containment the same way: block lateral movement, credential access, and data egress without breaking the approved workflow.

A repeatable cycle keeps the audit current

The six-step audit below is the minimum control set for operators who own agent lifecycle controls. It assumes you can query endpoints, cloud workspaces, and developer machines. If you cannot, start with the systems that already hold credentials. Keep the output in a format your incident team can read during an incident.

• Discover every running agent. Query endpoint, cloud, and developer environments for AI processes, model calls, and agent frameworks. Finish with a list of instances with host, start time, and last activity.
• Identify owner, vendor, and runtime. Assign each agent to a person or team, a vendor or internal builder, and the runtime that executes it. The inventory is clean when no instance is unowned.
• Map effective permissions and credentials. Record what each agent can read, write, execute, and send, including service accounts, API keys, and temporary tokens. The permission matrix should be reviewable quickly.
• Classify risk by blast radius. Rank agents by data access, network reach, external actions, and ability to spawn other agents. The shortlist names agents that need special controls.
• Enforce isolation and containment. Put high-risk agents in restricted networks, least-privilege identities, and egress controls. The test is a blocked attempt to reach credentials or other agents.
• Schedule drift review. Re-run discovery and permission mapping on a fixed cadence, and alert when new agents, credentials, or permissions appear. The schedule is a recurring report with an owner and a due date.