You Can’t Secure the Homegrown AI Agents You Don’t Know You Have

Ask a security team how many homegrown AI agents the organization runs, and the room usually goes quiet. Engineering teams are building agents on AWS Bedrock, Azure AI Foundry, Google Vertex AI, and open-source frameworks faster than security can catalog them. Many of those agents read sensitive data, call tools and APIs, and act autonomously with little oversight.

That’s why Discovery & Inventory is Domain 1 of HAMMER. It’s the least glamorous area of the model and the one every other control depends on. Identity can’t be scoped for an agent nobody registered, and runtime guardrails can’t protect a path nobody knows exists. This article looks at what a real inventory contains, where most programs fall short, and how to tell which level you’re operating at today.

Why Discovery Comes First

At Level 1, the Blind stage, agents are developed under the radar. Development teams are often unaware that security engagement is expected, so agents multiply and security finds out by accident, or by incident. The simplest test is a single question: how many homegrown agents do we run? If nobody can give a clear answer, those agents will probably surface only after something breaks.

This is the homegrown version of Shadow AI, and it maps directly to two risks in the OWASP Top 10 for Agentic Applications: rogue agents and agentic supply chain exposure. You can’t assess the supply chain of an agent you haven’t found, and you can’t tell a rogue agent from a sanctioned one without a record of what should exist.

With a SaaS agent, the vendor owns most of the posture, so discovery is mostly about knowing which products are switched on. With a homegrown agent, the organization holds the pen end-to-end. Nothing is registered unless your own teams make it so.

What a Useful Inventory Actually Records

Most programs begin at Level 2, with a point-in-time inventory built from surveys or spreadsheets. Some agents are documented, coverage is partial, and the file goes stale quickly. Security tooling may occasionally detect an agent, but those findings are incidental rather than part of a formal process.

Level 3 changes the nature of the inventory. Discovery is automated across the primary build platforms, and a central record captures five things for every agent:

• Owner
• Model
• Data sources
• Connected tools
• Invocation paths

Invocation is the piece most inventories miss. It means every endpoint, embedded surface, and channel through which an agent can be started, and who is able to start it. Consider an agent built to summarize support tickets. The inventory lists its owner, its model, and the ticketing system it reads. What it doesn’t list is the public webhook a developer added during testing, which accepts requests from anyone who knows the address. The agent hasn’t changed, but the exposure has.

That’s why Level 4 treats unauthenticated and externally reachable invocation paths as a distinct class of exposure, reviewed on their own. They’re a different kind of risk from a misconfigured permission, and they deserve their own line in the review.

Triggers Deserve the Same Scrutiny as Permissions

An agent doesn’t need a person to start it. It can run on a schedule, subscribe to events, or re-enter its own workflow when a condition is met. Each of those triggers is a way for the agent to act without anyone asking, and most inventories ignore them.

At Level 5, the Adaptive stage, the inventory is complete and continuous. It covers sub-agents, tools, memory stores, dependencies, and every trigger an agent owns. Two rules define this level:

• Agents can’t reach production without being registered.
• New triggers are registered as privileged changes.

In practice, that means a new recurring trigger can’t appear unnoticed. A scheduled job that quietly wakes an agent every night is reviewed the way a new credential would be, because it expands what the agent can do just as surely.

How Discovery Matures

Each level of maturity is a stage you hold, not a box you tick once. Moving from a spreadsheet to automated discovery is the first real step. Moving from there to continuous, near-real-time discovery that includes code frameworks is the harder one, because code-first agents don’t announce themselves the way agents on a managed platform do.

By Level 4, inventory is tied to risk tier and data classification. New agents register automatically, coverage is measured, and a new agent appears in the inventory within hours. Automated discovery and posture assessment of this kind are core to AI security posture management (AISPM), because a posture can only be assessed for an agent that has been found.

For homegrown agents, this progression is engineering work, not configuration hygiene. Nobody ships a registration gate or a trigger review on your behalf. That’s a useful thing to know before the budget conversation, and it’s covered in more depth in the identity and access post in this series.

Find Out Which Level You’re Operating At

An inventory is never finished, but it can be honest. The goal isn’t Level 5 everywhere. It’s knowing today’s level, naming the next one, and making a specific case to move toward it.

Download the HAMMER eBook to see all five levels of Discovery & Inventory, plus the six other domains, and score where your program stands today.