Discovery coverage for unregistered agents

The entry condition matters more than the inventory label

The index defines agent discovery as inventory across connected services, including agents not registered in advance. That final condition is important. A directory can accurately show every enrolled agent while remaining silent about an agent created elsewhere. A useful evaluation therefore starts with the population the buyer wants to find, then asks how a product observes that population and attaches an accountable owner. [newcore-c2-1] [silverfort-c2-1]

A discovery worksheet should separate imported records, observations from connected systems and claims about unregistered agents. These categories can overlap, but they are not interchangeable. The source should identify the observation point and the connections needed to make it useful. The buyer can then test a known missing agent against the promised boundary rather than interpret a polished inventory view as proof of complete estate coverage.

The integration boundary on continuous discovery

The NewCore product record describes inventory across connected identity systems and explicitly says coverage depends on integrations. The product’s announcement says it continuously discovers unregistered shadow agents and assigns named owners. These are relevant claims for a buyer whose immediate problem is unknown agents, but they do not remove the need to check each connection and runtime in the proposed estate. NewCore runs alongside the existing IdP as an agent governance layer. [newcore-c2-1] [n2]

A practical trial should ask how a newly observed agent becomes a distinct record, which evidence supplies the owner and how uncertainty is represented. A buyer should also separate discovery from control coverage. The NewCore record says direct command-line tool calls bypass its MCP gateway today. The discovery of an agent through a connected identity system does not by itself demonstrate interception of every action that agent can take. This distinction keeps a discovery claim useful without extending it beyond its documented scope. [newcore-c8-1]

The context exposed by discovery-led platforms

The Silverfort record describes discovery of agents and mapping of their underlying machine identities, together with accountable human owners. The Token Security record describes agents, MCP servers and machine identities, with owner attribution and access mapping. These are useful starting points for an ownership investigation. Their discovery evidence should not be converted into a claim of delegated token exchange or universal tool-call enforcement, which the records do not establish. [silverfort-c1-1] [silverfort-c2-1] [token-security-c1-1] [token-security-c2-1]

The Clutch Security record emphasises cross-environment discovery and lineage joining deployers, tools, identities and reachable resources. The Astrix record describes discovery of agents, servers, secrets, permissions and owners. A buyer can compare the context returned by each product rather than ask only whether an inventory exists. The question is whether that context supports the next action: finding a responsible owner, understanding reachable resources or preparing a controlled access profile. [clutch-security-c1-1] [clutch-security-c2-1] [astrix-security-c2-1]

The separate tests for imports and sensor signals

The Okta additions dated 22 October 2026 include import integrations for Cursor, Snowflake, Databricks, Workato and Tines. The same source states general availability for Multi-Source Agent Schema and AI Agent Registration with CIMD. These additions improve the documented registration and inventory workflow, but an import path should not be described as equivalent to finding every unknown agent. The buyer still needs to identify which records originate in connected platforms. [f3]

The earlier Okta announcement describes Shadow AI Agent Discovery for Endpoints as planned for Q3, without specifying fiscal or calendar quarters. That wording is not evidence of subsequent general availability. The Microsoft post dated 19 October 2026 describes additional identity types, including local agents and previously unknown agents discovered through security sensors. The held facts do not verify prices or availability dates for those additions. A trial should distinguish the import population from sensor-observed agents and record availability separately. [f2] [f7]

A directory can be useful without broad shadow discovery

The Descope record documents a unified directory, while discovery beyond its integrations is unclear. The Keycard record supports registered application identities rather than broad discovery of unknown agents. The Aembit gateway manages connected agents, but broad shadow-agent discovery is not established in the cited evidence. These are scope distinctions, not reasons to discard useful access infrastructure when the buyer already knows the agents it needs to govern. [descope-c2-1] [keycard-c2-1] [aembit-c2-1]

The SailPoint Entro evidence adds another useful boundary: integrations can discover workflows and correlate credential use and ownership. A buyer should name those integrations in its coverage sheet rather than generalise from them to every agent builder or endpoint. The right comparison asks whether a product finds the specific missing population and supplies enough context to investigate it. A platform strong at access mediation may remain useful even when another system supplies discovery. [sailpoint-c2-1]

A coverage worksheet that exposes the missing population

The test should use a small set of deliberately unregistered agents in the environments the buyer actually needs to cover. This is a proposed evaluation method, not a claim about measured vendor performance. Each result should retain its observation source, required connection, owner confidence and remaining blind spots. The worksheet should also distinguish detection from enforcement so that a found record does not silently become a blocked action.

A repeat check can examine whether records remain understandable after ownership or access changes. The desired output is not an unsupported estate-wide coverage percentage. It is a clear account of what was found, why it was visible and what remains outside the tested boundary. The following fields make that account portable between discovery-led products and identity-provider additions.

• The starting population identifies agents deliberately absent from the directory.
• The observation source names the connected service, endpoint or security signal.
• The owner field records evidence and uncertainty rather than only a display name.
• The control field separates inventory, access mapping and demonstrated enforcement.

What readers ask