BeyondTrust has announced expanded capabilities across its Pathfinder Platform that deliver the industry’s first unified approach to securing AI agent coworkers that operate alongside users and autonomous AI workloads executing at scale across cloud and SaaS environments. The announcement is backed by new threat research from BeyondTrust Phantom Labs, which found that the majority of enterprises are running shadow AI agents with privileged access that security teams cannot see or govern.
AI agents are no longer experimental. They are production workloads, initiating API calls, using credentials, deploying code, and accessing sensitive data. Many are deployed in minutes on low-code platforms, often with privileges that rival or exceed those of human administrators. In many enterprise environments, machine and AI identities already far outweigh human identities, dramatically expanding the privileged-identity attack surface. Yet most organisations lack any visibility into how many AI agents are operating in their environments, what those agents can access, or what happens when one of those agents is compromised. These trends underscore the need for a unified approach to securing AI, human, and machine identities across environments.
“Agentic AI is not an isolated problem. It’s a subset of the broader non-human identity landscape,” said Marc Maiffret, Chief Technology Officer at BeyondTrust. “Organisations cannot secure agentic identities in a silo. These agents are interconnected with human identities, machine accounts, secrets, and entitlements across every environment. You need a platform that sees and secures the full spectrum, and that’s what Pathfinder delivers. Simply put; to get agentic AI right, you need to get privileged identity right.”
Securing AI identities across coworkers and workloads
Unlike most AI security solutions, the Pathfinder Platform addresses both sides of the agentic AI challenge, providing defense for AI coworkers and local agents on endpoints, as well as for AI workloads running autonomously across cloud infrastructure and SaaS platforms.
New capabilities include:
- Endpoint privilege enforcement for AI coworkers: BeyondTrust Endpoint Privilege Management (EPM) enforces least privilege and application control for AI clients operating on endpoints, such as Claude, ChatGPT, etc., ensuring AI tools can only execute actions permitted by policy—a critical enforcement plane that no other agentic AI security vendor delivers.
- AI agent discovery and risk analysis: Identity Security Insights delivers comprehensive agentic AI discovery, classification, and posture auditing with connector coverage spanning major enterprise AI platforms, including OpenAI (Admin, Projects, and ChatGPT Enterprise), Google Vertex AI and Discovery Engine, Salesforce Agentforce, ServiceNow AI agents, and AWS Bedrock. Organisations gain automatic discovery, privilege path mapping, risk scoring, and shadow AI detection wherever they deploy agents.
- Secrets management for autonomous agents: BeyondTrustPassword Safe vaults, rotates, and enforces just-in-time access for the secrets and API keys that power agentic workloads. Combined with Insights, organisations gain end-to-end visibility from agent discovery through credential management, eliminating the static credential exposure that creates persistent attack surfaces.
Managing the explosion of non-human identities
Telemetry surfaced through BeyondTrust’s Identity Security Insights, operating within the Pathfinder Platform, indicates AI agent growth is accelerating rapidly across enterprise environments. Over the past year, organisations analysed through the Pathfinder Platform experienced a 466.7% increase in enterprise AI agents, many deployed through low-code platforms and automation frameworks that operate across endpoints, cloud infrastructure, and SaaS applications.
“The question security teams should be asking isn’t ‘do we have AI agents?’ You do,” Maiffret continued. “The question is: what can they access, what secrets are they using, and what happens if one gets compromised? A single AI agent’s blast radius can span your identity providers, cloud infrastructure, SaaS platforms, and on-prem directories all at once. Pathfinder maps those cross-domain privilege paths so you can see exactly how a compromised agent could escalate access across your entire environment.”
Free AI security posture assessment
BeyondTrust’s Identity Security Risk Assessment (ISRA) now provides organisations with immediate visibility into AI agent risk as part of a comprehensive identity security posture analysis. The assessment connects across enterprise identity and AI agent infrastructure in under an hour and delivers findings within 24 hours, including discovery and inventory of all AI agents, shadow AI detection, cross-domain privilege path analysis, and risk scoring aligned to MITRE ATT&CK with prescriptive remediation guidance.
Discussion about this post