AppViewX has introduced Agent Identity Security, a new product designed to manage and secure the identities of AI agents within enterprise environments. The company states that traditional identity and access management (IAM) systems, built for human users with predictable access patterns, are inadequate for the rapidly growing number of autonomous, short-lived AI agents that often share credentials.
Agent Identity Security operates as a component of the broader AppViewX platform, aiming to establish zero-trust principles for AI agents. Its core functions include continuous discovery, monitoring, governance, and securing of agent identities throughout their lifecycle. The product is also designed to extend coverage to other machine identities and prepare organizations for quantum computing challenges by leveraging a native Public Key Infrastructure (PKI) foundation. This architectural approach was highlighted by Todd Thiemann, a Principal Analyst at Omdia, as providing the necessary cryptographic depth to address both AI and quantum computing security concerns simultaneously.
The product helps organizations understand AI agent operations by monitoring runtime behavior, connections to Management and Control Plane (MCP) servers, and access to API keys and tokens. It also distinguishes whether agents are acting on behalf of a user or autonomously. This information is consolidated into a unified view, allowing for the application of guardrails through risk insights, policy-based governance, adaptive agent access, and threat detection.
AppViewX cites several incidents that underscore the need for such a solution, including stolen OAuth tokens at Salesloft/Drift, an Amazon Q prompt injection that reportedly wiped developer environments, and a Replit agent that deleted a production database. Gartner projects that by 2028, a quarter of enterprise breaches will involve AI agent abuse, and the average global Fortune 500 enterprise will utilize over 150,000 AI agents.
Agent Identity Security aims to address the challenge of employees creating and deploying AI agents on low-code platforms, often bypassing traditional security reviews. It introduces lifecycle management workflows, ensuring agents undergo review before production and receive automated guardrails, particularly for those interacting with sensitive systems.
Regulatory frameworks such as NIST AI RMF, ISO/IEC 42001, and the EU AI Act increasingly require organizations to have clear visibility into agent activities, ownership, and controls. AppViewX's product seeks to provide this by creating an "Agent Bill of Materials," an inventory of every agent, its identity, owner, connected MCP servers, Large Language Models (LLMs), credentials, and runtime behavior, along with cryptographic dependencies and trust relationships.
The system integrates with existing AI agent platforms, including major cloud vendors like AWS Bedrock, Microsoft Foundry, and Google Gemini, as well as foundation model providers such as OpenAI and Anthropic. It also supports generative AI assistants like ChatGPT and Claude Code, SaaS agent platforms like Salesforce Agentforce and Microsoft Copilot Studio, and orchestration frameworks like CrewAI.
For security systems, Agent Identity Security publishes event logs in OCSF format to SIEM platforms like Splunk, DataDog, and Sentinel. It also integrates with MDM/EDR solutions (JAMF, Intune, Crowdstrike), enterprise identity providers (Microsoft Entra ID, Okta), and credential management systems. Workflow and notification integrations include ServiceNow for approvals and Slack/Microsoft Teams for alerts.
The product continuously assesses agent posture against configurable detectors covering ownership, credential hygiene, MCP server sanction status, model drift, and system prompt changes. Detections are mapped to controls across various compliance standards, including SOC 2, NIST AI RMF, ISO 27001, the EU AI Act, OWASP Top 10 for LLM, and MITRE ATLAS, providing a compliance dashboard. A configurable risk engine evaluates agent identity, user access, data exposure, runtime behavior, and connections to LLMs, assigning a risk score based on the organization's profile. This allows for adaptive access decisions, such as rate limiting or blocking anomalous behavior against sensitive resources.
AppViewX emphasizes that agent identity fundamentally represents a credential and trust problem, best addressed from a machine identity and PKI foundation rather than by adapting human IAM tools. The company asserts that Agent Identity Security brings AI agents under the same security standards as other identities, while also preparing cryptographic assets for the post-quantum era.
