Why Visibility Must Precede Enforcement in Zero Trust Strategies for AI Agents

The conversation surrounding artificial intelligence agents is undergoing a profound and necessary evolution. Earlier industry discussions focused overwhelmingly on the speed with which organizations could deploy these agents and the immediate productivity gains they promised. However, a wave of recent high-profile security incidents—most notably a widely discussed intrusion at Hugging Face during an evaluation of OpenAI agents—has forced cybersecurity and IT leaders to confront a sobering reality: deployment speed has drastically outpaced the ability to secure what is being put into production.

Security teams are increasingly asking critical questions about what an agent can access once it is running, and whether anyone would notice a compromise before it leads to a catastrophic data breach. While the temptation is often to jump straight into implementing strict enforcement controls and complex detection mechanisms, cybersecurity experts warn that organizations must look before they leap. Without a foundational understanding of what exists within the corporate ecosystem, security measures are built on sand.

Recent research from Veeam underscores the scale of this visibility crisis, revealing that 70 percent of organizations admit AI workflows are already interacting with sensitive corporate data without full oversight in place. Furthermore, 67 percent report that IT departments cannot fully track the autonomous workflows employees are actively building. While shadow AI represents only one facet of the broader visibility challenge, it perfectly illustrates how quickly and pervasively this fundamental first step can slip out of an organization’s grasp.

Zero Trust principles can certainly support an enterprise AI governance program, but only if they are applied in the correct order. A prominent principle highlighted at the very top of the SANS cheat sheet, titled "Zero Trust for AI Agents: The Security Checklist," states simply: "You cannot govern what you cannot see." The guidance places comprehensive asset inventory ahead of every enforcement control, treating it as an absolute prerequisite for a secure architecture.

In practice, however, many organizations skip directly to implementing policy enforcement points or authorization schemes for an agent that has no named owner, no defined operational scope, and no entry in any corporate asset inventory. This flawed order of operations is a primary diagnosis of why many Zero Trust programs ultimately fail. Deploying a proxy or an authorization layer in front of an entirely unknown population of agents leaves security tools with nothing real to enforce against.

Agent Use Emerges as a New Form of Shadow IT

With almost any disruptive enterprise technology, rapid adoption consistently occurs first, while governance follows much later—if it arrives at all. Once security teams finally recognize this governance gap, their immediate instinct is often heavy-handed prevention. This can include blocking unapproved tools, cutting off network access, or indiscriminately shutting down any unfamiliar applications. Budget and leadership attention tend to accumulate for these restrictive processes first. However, blocking technologies before security teams have a clear picture of what already exists risks shutting down legitimate business use right alongside unauthorized shadow deployments. While traditional shadow IT has been acknowledged and addressed in legacy enterprise technologies for years, organizations are still in their infancy when it comes to managing shadow AI.

When an agent is effectively invisible to the organization, an attacker does not need to breach traditional perimeter defenses to gain a significant foothold. A striking example of this vulnerability recently surfaced in an incident at METR, the nonprofit research organization known for its evaluation of the Hugging Face security breach. In that case, an attacker discovered an employee’s personal EC2 instance running a vibe-coded agentic application. The intruder trivially bypassed authentication and prompted the agent to hand over its model provider API key. Over a period of three weeks, the attacker consumed the equivalent of $600,000 in tokens because there were no spending limits configured on the API key. METR’s internal dashboard simply failed to display data on rate-limited requests, and total token volume alone was not enough to trigger internal security alerts.

Cloud computing infrastructure experienced these exact growing pains years ago, offering a clear roadmap for achieving visibility. Modern enterprises now enforce rigorous controls around cloud infrastructure, such as continuously monitoring AWS and Azure resource usage, tracking cloud spending, and ensuring that unused virtual machines are promptly terminated. Yet, almost no organizations apply these same disciplined practices to AI agents. Companies should treat AI and agent spending, alongside API-key issuance, as vital discovery signals. Furthermore, finance and procurement departments represent valuable vantage points that are frequently overlooked by security teams. Organizations must publish an approved-provider path before blocking external tools, ensuring that legitimate business use has a sanctioned alternative, and adhere strictly to the operating order of knowing first and restricting second.

The Challenge of Multi-Lensed Visibility

Even when an enterprise fully commits to asset discovery, no single vantage point can provide a complete picture of the entire agent population. Autonomous agents operate across corporate networks, local endpoints, employee web browsers, and third-party SaaS platforms hosted elsewhere. Relying on any single lens leaves massive blind spots for security teams.

Because traffic directed to AI providers is heavily encrypted using Transport Layer Security, an inline network sensor can typically see only a destination IP address and a byte count. It cannot inspect the actual prompt, the specific tool call, or data exfiltration events, especially since AI traffic often flows to the exact same domains utilized by legitimate, sanctioned applications. Standard network analysis alone cannot differentiate malicious agent activity from routine web traffic. Simultaneously, traditional endpoint tools often miss browser-embedded AI extensions, while SaaS-embedded AI remains entirely invisible to both network and endpoint monitors.

Consider a marketing analyst who installs a browser tool designed to summarize customer records and draft outbound marketing emails. Traditional endpoint security tools will never detect the application because it operates entirely within the browser environment. Network monitoring tools will see only encrypted traffic heading toward a domain that also hosts a dozen pre-approved SaaS platforms. The tool—and any sophisticated attacker who manages to compromise it—could retain persistent access to a customer relationship management database full of sensitive data without anyone in the organization realizing the tool even exists.

Recovering enterprise visibility requires abandoning the search for a single source of truth and instead correlating a wide variety of telemetry signals, each covering a different section of the environment. While network traffic can easily camouflage itself or hide within local Model Context Protocol servers and command-line interfaces, network metadata can indicate when a system is communicating with a model provider through DNS indicators, Server Name Indication fields, JA4 cryptographic fingerprints, and egress-proxy logs. Organizations must layer network visibility with endpoint telemetry detailing active processes, API keys stored in environment variables, and local agent runtimes.

Security teams must also monitor the browser level for unauthorized extensions, in-page copilots, and enterprise browser logs, while integrating identity and SaaS logs covering OAuth grants, API-key issuance, and provider administrative consoles. When correlated effectively, these diverse signals can finally construct a reliable asset inventory. While a Large Language Model gateway like LiteLLM can centralize visibility and governance by acting as a policy enforcement point, it only governs agents already directed toward it, looping the problem right back to the missing inventory. A gateway can control known agents, but it cannot discover the ones hidden in the shadows.

Audits Must Keep Pace With Rapid Deployment

Traditional security audits and periodic monitoring schedules are entirely inadequate for maintaining modern asset visibility. An annual review cycle can only observe assets that were documented a year ago, providing virtually no insight into the current operational environment. When agents can be deployed, cloned, and destroyed in a matter of seconds, any inventory produced by a traditional review cycle is obsolete by the time the audit report is finalized. Continuous monitoring is the most obvious solution, but removing human oversight from the loop carries its own operational risks.

If an organization relies solely on periodic audits, an attacker can easily exploit the gap by instructing a compromised agent to spawn short-lived clones to complete a malicious task. Each clone inherits the parent agent’s privileges before being rapidly terminated. These transient clones exist just long enough to exfiltrate sensitive data or carry out other unauthorized activities, disappearing entirely long before a regular review cycle would ever detect them.

Addressing this dynamic requires a combination of strategies, including having humans observe agents while simultaneously utilizing automated agents to monitor other agents. However, this raises questions of accountability: when automated systems monitor other automated systems, who remains responsible for the outcome? Effective auditability still requires a named human owner who is accountable for results, regardless of what automated reporting systems indicate. Organizations can also mitigate risk upstream by implementing strict quality gates.

Recent legislative pressure in the United States, such as an executive order issued by California leadership to accelerate independent oversight and advance the development of an AI emergency shutoff switch, demonstrates that the concept of a kill switch for autonomous systems is being taken seriously at the highest levels. However, this returns directly to the foundational prerequisite: emergency shutoff mechanisms are only meaningful if the organization actually knows what systems need to be switched off.

Agent identity forms a critical component of this prerequisite, making monitoring thresholds genuinely meaningful. As experts emphasize, security teams cannot apply thresholds to entities they cannot attribute. Agent tool access must be modeled as a distinct identity and policy enforcement problem, rather than merely treating the agent as an extension of the user who deployed it. Every agent requires its own unique identity, permissions must be strictly bound to the active task, data exfiltration paths must be constrained, and an explicit authorization layer must be placed between the model and connected services. Enterprise logging must undergo a similar shift, moving beyond simple prompt recording to track the specific tool calls and actions executed by the agent.

Implications for Enterprise Security Programs

The placement of visibility within an organization’s order of operations forms the foundational bedrock for every subsequent governance step. Each security challenge traced across modern enterprise environments leads back to the same root cause: an enforcement layer constructed before an inventory exists has nothing real to enforce against. Security programs must begin with comprehensive discovery, correlate the various telemetry sources available to cover blind spots, and establish continuous monitoring anchored around unique agent identities. The complete Zero Trust For AI Agents security checklist walks through all three essential tiers—inventory and governance, architecture and enforcement, and detection and response—in the precise order they are meant to be executed.