Most teams think they have a handful of agents. The first scan says otherwise.
AWS Bedrock endpoints resolve to generic EC2 IPs after TLS handshake. Network monitoring sees nothing. AgentDiscover's L5 CloudTrail layer sees everything.
Each gap is structural — not a tuning problem.
Shows API calls but can't correlate them to a specific process or identity on disk. You see 155 invocations; you don't know which agent made them.
Only finds agents with source on disk. GHOST agents run from memory, containers, or compiled binaries — no .py file to scan.
Enterprise SSE proxies (Zscaler, Netskope, Prisma) hide all AI provider hostnames. TLS terminates upstream — no SNI visible downstream.
An analyst wiring ChatGPT Teams into Salesforce through the browser leaves no config file. Only L2 network correlation at the process level catches it.
Five classification states, each with a defined evidence threshold.
Code on disk + runtime activity verified. Both signals present and correlated.
Making live LLM calls with zero matching source code on disk. Running entirely outside your codebase.
Code present, no recent runtime activity. Dormant agents still holding credentials and permissions.
Sanctioned tools, zero governance. Browser-based AI usage leaving no config file behind.
Partial signals only. Needs additional evidence to classify — flagged for review.
No single signal finds everything. AgentDiscover correlates five independent layers.
Self-serve. No demo required to get real value.
All ~70 existing tenants grandfathered. Value metric: environments — never agent count. Watch and Guard are contact-us; no self-serve billing for those tiers.