AppViewX adds shadow AI agent controls & quantum IDs

AppViewX has expanded its Agent Identity Security product with tools to identify shadow AI agents, shut down rogue agents during operation, and issue quantum-resilient identities for agents. The update reflects growing corporate concern over how AI agents are discovered, controlled and authenticated.

The additions are designed for a wide range of software agents, including coding, enterprise productivity, endpoint, SaaS and custom-built agents. AppViewX argues that AI agents pose a distinct security and governance challenge because they can act on behalf of users or independently, often using credentials, privileges and connections to enterprise systems at a pace beyond traditional access controls.

Shadow AI

A central part of the update is broader discovery of unsanctioned AI agents. AppViewX said its expanded AI Bill of Materials now allows security teams to identify both approved and shadow agents across the enterprise, including browser-based agents and short-lived script-based agents that can be difficult to track.

The inventory now also extends to agents' skills, alongside their models, credentials, identities and MCP tools. The aim is to give security teams a clearer picture of what an agent can do and where risk may lie.

To support that process, AppViewX has introduced what it calls a lightweight endpoint Guardian Agent, combined with API integrations across endpoint detection and response systems, SaaS applications and cloud platforms. The approach is intended to improve visibility into agents that might otherwise operate outside formal governance structures.

Runtime controls

Another part of the expansion is a new Agent Kill Switch. AppViewX said the feature allows security teams to terminate an agent and its active sessions automatically in response to events, through runtime policies, or directly from the management console.

Teams can create workflows that stop an agent when AppViewX detects changes such as configuration changes. Through integration with the Shared Signals Framework, those workflows can also respond to signals from third-party security tools.

According to AppViewX, runtime policies can be based on the resource type involved, the specific agent and the agent's stated intent. The kill switch can be used on both sanctioned and shadow agents and does not depend on an MCP gateway.

A related addition is a new MCP Gateway intended to govern MCP servers, including unsanctioned ones. AppViewX said the gateway can discover those servers and assess their risk and posture on an ongoing basis. It also supports just-in-time access, so agents receive access to MCP servers and tools only when needed and only for the required period.

Sensitive data can also be redacted through built-in controls or integrations with external data security tools such as Microsoft Purview.

Compliance and spend

AppViewX also expanded the product's oversight features for AI programme management. Customers can now view AI token usage, trends and costs, and apply threshold policies intended to curb uncontrolled spending.

On compliance, the software now lets organisations assess agent deployments against a range of frameworks and regulations. These include the OWASP Top 10 for Agentic Applications and Agentic Skills, MITRE ATLAS, GDPR, HIPAA, ISO 27001/42001 and NIST SP 800-53 Rev. 5, alongside NIST AI RMF, the EU AI Act, SOC 2 and SEC Cyber Disclosure.

The latest additions also tie into AppViewX's broader identity and cryptography platform. It has extended its public key infrastructure and certificate lifecycle management software to issue cryptographically verifiable quantum-resilient identities for AI agents.

That identity layer is intended to sit alongside enterprise identity providers. AppViewX said the agent identities chain back to a customer-managed PKI through its platform, giving security teams a single trusted root and an audit trail for agent identity issuance and management.

Customer views

ZoomInfo is among the users AppViewX cited as adopting Agent Identity Security.

"Governance becomes much harder to introduce after agents and their access have already spread," said Venkat Chivukula, Vice President, Enterprise Applications and AI at ZoomInfo. "As agents connect to more systems and take more actions, organizations need a way to understand and control their combined access. Agent Identity Security is helping us bring together broader lifecycle governance, privileged access control, and runtime detection so we can establish those guardrails early and maintain control as AI adoption scales."

Docusign also uses the product, according to AppViewX.

"We need to scale AI, and we need to scale fast, but that requires solving the foundational governance and risk questions at the same time," said Sadeq Zabihi, Senior Director of Platform and Services at Docusign. "AppViewX's Agent Identity Security brings discovery, governance, security, detection and response together so my team can see where agents are operating, apply the right policies, and detect when their behavior creates risk."