Technology · Network Analysis

See every agent on the network, and what it does.

An agent cannot work without talking: to model APIs, to your systems, to other agents. Network Analysis turns that traffic into an inventory of agents with owners, credentials and behavior, and flags the ones that should not be there.

Agent inventory · excerpt
ops-agentowner: platform · restarts services · admin token
support-agentowner: support · reads tickets · replies to customers
review-agentowner: left the team · personal repo token · external model API
unknown-3owner: none · set up 14 months ago · new host contacted nightly
findings2 agents without a current owner · 1 over-privileged · 1 unexplained destination
Illustrative excerpt.
Questions it answers

The questions nobody can answer from a spreadsheet of "known" agents.

  • 01How many agents are running on our network right now, and who owns each one?
  • 02Which agents hold live credentials, and are those broader than the job requires?
  • 03Where does each agent send data, and did any destination change recently?
  • 04Which agents were set up by someone who has since changed roles or left, and still run with their access?
  • 05Is an agent reading inputs from outside that could carry instructions from an attacker?
What it sees

Agents reveal themselves by how they talk.

Model API calls in a steady rhythm. Tool calls into internal systems. Credentials that belong to a person, used at 3 a.m. Network Analysis reads these patterns and builds the inventory from them.

Rogue and forgotten agents

Agents nobody owns anymore: set up by someone for a project, a team or a trial, and left running after they moved on. Found, attributed where possible, and removable.

Credential scope

Which tokens and keys each agent uses, and whether they grant more than the agent's job needs.

Outbound communication

Every external destination per agent, with a baseline, so a new host or a new data volume stands out the day it appears.

Agent-to-agent traffic

Chains where one agent triggers another. A mistake in the first propagates to all of them.

Exposure to outside input

Agents that read mail, tickets, documents or web pages, which is where injected instructions arrive.

Behavior changes

A tool update, a new prompt, a new integration. When an agent starts doing something it never did before, you hear about it.

Example · an engineering organization

The reviewer that outlived its owner.

An engineer set up an AI code reviewer for their team. It worked, so nobody touched it. It was wired to the repository with the engineer's personal token. When they changed teams, the agent stayed. When the token was supposed to be rotated, it was not, because nobody knew what would break. Six months later it still reviewed every pull request, still called an external model API, and had started talking to a host nobody recognized.

Network Analysis found the agent from its traffic, showed that its credentials belonged to someone no longer on the team, and surfaced two more agents in the same state, left behind by people who had left the company.

The organization assigned owners where the agents were still wanted, removed the rest, and replaced personal tokens with scoped service credentials. The rule that came out of it: every agent has a named owner, and an agent without one is a finding.

Timeline · review-agent
mar 04deployed by an engineer for their team · personal repo token
may 12engineer changes teams · no handover, agent keeps running
jun – sepreviews every pull request · token never rotated · external model API
sep 20new outbound host · not seen anywhere else on the network
findingno current owner · credentials of a former team member · 1 unexplained destination · 2 similar agents
actionoutbound blocked · owners assigned or agents removed · scoped credentials
Illustrative timeline.
What you get

An inventory with owners, and the controls to act on it.

Inventory

Every agent, attributed

Type, first seen, last seen, who set it up and who owns it now. An agent whose owner has moved on is a finding on its own.

Behavior

What each one does

Destinations, volumes, credentials and internal systems touched, with a baseline per agent.

Alerts

Change and exposure

A new destination, a widened scope, or an agent reading outside input it did not read before.

Controls

Block, contain, remove

Stop unwanted outbound communication and remove agents that should not exist, with a record of every decision.

Network Analysis observes traffic where your network already gives you a vantage point. How that is set up depends on your topology and your cloud footprint. We map it together in the demo.

Demo

Count your agents. Then meet the ones you did not know about.

Bring a network segment or a cloud account. We will show you what an agent inventory built from behavior looks like.

Schedule a demo