2 min readAI Agents · Cybersecurity
How do you test whether a leader can name every AI agent and its owner?
By Michelle Savage, Co-author, Agentic AI + Zero Trust
TL;DR: Ask for one page that lists every AI agent that's running, with one person's name next to each. Give each row five boxes: name, owner, job, logins, and the systems it can touch. Then count the blanks. A full page with a real name on every row is Level 3.
Security is Josh's field. Mine is words. So I make him say it again, plainly.
So I asked him the first thing any leader should be able to answer.
The question
How do you know which AI agents your company has?
Josh's answer
"List every AI agent that's running. Not the ones you approved. The ones running. Then put one human name next to each. The blanks on that page are your real risk list."
Short. Clear. I still had four questions.
What I still didn't get
What counts as an AI agent? I thought I knew. Turns out I didn't. Josh's test is simple. A chatbot answers the question. An agent sends the email. If it can act in your systems without a person clicking the button, it goes on the list.
What does "running" mean? It means look, don't ask. Asking gets you the list people remember. Looking gets you the one somebody in sales built before lunch. There's a full test for that part: how do you know if your AI agent inventory is complete.
Can a team be the owner? No. "Marketing owns it" means nobody does. One person. A name you could call tonight. Here's what evidence proves every AI agent has one accountable owner.
Why does the name count so much? Because a lot of agents borrow a person's login. Then the log says you sent that message. You were in a meeting.
Score yourself
Make one page. One row per agent. Five boxes in each row: its name, its owner, its job in one sentence, the logins it holds, and the systems it can touch.
Then find your answer below.
Level | What your answer sounds like |
1 | "We'd have to ask around." |
2 | "We have a list of the ones we approved." |
3 | "Here's every agent that's running, with one name next to each." |
4 | "Every agent has its own login. A new one can't start without a row on the list." |
Every blank box is a to-do.
This is where the free assessment starts. Question 1 asks how you identify your AI agents, under Identity Management. Thirty questions, about ten minutes: take the free assessment.
Start with the list.