The Visibility Gap Nobody Planned For

When IT teams talk about shadow AI, they usually picture a developer quietly using ChatGPT to write SQL. What they increasingly face instead is something harder to see: autonomous agents making API calls, reading files, and storing credentials on endpoints that existing network proxies never touch. The infrastructure to govern that is arriving fast — and the urgency is real.

According to a 2026 shadow AI survey by Unseen Security, 80% of organizations report moderate to pervasive shadow AI across their workforce. Only 25% describe comprehensive visibility into how employees use AI tools. And only 37% have policies in place to manage or detect shadow AI usage at all. With agentic AI in the mix, the gap between adoption and oversight has become a structural problem, not an awareness one.

What Jamf Found on Your Mac Fleet

On June 30, Jamf launched AI Governance in general availability — billed as the first native AI control plane for Mac. The pitch is straightforward: AI tools like Claude Code, Claude Desktop, and OpenAI Codex run as native processes on Apple Silicon. They operate entirely outside what network proxies and cloud-based SaaS monitoring can see. Jamf, which already runs a management agent on managed Macs, uses that existing telemetry to surface what’s actually running — without deploying anything new.

The product provides three capabilities: visibility into which AI applications are active across the fleet (including CLI tools and background agents), granular policy controls at the vendor configuration level (MCP server restrictions, network permissions, file system access), and compliance-ready reporting for CISOs. All policies enforce before a user’s first login to an AI agent — what Jamf calls a “day-zero” baseline.

Jamf’s own survey data puts the urgency in context. Organizations with deeply integrated AI are 40% more likely to report a security incident than those still exploring. Eventbrite’s Security Engineering manager noted that Jamf’s approach let them apply policy across the Mac fleet without adding another point solution or slowing developers down — a constraint that has killed most previous attempts at AI governance tooling.

Gartner’s estimate for AI governance spending in 2026: $492 million, crossing $1 billion by 2030. That number was essentially zero in 2024.

Why Cisco Paid ~$300M for Agent Discovery

In May, Cisco acquired the Israeli cybersecurity startup Astrix Security in a deal reported at around $300 million. The acquisition was a direct bet that AI agents — not humans — are becoming the primary identity risk in enterprise environments.

Astrix’s platform maps every AI agent operating in production, tracks the non-human identities (API keys, OAuth tokens, service accounts) agents rely on, and can block out-of-scope actions when a credential is compromised. Cisco is integrating these capabilities into its Identity Intelligence platform, extending them through Cisco Secure Access and Duo into a zero-trust framework for agentic workloads.

The strategic framing at RSA Conference 2026 was explicit: AI agents now significantly outnumber human users in most enterprise environments. An agent that autonomously provisions cloud resources or queries a database doesn’t go through an SSO flow — it uses a key or token that may have been issued months ago and never rotated. Astrix closes that blind spot. Cisco’s broader AgenticOps initiative, announced at Cisco Live 2026, packages agent discovery, lifecycle management, and threat detection into a unified control plane.

The Jamf-Okta integration announced alongside Jamf AI Governance makes the architecture visible: Jamf governs what MCP servers can run on the device; Okta for AI Agents governs what cloud resources those servers can reach. Short-lived credentials replace long-lived API keys. Every agent action is authorized and logged from endpoint to SaaS. The question Cisco and Jamf are both answering is: who ran which agent, with what permissions, and what did it do?

Microsoft’s Bet: Govern at Build Time, Not After

At Build 2026 in May, Microsoft made the Agent 365 SDK generally available with a specific thesis: governance should fire while an agent is being built, not after it misbehaves in production. The SDK wraps any agent — regardless of underlying stack — with Entra-based identity, Purview data controls, OpenTelemetry observability, and policy enforcement at five lifecycle checkpoints: input, LLM call, state, tool execution, and output.

The accompanying Agent Control Specification (ACS) is an open standard that gives any agent runtime a deterministic allow/deny decision at each checkpoint. Microsoft also shipped Microsoft Scout (July 1), which gives enterprise AI agents their own managed identity in Entra — a prerequisite for meaningful audit trails. The shift is architectural: you cannot govern what you cannot identify. Scout solves the identity layer; Agent 365 solves the policy layer.

Futurum Research described the net effect as turning shadow AI from an untracked risk into a governed asset class. That framing is accurate. The Agent 365 SDK doesn’t prevent employees from using AI agents — it makes every agent they use observable, policy-bound, and attributable to an identity. The practical effect for IT is that agent sprawl becomes a governance problem they can actually address, rather than a visibility problem they cannot.

What This Means for Engineering and Security Teams

The Technology Radar for July 2026 flagged the same structural issue: AI agents have moved to production while enterprise governance frameworks are still being written. The question is no longer whether employees use AI agents — 78% bring their own tools according to the Unseen Security data. The question is whether the organization can answer: which agents ran on which systems, what they were authorized to access, and what they actually did.

For engineering teams, the practical implication is that agentic tools — Cursor, Claude Code, Devin, GitHub Copilot Workspace — are increasingly in scope for device management and security policy, not just license procurement. The Jamf launch specifically named Claude Code and Codex as launch partners because those tools run natively on macOS and interact with the file system, network, and MCP servers in ways that require endpoint-level policy to govern.

For security teams, the convergence of endpoint management (Jamf), identity governance (Okta, Entra), and agent discovery (Cisco/Astrix) into integrated platforms means the tooling is arriving faster than the organizational processes to use it. Gartner’s cybersecurity trends report for 2026 puts the directive plainly: identify sanctioned and unsanctioned AI agents, enforce controls for each, and build incident response playbooks for when agents go wrong. The tooling exists. The incident response playbooks mostly don’t.

The pattern across Jamf, Cisco, and Microsoft is a convergence on the same architecture: agent identity as the foundation, endpoint policy as the enforcement layer, and audit logging as the compliance output. Organizations with deeply integrated AI that haven’t solved visibility are 40% more likely to report an incident. That number should be the catalyst for organizations still treating agent governance as a future planning exercise.

Further Reading

• Jamf enables AI Governance and shadow AI detection on Mac — Help Net Security’s detailed writeup covers the endpoint policy controls and the Okta integration in depth.
• Cisco buys Astrix Security to strengthen AI agent discovery and governance — SiliconAngle’s coverage of the acquisition with strategic context on non-human identity as the core security challenge.
• The MCP Governance Problem: Who Runs “Open”? — Our earlier piece on how the proliferation of MCP servers is outrunning the governance frameworks designed to manage them.