C1 has introduced Shadow AI Discovery, a new capability designed to eliminate security blind spots caused by unauthorized AI tools, agents, and credentials. By automatically identifying AI-related identities and integrating them into its identity governance platform, C1 helps organizations strengthen oversight and accelerate secure AI adoption.
Shadow AI discovery works across two surfaces. In the cloud, C1 uses connectors to find unowned agents and map every MCP server, API, and data store that agent can reach. It flags long-lived keys and over-permissioned service accounts on sight. On the endpoint, C1 scans devices for local MCP configs, unsanctioned copilots, and API tokens sitting in plaintext in .env files. Cloud and endpoint findings land directly in the C1 platform, answering the question: what AI is running, and who owns it?
AI has multiplied the number of non-human identities (NHIs) inside the enterprise. The fastest-growing and least-governed NHI is the AI agent that authenticates on its own and accumulates its own credentials. Existing tools miss it. Privileged-access tools guard human sessions, endpoint tools watch processes, and data-loss tools watch sanctioned apps. Each one assumes an identity is a person or an approved app. IBM’s Cost of a Data Breach Report 2025 found that one in five organizations reported a breach due to shadow AI, and among those breached through an AI model or application, 97% lacked proper AI access controls.
For much of the market, governing shadow AI stops at detection: a list, a flag, a one-time block. In C1, a discovered agent, MCP server, or credential becomes a real access item on the same fabric as employee access. Teams assign an owner, route it through request and approval, certify it in a review, and de-provision it when it goes stale. Governance becomes a lifecycle instead of a switch, and every step is logged for auditors.
“Every CISO knows shadow AI is happening in their environment, and now especially on the endpoint,” said Alex Bovee, CEO and co-founder of C1. “Companies need complete visibility into AI, harnesses, and MCP use across their cloud and end user environments. It’s the only way to get control of the situation.”
With shadow AI discovery, security teams can protect against future attacks and prepare for what’s next. Teams can scale AI adoption with confidence, knowing users and agents can be productive and safe. Security improves when organizations can catch risks before they become incidents.
Related News:
C1 Launches Headless Identity Infrastructure Platform
Q&A: C1 Jeffrey Russell on Making Technology Modernization Secure
