First scan
cursor-agentFound on 3 laptopsNewcrm-mcpMCP server in a repo configNew
svc-reportingService account, no ownerNew
[01]
First Map
The first complete scan. Every agent and machine identity in one picture, including the ones nobody expected.
Book a demo
PLATFORM
Platform overviewGuardrailsAttack paths guideZero Shadow ClubUSE CASES
Coding agentsMCP serversOAuth appsService accountsACADEMY
All Academy topicsNon-human identitiesAI agent securityMCP securityAttack paths and reachPRICING
PricingRESEARCH
ResearchAgent Incident DatabaseAgent Reach MatrixAgent Reach CalculatorMCP Server DatabaseAttack paths guideBook a demoThe Zero Shadow Club. Reach it, then hold it.
A club for teams that reach a specific state and hold it: every agent they run has an owner, no shadow agent is left open, and every remaining path to sensitive data is there because somebody decided it should be. Three criteria, four badges on the way.
Book a demoWhat is a shadow agent
KEY TAKEAWAYS
- Three criteria, all at once: every agent owned, no shadow agent open, no path to crown jewels without a reviewed decision.
- All three are measured in the product, not self-declared. Ownership, decisions and the activity trail are the evidence.
- Four badges mark the way: First Map, Every Agent Owned, Zero Shadow, First Breakpoint.
- Membership is a state, not a certificate. New agents appear weekly, so it is checked rather than awarded once.
Three criteria. All of them, at the same time.
Each one is deliberately hard to satisfy by paperwork alone.
Every discovered agent has a confirmed owner.Not a team in a wiki. A named person who can say what the agent is for and answer for its access. An agent whose owner has left does not count.
No shadow agent is left open.Every agent found through OAuth consents, MCP configuration, CI workflows or key usage has been either adopted with a scoped identity or removed. Finding one and leaving it is not adoption.
No path to crown jewels without a reviewed decision.Where an agent can still reach customer data or production, somebody looked at that path and decided to keep it, with a date. The requirement is a decision on the record, not the absence of access.
BADGEScursor-agentFound on 3 laptopsNew
Four badges on the way.
Most teams collect them in this order. The second one takes the longest and changes the most.
cursor-agentFound on 3 laptopsNewOwnership
cursor-agentOwner: platform team leadOwned
crm-mcpOwner: revenue opsOwned
svc-reportingOwner: unassignedOpen
[02]
Every Agent Owned
Every discovered agent carries a named owner. This is usually the slowest badge and the one that changes the most behaviour.
Open shadow agentsHeld
0Found 12
1Owned 7
2Scoped 11
3Zero
[03]
Zero Shadow
No unadopted agent is open. Reached once, then held: the badge lapses if a new shadow agent sits unresolved.
Paths to customer data
cursor-agent pathClosed by scoping prod-deployClosed
ci-runner pathSame change, same pathClosed
crm-mcp pathReviewed, kept with an ownerDecided
[04]
First Breakpoint
A path to sensitive data closed by one deliberate change, with the paths before and after on record.
THE PATH
How teams get there. Four steps.
None of this is a product tour. It is the order the work actually happens in.
01Map what exists
Connect the sources agents leave traces in and get the first picture. Most teams find agents here that were not on any list.
02Assign owners
Work down the list by reach, not alphabetically. The agents that can touch production get an owner first.
03Close or decide
For every remaining path to sensitive data: close it, or record the decision to keep it and who made it.
04Hold it
The club is a state, not a certificate you keep after it stops being true. New agents appear weekly, so membership is checked, not awarded once.
HONESTLY
Where the club stands today
The club is opening now, with the first design partners. There is no membership list on this page because there is nothing honest to put on it yet, and a programme that starts with invented members is worth less than one that starts empty.
What exists today is the standard: three criteria that can be checked against a real environment rather than a questionnaire, and four badges that mark real progress toward them. If your team wants to be among the first, the way in is a map of what you run.
STATUS
Opening with the first design partners. No members to show yet.
FAQ
Questions, answered.
The criteria, how membership is held, and where it stands today.
What are the criteria for joining?
Three, and all of them at once: every discovered agent has a confirmed owner, no shadow agent is left open, and no path to crown jewels exists without a reviewed decision behind it. All three are measurable in the product, which is the point. Nothing here depends on an opinion.
Does membership expire?
It lapses rather than expires. The criteria describe a state, and new agents appear every week, so membership is checked continuously rather than awarded once. A new shadow agent that sits unresolved takes the state away until it is handled.
Can we join before we are customers?
The criteria are checked against a real environment, so in practice it starts with a map of that environment. The club is opening now with the first design partners, so there is no membership list to show yet. We would rather say that than invent one.
What it is built on.
The club measures three things. These explain them.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.
Book a demoRead the attack path guide