Hundreds or thousands of new AI agents get built inside organizations every month, and keeping track of all of them, let alone what each one can do, is more than a governance team can manage by hand. An agent’s risk depends on its function and purpose. Two agents built on the same model can differ by ten times in risk, depending only on what they can reach, such as which files they can open, which systems they can call, and whether they can send a message or spend money before anyone reads the output. Trustible’s Agent Scanner finds every agent across your AI platforms and scores its risk automatically.
What makes an AI agent risky
An AI agent’s risk comes from its capabilities, or the specific instructions and attributes it’s been given permission to do. Trustible groups those into 18 capability types within 4 categories: local machine and desktop access, external services and integrations, agent-specific behavior like memory and sub-agents, and capabilities whose actions are hard to reverse, like payment access and robotic control. Trustible’s new white paper walks through all eighteen capabilities and what each one means for governance, available here. It’s also the list Agent Scanner checks against every time it finds an agent.
Agent volume has outgrown manual review
Employees build agents directly on citizen developer platforms, and most organizations now have hundreds or thousands of them with little oversight. A governance team built for a dozen reviews a month can’t keep pace with that by hand, especially when a single manual review still takes ~6.5 hours on average.
Trustible’s Agent Scanner connects into the platforms where these agents are created, including Amazon Bedrock AgentCore, Microsoft Foundry, Microsoft Copilot Studio, Google Cloud’s agent platform, and Claude Enterprise. From there, it scans every connected platform for the agents your teams have built and lists them in your AI inventory.
How the Agent Scanner scores risk
Agent Scanner scores every discovered agent across 5 risk categories — performance, data privacy, cybersecurity, ethical, and legal — following the assessment framework was built by Trustible’s AI research and policy experts. Low-risk agents may not need a review at all, whereas the ones with real risk get flagged and routed into governance. Every score can be confirmed or overridden, and either way the reviewer always documents the outcome.
Each new scan surfaces agents that are new, retired, or changed. When Agent Scanner detects a change, like a new connector or an updated instruction set, it shows what moved and whether it should trigger a new review or pass through without one. See how Agent Scanner finds, scores, and governs every agent in your connected developer environments. Explore Agent Scanner →