Netwrix has announced new capabilities for Netwrix PingCastle and Netwrix Threat Manager designed to extend identity security deeper into the Microsoft cloud, including visibility into AI agent identities.

The company said organizations are deploying AI agents faster than they can govern them. Each agent operates as an identity with real permissions in an enterprise environment, yet many exist outside established inventory, ownership and review processes.

According to a Cloud Security Alliance survey cited by Netwrix, fewer than a quarter of organizations have a formally adopted policy for creating or removing the identities used by their AI systems. More than 16% do not track when a new AI identity is created.

Netwrix said its 2026 Data and Identity Security Report found a 43% breach rate among organizations where AI had significantly expanded the number of identities requiring access. That compared with an 11% breach rate among organizations where AI had not significantly expanded those identities.

PingCastle Expands Entra ID Coverage

Netwrix PingCastle now extends its Microsoft Entra ID coverage to 102 risk checks. The expansion extends the tool's Active Directory posture assessment capabilities into the cloud identity plane.

Security teams and administrators can assess identity risk across both on-premises Active Directory and Entra ID using the same prioritized approach.

Threat Manager Adds AI Agent Visibility

Netwrix Threat Manager adds visibility into AI agent identities in Microsoft Entra ID. The company said the capability provides security teams with an inventory of agents operating in their environments along with the access those agents hold.

Netwrix said only 19% of organizations fully govern non-human identities such as service accounts and AI agents.

Threat Manager already provides visibility and monitoring for service accounts through risk insights, abnormal-behavior detection and attack context. The latest release extends that coverage to AI agents.

The release also adds threat detection for Azure Files, with protection against ransomware, abnormal behavior and high-risk changes such as the creation of open access. Agent-specific threat detection is planned for a subsequent release.

"Earlier this year, we gave organizations visibility into what AI agents can access. This release goes a layer deeper: which agents exist at all," said Jeff Warren, CPO at Netwrix. "Our research found fewer than one in five organizations fully govern non-human identities, and agents are the fastest-growing category. You can't review access for an identity you don't know you have."

The new capabilities are intended to complement Microsoft's native tooling with independent assessment and visibility across the Microsoft identity plane.

Netwrix said the releases also advance its strategy to unify identity and data security. The PingCastle assessment engine already powers more than 200 checks within the company's 1Secure platform.

Netwrix PingCastle 4.0 and Netwrix Threat Manager 3.3 are available now.