Netwrix has unveiled new functionalities in its identity security tools, Netwrix PingCastle and Netwrix Threat Manager, enhancing protection within the Microsoft cloud environment and extending support to AI agents.
As businesses increasingly rely on AI agents, each agent represents an identity with real permissions within corporate infrastructure, often without being accounted for in inventories or governance processes.
Identities Needing Access
A survey by the Cloud Security Alliance revealed that less than 25% of organizations have formal policies for managing AI system identities, and over 16% fail to track when new identities are created. According to the 2026 Data and Identity Security Report from Netwrix, organizations that experienced substantial AI-driven expansion of identity access saw breach rates of 43%, compared to 11% in those where such growth was limited.
Netwrix PingCastle has expanded its capabilities to perform 102 risk checks within Microsoft Entra ID. This enhancement allows security teams to assess identity risks both on-premises and in the cloud using the trusted Active Directory posture assessment, which has been well-received in the community.
Actionable Risk Insights
The updated Netwrix Threat Manager tool now offers enhanced visibility into AI agent identities
The updated Netwrix Threat Manager tool now offers enhanced visibility into AI agent identities within Microsoft Entra ID, providing an inventory of agents in a company’s system and the access levels they hold.
The need for effective governance is significant, as Netwrix found only 19% of organizations fully control non-human identities like service accounts and AI agents. The Threat Manager already supports the monitoring of these identities with risk insights, detection of abnormal behavior, and context in the event of attacks, now including AI agents.
Agent-Specific Threat Detection
Further updates to Netwrix Threat Manager introduce new threat detection capabilities for Azure Files, aiming to protect file shares from ransomware, abnormal activities, and risky changes such as the establishment of open access. Future releases are set to incorporate agent-specific threat detection, capitalizing on the foundational visibility provided in the current update.
These innovations serve as a complement to Microsoft's own solutions by offering independent assessments and visibility throughout the Microsoft identity ecosystem. Jeff Warren, CPO at Netwrix, stated, "Earlier this year, we gave organizations visibility into what AI agents can access. This release goes a layer deeper: which agents exist at all." He noted the rapid growth of non-human identities, emphasizing, "You can't review access for an identity you don't know you have."
Independent Posture Assessment
The launch of these features underscores Netwrix's commitment to integrating identity and data security.
The PingCastle assessment engine, supporting over 200 checks within the 1Secure™ platform, exemplifies an independent posture assessment strategy now extended further into the Microsoft identity domain. The latest versions, Netwrix PingCastle 4.0 and Netwrix Threat Manager 3.3, are currently available for users seeking enhanced security capabilities.
Netwrix, a recognized pioneer in identity and data security, announces new capabilities across Netwrix PingCastle and Netwrix Threat Manager that extend identity security deeper into the Microsoft cloud, including coverage of AI agents.
Organizations are deploying AI agents faster than they can govern them. Each agent is an identity holding real permissions inside the enterprise environment, yet most exist outside any inventory, ownership, or review process.
Identities needing access
A Cloud Security Alliance survey found that fewer than a quarter of organizations have a formally adopted policy for creating or removing the identities their AI systems run on, and more than 16% don't track when a new one is created at all. The consequences are measurable: in its 2026 Data and Identity Security Report, Netwrix found a 43% breach rate among organizations where AI had significantly expanded the number of identities needing access, compared with 11% where it hadn't.
Netwrix PingCastle extends its Microsoft Entra ID coverage to 102 risk checks, extending the tool's trusted Active Directory posture assessment into the cloud identity plane. Security teams and administrators can now assess identity risk across both on-premises AD and Entra ID with the same fast, prioritised approach that has made PingCastle a community favorite.
Actionable risk insights
Netwrix Threat Manager adds new visibility into AI agent identities in Microsoft Entra ID, giving security teams an inventory of the agents operating in their environment and the access they hold.
That inventory is the missing foundation for most organizations: the Netwrix report found only 19% of organizations fully govern non-human identities such as service accounts and AI agents. Threat Manager already provides visibility and monitoring for another critical non-human identity category, service accounts, through actionable risk insights, abnormal-behavior detection, and attack context for faster triage; this release extends that coverage to AI agents.
Agent-specific threat detection
The latest Netwrix Threat Manager release also adds new threat detection for Azure Files, protecting file shares against ransomware, abnormal behavior, and high-risk changes such as the creation of open access. Agent-specific threat detection is planned for a subsequent release, building on the visibility foundation delivered today.
The new capabilities complement Microsoft's native tooling with independent assessment and visibility across the Microsoft identity plane.
"Earlier this year, we gave organizations visibility into what AI agents can access. This release goes a layer deeper: which agents exist at all," said Jeff Warren, CPO at Netwrix. "Our research found fewer than one in five organizations fully govern non-human identities, and agents are the fastest-growing category. You can't review access for an identity you don't know you have."
Independent posture assessment
These releases advance Netwrix's strategy to unify identity and data security. PingCastle's assessment engine already powers more than 200 checks within the company's 1Secure™ platform, reflecting the same independent posture assessment approach now extended deeper into the Microsoft identity plane.
Netwrix PingCastle 4.0 and Netwrix Threat Manager 3.3 are available now. To learn more, book a meeting with the Netwrix team.
