Best Practices for Building Agents Recap
Arthur

New: open source scanner for shadow AI agents

Complete visibility of your entire agent attack surface.

Deckard makes it easy to conduct routine scans of endpoints, cloud providers, and managed agent platforms to build a constantly updating inventory of every agent running at your organization.

Download from GitHub
Agent inventory Last scan 2 min ago

1,284

Agents found

213

Unregistered

4

Vectors

AgentSourceStatus
invoice-reconcilerAWS BedrockKnown
claude-code (jdoe-mbp)Endpoint, OSQueryUnregistered
support-triage-v2Google VertexKnown
crm-sync-agentOpenAI Agents APIUnregistered
unknown → api.anthropicNetwork logsUnregistered
contract-reviewerClaude ManagedKnown
Streaming to SIEM Connected

Close the blind spot

The first step to securing agents is to find them.

Agents fail by accident, get manipulated by the people they serve, and get built to attack. The damage already runs into the millions, and it grows with every new deployment.

Arthur helps you keep moving fast on AI while keeping risk in check.

Paste into Claude Code or Codex

Download https://raw.githubusercontent.com/arthur-ai/deckard/main/docs/agent-setup/prompt.md with curl, read all of it, and follow its instructions to set up Arthur Deckard on this machine.

Scan your entire organization

Bring agents out of their shadows.

The first comprehensive scanner that finds every agent running in your environment.

Endpoints

Deckard includes a comprehensive set of OSQuery signatures, the leading endpoint scanner used by security teams everywhere. These signatures are constantly updated by our agent software factory. They can be easily deployed by organizations using popular fleet and mobile device management platforms.

CrowdStrikeNinjaOneJamfNightfall+ more

Your Cloud

A robust set of integrations is available, with leading cloud providers including Google Vertex, AWS Bedrock, and Azure Agent Foundry.

Google VertexAWS BedrockAzure Agent FoundryOpenAI Agents APIClaude Managed Agents+ more

SIEM

Deckard connects to your SIEM and searches your existing logs for signs of agent activity, using data you already collect.

SplunkElasticMicrosoft SentinelGoogle Security OperationsIBM QRadar+ more

Network & Gateway

Deckard uses network logs to identify agents using LLMs and other agentic resources.

AWS Network LogsGoogle Cloud Network LogsF5Zscaler+ more

Built for your SOC

Agent data in your SIEM, at your fingertips.

Deckard reads application logs from your SIEM, including OTEL OpenInference data, so you can see how your agents evolve over time.

Routine scans

Endpoints, cloud providers, managed platforms, and network logs.

Living inventory

A constantly updating record of every agent at your organization.

Investigate and act

Security teams identify rogue agents and take action.

Get started, free and open source

Find out which agents are running in your organization today.

Run your first scan in minutes. The docs walk you through deploying signatures to your fleet and connecting your cloud and agent platforms.

The Arthur platform

Visibility is the first step. Arthur takes you the rest of the way.

Once you know what's running, Arthur will help you operationalize governance across every agent and enforce runtime security in production.

  • Governance

    Policies, ownership, and approval workflows for every agent in your inventory.

  • Runtime security

    Detect and block risky agent behavior as it happens.

  • Observability

    Traces, evals, and cost across every agent in production, with behavioral analytics that show how each agent performs over time.

Talk to an AI Expert