Discover AI agents and related components across enterprise endpoints, build a unified asset inventory, and identify security risks—such as shadow AI usage, prompt leakage, and unauthorized access—introduced by productivity tools like OpenClaw. You can then enforce control policies to keep AI applications secure and compliant.
Scan AI assets
Scan endpoints for installed AI agents and related components, build an asset inventory, and discover assets that pose security risks.
Start a scan
Log on to the Secure Access Service Edge console.
In the left-side navigation pane, choose Agent Office Security > AI Asset Management.
On the AI Asset Management page, turn on the Asset Scan toggle in the upper-right corner to enable asset scanning.
Click Configure next to the Asset Scan toggle. In the Quick Scan Configuration dialog box, configure the following parameters.
Parameter
Description
Enable Agent Detection Scan
Turn on the toggle to enable the scan task.
Enable Agent Security Scan
When enabled, the system also scans skills associated with AI agents on endpoints.
Enable Session Scan
When enabled, the system scans agent behavior logs. For information about how to view and download the logs, see Log audit.
Scan Scope
Select the scan scope. Valid values: All Users and Specific User Group.
Click Start Scan.
View scan results
After the scan completes, click Visual Analytics in the upper-right corner of the AI Asset Management page to view the Top 5 AI Asset Installations and Pending Threats charts.
Click List in the upper-right corner of the AI Asset Management page, and then switch between the AI Agents, LLMs, Tools, and Skills tabs at the top of the page to view details of each asset type, including the number of associated employees and devices. Click the number in the Terminal Count or Employee Count column to view the associated details.
Export asset data
To export scan results for offline analysis or compliance auditing, perform the following steps on the AI Asset Management page:
Click List in the upper-right corner of the AI Asset Management page. Switch to the AI Agents, LLMs, Tools, or Skills tab.
Click Export Threats and select an export method:
Export All: Exports all assets under the current tab.
Export by Search Conditions: Exports only the assets that match the current search filters.
Click Export Task to view all export tasks, locate the target task, and download the results.
Configure runtime protection
Supported in client version 5.2.7 and later.
Log on to the Secure Access Service Edge console.
In the left-side navigation pane, choose Agent Office Security > AI Asset Management.
On the AI Asset Management page, click Runtime Protection in the upper-right corner.
Parameter
Description
Skills Protection
Detects and isolates malicious skills called by an agent to prevent third-party plug-ins or tool chains from injecting malicious logic, stealing data, or performing unauthorized operations. You can specify a handling action for each of the built-in High, Medium, and Low risk levels. Valid handling actions: Monitor and Block.
Prompt Protection
Detects and blocks prompt injection attacks, jailbreak attempts, and malicious instructions that target an AI agent, and prevents the agent from being induced to perform operations beyond its authorized scope. You can specify a handling action for each of the built-in High, Medium, and Low risk levels. Valid handling actions: Monitor and Block.
Sensitive Data Detection
Detects sensitive data read by an agent in real time to prevent data leaks. Click Configure next to Monitor and Block to select the data identification rules to apply. Files that match a selected rule are selected. Only rules that apply to file content are supported. For more information, see Configure data classification rules for outbound files.
Scope
The users and devices for which runtime protection takes effect. You can specify the scope by Specific User Group, Specific Device Tag, or Specific Device, or select All Users.
After you click Ok, the policy is delivered to the specified devices.
You can then view the related logs in Security Operations > Log Audit.
Configure control policies
Supported in client version 5.2.7 and later.
After identifying AI assets that pose security risks, select control measures based on risk severity.
On the AI Asset Management page, click Control Policy in the upper-right corner.
You are redirected to the Agent Control Policy page, where you can configure a control policy as described in Agent control policies.
Free trial
For information about the free trial, see Apply for a free trial.