TL;DR: Contain the damage first, finish the inventory second. Models now find and use weaknesses faster than defenders can patch them, so blast-radius controls beat complete discovery. The same shift came up on three separate security calls inside eight days in August 2026. Counting your AI agents still counts. It just can't be the thing you wait on.
Security has one saying that's been true for twenty years. You can't protect what you don't know is out there.
I've said it. I've probably said it on stage. And in August 2026 I watched a group of security leaders agree that it's no longer the right place to start.
What does containment over enumeration mean?
It means you build limits on damage before you finish the list of what you own. Enumeration is finding everything. Containment is making sure no single thing can hurt you much. When attackers move faster than your discovery cycle, the second one pays off sooner and the first one never quite finishes.
This isn't new thinking in security. It's the same logic behind segmentation and least privilege, which have been Zero Trust practice for years. What changed is the timing.
An AI model can find a weakness and use it faster than a normal remediation cycle closes. Your inventory project takes a quarter. That's the whole argument in two sentences.
The phrase came up as "containment over enumeration" on a security call in August 2026, and the security leaders on it adopted it on the spot. It was the third time the same shift had surfaced in eight days.
Why doesn't the count-everything-first approach work for AI agents?
Because the population changes faster than you can count it. Agents get created in a chat window and disappear a few minutes later. New ones show up through tools your team already approved. By the time a discovery scan finishes, the answer it gives you is about last month.
I hear "no real inventory" on a lot of calls. It's usually said as a confession. It shouldn't be.
What actually goes wrong is a sequencing mistake. A team decides inventory is step one. Then it funds a discovery project and puts every control decision behind that project. Nine months later they have a number nobody trusts and no controls. The agents that worried them at the start have been replaced by different agents.
Meanwhile the containment work they could've done in the first month, like separating agent identities from human ones and capping what any single agent can reach, would still be protecting them today.
What are the controls that limit an AI agent's blast radius?
Blast radius is how much damage one agent can do before somebody stops it. You shrink it with five things, none of which require a complete inventory to start.
A separate identity per agent. Not a shared service account, and not the launching human's credential. If an agent runs as a person, its reach is that person's reach and you can't tell their actions apart afterward.
A ceiling on what any agent can reach. Set the maximum before you know what each agent needs. No agent touches production data by default. No agent gets write access to a system of record without a specific grant.
A stop that works fast. Somebody can shut off one agent, or all of them, without a change ticket. Test it, because the number of teams who have this on paper and not in practice is high.
A log the agent can't edit. What it did, what it touched, when it happened, and under whose authority. This is what makes the difference between an incident and a mystery.
A network path that funnels. Agents reach outside systems through one route you control rather than however each tool prefers. That single route is where a policy can actually be applied.
Every one of those is deployable against agents you haven't found yet, because they're properties of the environment rather than properties of the list.
Does inventory still count?
Yes, and I want to be careful here because this argument gets flattened into "don't bother counting." That's wrong. You'll need the inventory. What changes is that inventory becomes a continuous measurement, not a prerequisite.
A security leader I spoke with in 2026 reframed it well. Measure coverage instead of chasing completeness. Percentage of agents with their own identity. Percentage running through the controlled path. Those numbers move every week, and they're useful even when the total is unknown.
Another line from a 2026 call has stayed with me. If you can't measure fundamentals today, the first investment is measurement, not more AI. That applies here exactly. Count what you can see. Publish the percentage and let it climb.
Coverage is also a number you can show a board without pretending. A sentence like "84% of the agents we know about run with their own identity" is honest and improvable. A flat total like "we have 412 agents" is a claim you'll have to defend when it moves.
How do you decide what to contain first?
Rank by what an agent can reach and how fast it acts. Then weigh that against impact and reversibility, meaning how bad the damage is and whether you can undo it. Security leaders named those properties on 2026 calls, and I've used them since. An agent with broad reach that acts without a human check on something expensive is your first job, whether or not it's on any list.
Practically, that means you don't need discovery to know where to start. Ask your engineers two questions. Which agents touch money. Which agents can change something a customer sees.
You'll get five names. Those five are the program.
The temptation is to do the reverse and start with the easy ones, because the easy ones close fast and look like progress on a slide. That instinct produces a clean report and no protection.
I'd also skip the products promising to automate all of this. A security leader in 2026 put it flatly: an autonomous system that runs your security operations by itself doesn't exist. What exists is a set of controls that limit damage while humans decide, and those are available now.
What can you do in the next week?
Name your five highest-impact agents. Ask engineers, not tools. Rank by reach, speed, impact, and whether you can undo it.
Check whether any of them run as a person. That's the single highest-value finding you'll get this week.
Test one kill switch for real. Pick an agent, shut it off, time it. Then find out what else broke.
Publish one coverage number. Any one. Percentage of known agents with their own identity is a good first pick.
Set a default ceiling. Write one sentence saying what no agent gets without a specific grant. It applies to agents you haven't met yet, which is the point.
Key takeaways:
Containment over enumeration came up on three separate security calls inside eight days in August 2026 and was adopted as a strategic shift.
Models find and use weaknesses faster than defenders remediate, so limiting damage pays off before finishing discovery does.
Blast-radius controls like per-agent identity, default reach ceilings, tested kill switches, and unalterable logs all work against agents you haven't found.
Replace completeness with coverage: report the percentage of agents under each control rather than a total count you can't defend.
Rank what to contain by reach, speed, impact, and reversibility, which you can determine by asking engineers rather than running a discovery project.
Frequently asked questions
Isn't "you can't protect what you don't know is out there" still true?
It's true and it's no longer a good starting instruction. Discovery is slower than agent creation, so treating it as step one means the controls never ship. Run discovery continuously in the background while containment work goes first. The order changed, not the value.
How is this different from just doing least privilege?
Least privilege is one of the controls, and it's the one most teams already know. Containment is the wider goal. It also covers a per-agent identity, a working stop, a log the agent can't change, and a single network route out. Least privilege limits what one agent may do. Containment limits what happens when the limit fails.
What if leadership wants a total number of AI agents?
Give them a coverage percentage and an honest known count with the word "known" attached. Boards accept partial numbers with a trend line better than most security teams expect. What they don't accept is a confident total that moves sharply next quarter.
Does containment work against prompt injection?
It reduces the damage rather than preventing the attack. There's no reliable filter that blocks malicious instructions hidden in content an agent reads. So the working defense is what the agent can reach after it's been fooled, which is a containment question rather than a detection one.
Where does Zero Trust fit into this?
Zero Trust is the foundation this rests on. Verify every request and grant the least access needed. Assume something inside is already compromised. Agents need one more check on top of that foundation, which is a judgment about how much autonomy this particular agent has earned.
How long does containment work take compared to inventory?
Setting a default reach ceiling and separating agent identities is weeks of work for most teams, because both extend systems you already run. A full agent inventory has taken clients two or three quarters and still comes back incomplete. That difference in timeline is the entire reason to reverse the order.
I've spent years telling people to find everything first. I was giving advice calibrated to a slower attacker, and the attacker got faster while the advice stayed the same.