Data protection provider HYCU has introduced aiR Graph, a new, free tool designed to provide organizations with visibility into the complex web of AI agents and copilots operating within their environments. As enterprises rapidly integrate AI-driven automation into their workflows, the tool aims to address the significant security and data integrity risks posed by agents that often operate with broad, unchecked permissions.
Mapping the AI Attack Surface
The aiR Graph tool functions by connecting to identity providers, specifically Microsoft Entra ID and Okta, to perform a read-only discovery of all AI agents and copilots currently active within an organization. By mapping these identities, the software identifies which applications the agents can access, what data they possess the authority to read or modify, and whether they are configured for unattended operation. The tool also tracks ownership, ensuring that every agent has an assigned sponsor, which is a critical step in maintaining governance over automated systems.
Simon Taylor, founder and CEO of HYCU, emphasized that the proliferation of these agents has outpaced the ability of IT teams to maintain oversight. Without visibility into what these agents can reach, organizations are effectively blind to potential data corruption or unauthorized deletion events. By highlighting which agents have write or delete permissions on systems of record, aiR Graph provides a necessary risk assessment that allows security teams to prioritize their defense strategies.
Bridging the Gap Between Visibility and Resilience
A core feature of the new offering is its ability to perform a gap analysis between agent permissions and existing backup coverage. The platform identifies which applications are being interacted with by agents but currently lack an independent, immutable backup. This insight is intended to direct backup resources toward the most exposed systems, ensuring that if an agent malfunctions or is compromised, the organization can restore its data to a known-good state.
Unlike some AI-driven tools that rely on opaque machine learning models for risk assessment, HYCU has opted for a rule-based approach. According to Anant Chintamaneni, Chief Product Officer at HYCU, the system uses explicit rules applied directly to data extracted from identity providers. This ensures that findings are deterministic, traceable, and audit-ready, providing security teams with the transparency required for board-level reporting.
Integration and Future Scope
The aiR Graph tool is designed to be extensible, with plans to incorporate additional discovery sources beyond Entra ID and Okta in the future. While the tool is available to all organizations regardless of their current relationship with HYCU, it is specifically designed to integrate with the company’s R-Cloud platform. Once risks are identified, organizations can leverage R-Cloud to implement immutable backups for the identified workloads, effectively closing the loop on cyber-resilience.
As AI agents move from experimental deployments to critical components of enterprise infrastructure, the ability to audit their scopes and ensure they are backed by robust data protection strategies is becoming a primary concern for IT leadership. By providing a clear, actionable map of agentic activity, HYCU is positioning its new tool as a foundational element for organizations looking to secure their data against the risks of high-speed, automated environments.
