You Vetted the Vendor. Nobody Vetted the Vendor's Agent.

Your procurement team did everything right. The vendor answered the 200-question security review. Legal redlined the data processing agreement. The SOC 2 report came back clean. The contract got signed, the renewal got calendared, and everyone moved on.

Then, somewhere between the signature and the renewal, the vendor shipped an AI agent into your environment in a routine product update. It reads your data, takes actions in your tenant, and calls models you've never evaluated. Nobody asked it a single question — because nothing in your third-party risk process knew it had arrived.

The agent that arrived without a purchase decision

Vendor-embedded agents aren't an edge case anymore; they're a revenue line. Salesforce reported Agentforce at $540 million in annual recurring revenue in its most recent quarter, up 330% year over year, with more than 18,500 deals closed since launch — 9,500 of them paid (Zacks, via Nasdaq). That's one vendor. Every major SaaS company is following the same playbook: the product you bought two years ago is becoming an agent platform, one release note at a time.

The security data says enterprises haven't caught up. In a Cloud Security Alliance survey of 418 IT and security professionals, 82% of organizations said they've found AI agents running in their environment that they didn't know about — and 40% of those shadow agents surfaced inside SaaS tools with built-in automation. Agents the vendor shipped, not agents your teams built. The same survey found 65% of organizations experienced at least one agent-related incident in the past twelve months, with data exposure leading the damage list at 61% (Cloud Security Alliance, April 2026).

Read those two trends together. Vendor agents are compounding at venture-scale growth rates. Visibility into them is a survey finding about failure.

Your TPRM program reviews the vendor, not the agent

Third-party risk management was built for a world where software held still between audits. A SOC 2 Type II report describes the vendor's controls over a review period. A security questionnaire describes the vendor's posture on the day someone filled it out. Neither describes what a piece of autonomous software is doing inside your tenant this afternoon.

The embedded agent slips through every gate in the process:

It isn't a new vendor, so it doesn't trigger onboarding review. It usually isn't a named subprocessor, so it doesn't trigger a DPA update. It arrived in a feature release, so it doesn't trigger a contract change. And your questionnaire — the one with 200 questions — almost certainly has no row for "does your product take autonomous actions in our environment, and how would we know if those actions changed?"

Scope drift doesn't trigger a re-review

Here's the part that should bother you most. Even if you cataloged every vendor agent today, the vendor can expand what that agent does in next month's release. New tool access, broader permissions, a different underlying model — shipped as product improvement, mentioned (maybe) in a changelog nobody in security reads.

Your review cadence is annual. Their ship cadence is biweekly. That gap is where scope drift lives, and no amount of questionnaire engineering closes it, because the questionnaire measures intent at a point in time and the agent is behavior over all of them.

Governing an agent you didn't deploy

You can't audit your way out of a runtime problem. Governing vendor agents takes the same three primitives as governing your own — applied to software you don't control.

Identity before access. An agent operating in your environment should prove what it is, who operates it, and what it's been delegated to do — cryptographically, not contractually. VeriSwarm Passport issues and verifies signed manifests (ES256 JWTs) for exactly this: a vendor agent presents a verifiable identity and a scoped delegation, and when the vendor changes what the agent is allowed to do, the manifest has to change with it. No valid manifest, no access. That turns "we found out in the postmortem" into "the credential didn't verify."

Judge behavior, not paperwork. The vendor's audit report tells you about the vendor. Trust scoring tells you about the agent. VeriSwarm Gate scores every agent on observed behavior — event by event, in real time — and applies policy tiers accordingly. A vendor agent earns trust the same way an in-house agent does: by behaving. When its behavior shifts after a release, its score shifts with it, and your policy tier decides what a lower-trust agent can still touch. Gate is the always-on foundation of the platform, and it's free.

Evidence that outlives the changelog. When something goes wrong, the vendor's release notes and your incident timeline will disagree. VeriSwarm Vault writes agent activity to an immutable, hash-chained audit ledger — so "what did the vendor's agent actually do, and when" is a query, not a negotiation.

The uncomfortable question to ask this quarter

Add one question to every vendor review, starting now: which agents does your product operate inside our environment, what can they do, and how will we know when that changes? The vendors building seriously will have an answer. The silence from the rest is your risk register.

Then stop relying on their answer. Inventory the agents acting in your environment — including the ones that arrived in a Tuesday release — and put them behind the same identity, scoring, and audit controls as everything else you run.

Gate is free and always on. Point it at every agent in your stack, especially the ones you didn't deploy. Get started at veriswarm.ai.