Product announcements and company milestones from GanVi Secure Monitoring.
CloudSentry AI now covers two new areas. AI Spend & Token Consumption reads token usage, read-only and without touching prompts or responses, from AWS Bedrock, Azure OpenAI and Google Cloud Vertex AI, estimates cost from list prices, and flags spend over a budget you set, sudden spikes, callers that match no registered agent, and models larger than the workload needs. The usage readings were checked against each cloud's own counts. SaaS AI Prompt Monitoring looks for prompt-injection, jailbreak and policy-bypass attempts in products such as ChatGPT, Claude and Microsoft 365 Copilot. It accepts prompt events from a platform's audit or compliance export through a secure API, checks each prompt against detection rules and discards the text, keeping only who, where, when and which rules matched; repeat offenders are surfaced as their own finding. The rules match known phrasing and can miss paraphrased attempts, so a clean result is not proof of safety. Direct connectors for Microsoft 365 Copilot, ChatGPT Enterprise and Claude Enterprise are planned.
Every connected cloud account on the Cloud Accounts page now carries a Connector notes column. Real failures appear in red; coverage notes — for example, a tagged resource that no discovered agent claims, or a protection that is configured at the project level rather than per agent — appear in amber, and they no longer interrupt routine inventory cleanup. The notes are replaced on every sync, so the page always reflects the latest run. The goal is simple: a clean dashboard should mean everything was checked, and when it does not, CloudSentry AI says so.
CloudSentry AI now remembers how far it has already read each AWS account's CloudTrail history. The first sync still builds the full 90-day picture; every sync after that reads only what is new, keeping a rolling 90-day record of the actions each agent role has actually performed. In internal testing on a pilot account, the first full collection took just over 16 minutes and the next sync completed in about 80 seconds, with the same agent and finding counts. The release also makes the connector's AWS access tokens refresh automatically during long collections, so large accounts no longer risk a sync that outlives its credentials.
CloudSentry AI's continuous compliance reporting now covers Azure subscriptions. It checks whether the subscription exports its Activity Log to a Log Analytics workspace and whether the workspace's retention meets the requirement for the data the agents handle — seven years for regulated classifications, one year otherwise. Subscriptions with no export are reported as a gap, because Azure keeps the log for only 90 days by default. Verified against a live Azure subscription, the check joins the AWS CloudTrail retention check already in production. The same release keeps standalone Azure AI Content Safety accounts out of the agent inventory and reports them as a subscription-level note instead.
Until now, an agent's data sensitivity came from a tag someone put on the agent itself. CloudSentry AI now also resolves it from the data the agent can reach: if an agent has access to an object-storage bucket or storage account labeled confidential, the finding says so, and names the resource. The check works on AWS, Azure and Google Cloud and was verified live on each, and it fires on that evidence alone — no outbound traffic is needed for the risk to show up. Findings now identify the specific bucket or account involved, so the fix is clear from the finding itself.
Agents, like accounts, should not live forever without someone vouching for them. CloudSentry AI now records who recertified an agent and when, and flags any agent that has gone more than 90 days without a fresh confirmation of its continued need, access, tools, model and data usage. The workflow is the same on every cloud, because it tracks governance decisions rather than provider telemetry, and a new recertify panel on each agent makes the review a single step for the owner.
CloudSentry AI now compares what each agent is allowed to do with what it has actually done. Using 90 days of audit-log history from AWS CloudTrail, the Azure Activity Log and Google Cloud Audit Logs, it flags permissions that have been granted but never used, a practical starting point for trimming access without guessing. The comparison waits until an agent has a full 90 days of history before evaluating, so a brand-new agent is never penalized for not having done everything yet. Updated client permission guides list the exact read-only access each cloud needs.
Not every finding needs action today, and security teams need a way to say so without losing the record. CloudSentry AI now lets authorized users suppress a finding with a stated reason, review everything currently suppressed in a dedicated Ignore List view, and lift a suppression at any time. Every suppression keeps who, when and why, and the on-demand compliance report includes a section for suppressed findings, so accepted risk is documented rather than hidden.
CloudSentry AI now checks whether each agent's model sits behind the cloud provider's own prompt-attack protection: the attached guardrail and its prompt-attack filter on AWS Bedrock, and the project-level Model Armor setting on Google Cloud. An agent with no protection in place is a finding on its own, with no invocation logging required. The release also adds discovery of AWS Bedrock AgentCore Runtime agents — the platform newer AWS accounts use by default — so these agents appear in the inventory alongside classic Bedrock agents.
CloudSentry AI now reads actual network-egress and audit-log data from AWS (VPC Flow Logs, CloudTrail, CloudWatch) and Google Cloud (VPC Flow Logs, Cloud Audit Logs), replacing manual endpoint tagging. Egress to external AI services, runtime call-volume baselines, inactive-agent detection and compliance evidence now come from what the agents actually did. Scheduled syncs also run in the background, so a large account no longer freezes the dashboard while it is collected.
The Compliance page generates a PDF report on demand that maps CloudSentry AI's findings to the controls auditors ask about: NIST AI RMF 1.0, SOC 2 Trust Services Criteria, ISO/IEC 27001:2022 Annex A, GDPR and, new this release, CIS Controls v8.1 with its AI Companion Guides. Each framework section shows which controls are affected by open findings, so evidence for an AI governance review can be produced in minutes instead of assembled by hand.
Agent memory is a data store, and CloudSentry AI now treats it like one. It reads memory configuration and retention directly from AWS Bedrock AgentCore Memory, flags memory kept longer than policy, and flags long-term memory records with no expiration that have aged past policy. Readers for Azure AI Foundry Memory Stores and Google Vertex AI Memory Bank follow the same model. The retention limit is resolved per agent, then per data classification, then per tenant, so each organization can set a policy that matches its own obligations.
CloudSentry AI now supports sign-in through Okta and PingOne, alongside Microsoft Entra ID, with each client organization keeping its own directory and its own isolated tenant. Users are provisioned automatically on first sign-in, and each tenant's administrators manage their roles. Both integrations have been verified end to end against live identity-provider environments.
GanVi Secure Monitoring today announced that CloudSentry AI now evaluates the full catalog of 20 AI agent risk use cases with real, live data from connected cloud accounts and internal governance workflows — spanning inventory and discovery, access and identity controls, data protection, behavioral security, infrastructure guardrails, and continuous compliance reporting. The expansion adds coverage for human-in-the-loop approval workflows, incident response tracking, approved model and platform enforcement, data residency verification, and infrastructure-as-code guardrails, giving customers a single platform that spans the full lifecycle of AI agent risk rather than a narrow slice of it.
CloudSentry AI now discovers and monitors AI agents running on Google Cloud Platform, joining existing support for Microsoft Azure and Amazon Web Services. The new GCP connector uses Cloud Asset Inventory to identify native Vertex AI resources alongside custom agent frameworks running as labeled service accounts, Cloud Run services, or GCE instances — giving customers a single, unified inventory across all three major clouds instead of a separate tool per provider. Read-only by default, the connector requires only the cloudasset.viewer IAM role to begin discovery, with remediation actions gated behind explicit human approval.
GanVi Secure Monitoring today launched CloudSentry AI, a multi-cloud, multi-tenant platform purpose-built to give security and compliance teams continuous visibility and control over autonomous AI agents. As organizations move AI agents into production faster than governance programs can track them, CloudSentry AI closes the gap with continuous, automated discovery across Azure, AWS, and GCP, a growing catalog of built-in risk use cases, and a human-approval workflow for every high-risk remediation action. “Most organizations can't answer a basic question today: how many AI agents do we actually have running, and what can each one touch,” said GanVi Secure Monitoring. “CloudSentry AI exists to make that question answerable, continuously, without slowing down the pace of AI adoption that makes it valuable in the first place.”
