ThreatDown expands security visibility to AI tools and machine identities

ThreatDown has announced a synchronized expansion of its AI and identity security capabilities to protect organizations from emerging, unmanaged risks. The company launched AI visibility, giving security and managed service provider (MSP) teams a full inventory of the AI tools running across their environments, while simultaneously extending its ITDR capabilities to secure non-human identities (NHI).

By bringing governance to service accounts, API tokens, OAuth credentials, and machine identities, ThreatDown helps close critical exposure points that now outnumber human users but lack oversight.

These two additions address both sides of the problem: the AI activity teams cannot see, and the machine identities they cannot govern. ThreatDown delivers both on the platform teams already run, with no separate console, agent, or additional dedicated security staff.

According to ISACA’s 2026 AI Pulse Poll, 90% of professionals reported that employees use AI at work, sanctioned or not, while just 38% of organizations have a formal AI policy. The proliferation of unauthorized tools handling unmanaged corporate data has led to an exponential rise in non-human identities (NHIs). This trend presents a critical security gap. According to the Cloud Security Alliance, a mere 12% of organizations are confident in their ability to thwart NHI-related attacks.

“Shadow AI is the next major blind spot for security teams, and most organizations haven’t even started thinking about the identities behind AI activity,” said Kendra Krause, General Manager of ThreatDown. “ThreatDown brings both into view on the platform teams already use, without adding complexity, to provide visibility into the AI tools active in their environment.”

As the first set of capabilities in ThreatDown AI Detection and Response, AI visibility gives teams sight into AI application use across the organization. The dashboard details each tool’s name, category, platform, vendor, version, and endpoint count, and shows exactly which devices access which tools. Teams can baseline AI usage and catch shadow AI before it triggers a data breach or compliance failure.

Extending ThreatDown Identity Threat Detection and Response brings the same visibility to non-human identities. It tracks service accounts, API tokens, OAuth credentials, and machine identities, revealing each one’s ownership, age, and privilege level. Teams govern a second class of identities without standing up a separate identity security product.

Detection and response must keep pace with AI-driven attacks. ThreatDown layers detection across endpoints, identities, and AI activity, drawing on more than 20 years of machine-learning telemetry to catch threats by behavior rather than signature. Its 24/7 MDR adds expert human analysts, who deliver a 5-minute median time to detect and a 19-minute median time to respond.

Now ThreatDown is adding a new layer to the console: ThreatDown AI, an intelligent assistant that turns complex security data into plain-language guidance and recommended actions that admins review and confirm before execution, giving every admin senior-analyst clarity without the headcount.

These capabilities address the exact threats tracked in ThreatDown’s new report, Cybercrime in the age of AI. The research found over 6,000 AI models published openly on Hugging Face, advertised as guardrail-free, and downloaded more than 22 million times in a 30-day period. The attack surface shifts daily, and visibility into AI activity and machine identities cannot wait.