hardware processors configured by machine-readable instructions to:

assess the identity infrastructure with a discovery agent element configured to assess authorized network traffic within the identity infrastructure, including monitored and unmonitored network traffic, wherein at least a portion of the identity infrastructure is known and a portion of the identity infrastructure is unknown, and wherein the known and unknown identity infrastructure comprises identity domains and identity infrastructure elements, wherein the discovery agent element is installed on or adjacent to the identity infrastructure elements, and wherein the identity domains comprise identity domain elements;

identify, by the discovery agent element, one or more infrastructure elements within the identity infrastructure;

intercept, by the discovery agent element, first authorized network traffic in the identity infrastructure, wherein the first authorized network traffic comprises requests for identity data or identity metadata from the one or more infrastructure elements within the identity infrastructure, wherein the identity data comprises a user identity, a user credential, or a user attribute for one or more users of the identity domains, and the identity metadata comprises a list of identity infrastructure elements, configuration, network location, identity policies, or identity session structure and content;

assess, by the discovery agent element, a status or a structure of the identity infrastructure, wherein the assessing is based at least in part on the identifying, the intercepting, or a combination thereof;

install, by a discovery agent element installment module, one or more new discovery agent elements based at least in part on assessing points of interest in said one or more infrastructure elements, wherein after the discovery agent element determines that additional information about the identity infrastructure may be gathered by installing the one or more new discovery agent elements, the discovery agent element installment module installs the one or more new discovery agent element at or near a proxy point; and

report, by the discovery agent element, the status or the structure of the identity infrastructure to an administrator or a centralized server, the reporting being based at least in part on the assessing.