TRANSCRIPTION 🔗
WEBVTT
00:00:02.729 --> 00:00:05.330
A while back, we introduced you to Dave. Dave
00:00:05.330 --> 00:00:07.389
was the engineer who spun up a service account
00:00:07.389 --> 00:00:10.929
in 2017, gave it god mode access, and left the
00:00:10.929 --> 00:00:14.029
company in 2020. Dave's account is still there.
00:00:14.410 --> 00:00:18.010
And in 2026, Dave's account has 108 friends.
00:00:18.649 --> 00:00:21.629
79 of them are AI agents nobody named, nobody
00:00:21.629 --> 00:00:24.250
owns, and two thirds of them your identity team
00:00:24.250 --> 00:00:28.030
has never even seen. This is tech updates, the
00:00:28.030 --> 00:00:31.589
machine identity crisis, one year later. Let's
00:00:31.589 --> 00:00:33.490
start with the number we gave you last time.
00:00:33.850 --> 00:00:36.909
A year ago, we said machine identities outnumbered
00:00:36.909 --> 00:00:40.649
humans 45 to 1. That's now the floor, not the
00:00:40.649 --> 00:00:43.869
headline. And the honest answer is that it's
00:00:43.869 --> 00:00:46.450
a moving target because every vendor measures
00:00:46.450 --> 00:00:49.170
a different population. CyberArk's big survey
00:00:49.170 --> 00:00:53.409
says 80 to 1. Their 2026 event data says 109
00:00:53.409 --> 00:00:56.649
to 1. And of those 100 plus machine identities,
00:00:57.229 --> 00:01:00.759
about 79 are AI agents. In cloud native shops,
00:01:01.000 --> 00:01:05.640
one report clocks 144 to 1, up 56 % in a single
00:01:05.640 --> 00:01:09.099
year. The spread itself is the story. Nobody
00:01:09.099 --> 00:01:12.140
can even agree how outnumbered we are. One stat
00:01:12.140 --> 00:01:14.680
before we move on, and it is the scariest one
00:01:14.680 --> 00:01:18.170
in this whole episode. The security firm GetGuardian
00:01:18.170 --> 00:01:21.530
found that 64 % of the valid secrets leaked back
00:01:21.530 --> 00:01:25.549
in 2022 were still live and exploitable in January
00:01:25.549 --> 00:01:28.609
of this year. Still working, never rotated, never
00:01:28.609 --> 00:01:32.129
revoked. Meanwhile, 28 .5 million new secrets
00:01:32.129 --> 00:01:36.310
hit public GitHub last year, up 34%. The biggest
00:01:36.310 --> 00:01:39.650
jump ever recorded. AI service credential leaks
00:01:39.650 --> 00:01:43.689
surged 81%. And here's the ironic twist. Commits
00:01:43.689 --> 00:01:46.370
written with AI coding assistants leak secrets
00:01:46.370 --> 00:01:49.430
at twice the normal rate. So who got burned this
00:01:49.430 --> 00:01:52.409
year? The pattern is always the same. A token
00:01:52.409 --> 00:01:55.469
stolen once, then used everywhere. The Shiny
00:01:55.469 --> 00:01:58.010
Hunters crew reused OAuth tokens from an earlier
00:01:58.010 --> 00:02:01.689
breach to quietly keep accessing over 200 Salesforce
00:02:01.689 --> 00:02:04.879
environments. Versal got hit when attackers abused
00:02:04.879 --> 00:02:07.299
a connected Google Workspace app and pivoted
00:02:07.299 --> 00:02:10.460
in. An NPM supply chain worm harvested nearly
00:02:10.460 --> 00:02:14.039
300 ,000 secrets from almost 7 ,000 machines,
00:02:14.539 --> 00:02:17.979
most of them CI -CD build servers. And the vendors
00:02:17.979 --> 00:02:21.800
noticed, Cisco bought Asterix, SalePoint bought
00:02:21.800 --> 00:02:24.699
Entro, Syrah bought Oasis for about a billion
00:02:24.699 --> 00:02:27.879
dollars, three machine identity companies acquired
00:02:27.879 --> 00:02:30.479
in three months. Now the fix that's actually
00:02:30.479 --> 00:02:33.159
emerging and it's a good one. The industry landed
00:02:33.159 --> 00:02:37.419
on a concept. Give every AI agent its own verifiable
00:02:37.419 --> 00:02:40.039
cryptographic identity. Think of it as an agent
00:02:40.039 --> 00:02:43.599
passport. Short -lived, provable, scoped, and
00:02:43.599 --> 00:02:46.500
revocable instead of a borrowed god mode key.
00:02:47.159 --> 00:02:50.400
Microsoft shipped Entra Agent ID. Okta shipped
00:02:50.400 --> 00:02:53.479
identity for AI agents. Open standards issue
00:02:53.479 --> 00:02:55.759
each workload a short -lived certificate that
00:02:55.759 --> 00:02:58.800
proves what it is and where it runs. The architecture
00:02:58.800 --> 00:03:01.300
is converging on the same primitives everywhere.
00:03:01.659 --> 00:03:06.020
OAuth for tokens, MCP for tool access, and agent
00:03:06.020 --> 00:03:08.500
-to -agent protocols for the rest. But you don't
00:03:08.500 --> 00:03:11.620
need to buy anything to start. Four moves. One,
00:03:12.139 --> 00:03:15.639
inventory first. 67 % of non -human accounts
00:03:15.639 --> 00:03:19.099
were born inside an application, completely invisible
00:03:19.099 --> 00:03:21.800
to your identity team, so you literally cannot
00:03:21.800 --> 00:03:25.240
govern what you cannot see. Two. Kill long -lived
00:03:25.240 --> 00:03:28.139
secrets. Move to short -lived, tightly -scoped
00:03:28.139 --> 00:03:30.699
credentials that actually get retired after use,
00:03:31.120 --> 00:03:33.680
because rotating a broad, permanent key changes
00:03:33.680 --> 00:03:37.139
almost nothing. 3. Least privilege. Remember
00:03:37.139 --> 00:03:40.199
Capital One. A hundred million records lost through
00:03:40.199 --> 00:03:43.780
one overprivileged role. 4. Give every machine
00:03:43.780 --> 00:03:47.340
identity a human owner and a review date. OWASP
00:03:47.340 --> 00:03:49.879
even publishes a non -human identity top ten
00:03:49.879 --> 00:03:52.810
now. Use it. For the Security Plus crowd, this
00:03:52.810 --> 00:03:56.949
is not exotic. It's your exam, at scale. Secrets
00:03:56.949 --> 00:03:59.490
management, short -lived tokens, just -in -time
00:03:59.490 --> 00:04:03.169
access, service accounts, leased privilege IAM
00:04:03.169 --> 00:04:06.310
roles, certificate and key lifecycle under PKI.
00:04:06.969 --> 00:04:08.969
Every one of those objectives is the machine
00:04:08.969 --> 00:04:11.810
identity problem, wearing an exam questions close.
00:04:12.370 --> 00:04:14.870
Learn to inventory and rotate a service account
00:04:14.870 --> 00:04:17.129
for the test, and you've learned the core of
00:04:17.129 --> 00:04:19.329
the single fastest growing risk in the enterprise.
00:04:19.579 --> 00:04:23.519
So here's the close. Dave left in 2020, his account
00:04:23.519 --> 00:04:26.720
is still running, and now it has 108 companions,
00:04:26.899 --> 00:04:30.199
most of them unmanaged, and the AI agent explosion
00:04:30.199 --> 00:04:33.019
is barely getting started. The machines outnumber
00:04:33.019 --> 00:04:36.899
your people 100 to 1. Inventory them, scope them,
00:04:37.379 --> 00:04:40.459
and retire the ones nobody owns, before an attacker
00:04:40.459 --> 00:04:43.360
inventories them for you. They already know Dave's
00:04:43.360 --> 00:04:46.220
account is there. That's the show. Go find your
00:04:46.220 --> 00:04:48.930
own Dave. Every org has at least one. We're back
00:04:48.930 --> 00:04:51.370
next week with more tech updates. Stay sharp.