Coder Legion - Recent posts tagged identitysecurity

NewCore Wants to Kill the Service Account — and Make Every AI Agent Answer for What It Does

Tue, 15 Sep 2026 13:00:00 +0000

Every identity system enterprises run today rests on one assumption: there's a person behind the credential. Trace a password, a token, a badge swipe back far enough, and you land on someone who can be held accountable. AI agents break that assumption. They act on their own, delegate to other agents, spin up sub-agents nobody explicitly approved, and sometimes run for days on a task nobody's checked in on since it started.

That gap is what NewCore, an identity security startup, is building its platform around — and it's why Joy Chik, who spent 28 years building and running Microsoft's identity business, just joined its board.

"Identity is the number one attack vector inside the security space, and has always been," Chik said. "Now, with AI, that's happening at machine scale, machine speed."

Chik left Microsoft this year after nearly three decades, taking a sabbatical to explore venture and startup work — she also sits on PayPal's board and advises Nyca Partners, a fintech-focused venture firm — before deciding where to put her second act. NewCore, co-founded by Zohar Alon alongside two other repeat founders, stood out because it treats identity as a problem shared by people and agents, not bolted onto one side after the fact. "They don't stop at AI. They think about it holistically, AI with human," she said of the founding team.

Zohar Alon's argument starts with what an agent actually is, compared to what security teams have handled before. A service account, he said, descends from something like an early Lambda function: compute that does one specific, predictable thing. An LLM-driven agent isn't predictable in the same way. "You should look at it very similar to the way you look at human-based permissions," Alon said, "because guess what — your permission model was designed for humans."

That's the shift NewCore is selling: instead of retrofitting agents onto service accounts and static API keys, treat them more like people logging in. An agent authenticates itself, gets issued a scoped, time-limited grant to do one task, and loses that access the moment the task ends. Steal the token off an agent mid-task, and there's nothing useful in it. "It's not just that it's hard to steal," Alon said. "There's nothing to steal."

Authority still flows downhill from a human. An agent only gets the permissions of whoever owns or runs it, and NewCore's policy layer splits actions into three zones: automatically allowed, blocked outright, and a middle zone that needs a human to confirm before the agent proceeds.

That middle zone is where the harder engineering problem shows up. Alon described a client — a 4,500-person law firm where roughly 1,000 lawyers now use agents to draft their own outreach — whose security chief wanted agents doing client outreach without connecting a coding assistant to the firm's Microsoft 365 environment and, in Alon's words, letting "all hell break loose without accountability." The catch: if an agent is already connected to Teams, you can't route its approval request through Teams. The agent can see it and could act on it. NewCore's answer is to push confirmation out of band entirely, onto a mobile passkey app the agent has no way to reach. Before an agent sends an email to 250 people, a human gets a prompt on their phone and has to positively confirm it — producing an audit trail of who approved what, and when.

Every identity vendor has spent the past year bolting some version of "agent identity" onto what it already had. Alon's case for building it in from scratch is mostly about scale. "Today you have 14 identity systems. Come agentic, you'll end up with 19," he said, describing the common path: stacking agentic versions of IDP, governance, and compliance tooling alongside the human-facing systems already in place, rather than replacing anything. That's the wrong bet, he argues, because agent-driven authorization traffic runs orders of magnitude past what those older systems were sized for — enough that a legacy IDP built to serve human logins can buckle under the request volume a fleet of agents generates. NewCore built its unified human-and-agent model right as "agentic" became a real word in the industry, rather than years into a human-only system it would later have to unwind. The stated ambition goes past adding an agent product line — replacing the legacy IDP outright, and shrinking a company's separate governance and privileged-access tooling alongside it, with consolidation savings as the case on top of security. Alon also pointed to the industry's coming shift to quantum-safe cryptography as a second, unrelated deadline forcing the same infrastructure refresh over the next two to three years, regardless of what any company decides about agents.

Ask Alon what NewCore doesn't have a good answer for yet, and the honesty is the most useful part of the conversation. "Proving that you monitored the agentic loop... attributing it back to an individual person" is still unsolved, he said. As agents create sub-agents, tracing an action back to the person accountable for it gets harder, and if that chain breaks, "it falls on the CEO." One control NewCore is testing: an agent running a task past a set duration — he floated six hours as an example — has to check back in with a human before it keeps going, rather than being left to run indefinitely against someone's compute budget and risk tolerance.

Asked what it looks like in two years, once agent identity is as boring and settled as single sign-on is today, Alon didn't hedge: that future looks like NewCore's approach, he said, not because agents will start behaving more like machines, but because they won't. Running for days, delegating to each other, holding a role rather than executing one instruction — agents already have, in his words, "a lifespan that's closer to a human than to the service account that ran ten milliseconds and did one very single thing." That's the bet underneath the product: identity built for something that behaves like a person, because that's increasingly what's showing up in the logs.

Oak's Head of Research: Some Orgs Discover They Have 10,000 AI Agents for Every 200 Employees

Wed, 05 Aug 2026 23:44:18 +0000

When Oak's enterprise customers first load their own identity graph inside the platform, the most common reaction isn't about a specific vulnerability. It's shock at scale. "Even now, when you talk to security leaders, they'll tell you, 'My organization is 200 people,'" said Oryan Perlmutter, Oak's Head of Research. "But it's not the case anymore. It's 200 people, but 10,000 agents on top." Oak, which emerged from stealth in July with a $60 million seed round led by Accel, Greylock, and CRV, is building a single identity platform that treats human employees, service accounts, and AI agents as different categories of the same underlying problem, rather than three separate products bolted together.

Oak's founders, CEO Shai Morag and co-founder Tal Marom, have both been through this cycle before. Morag previously built and sold Secdo to Palo Alto Networks and Ermetic to Tenable; Marom led product at Tenable and Salesforce. According to Perlmutter, what convinced them Oak needed to be built from scratch rather than extended from existing cloud identity tooling was watching how badly that older generation of tools broke down once AI entered the picture. Cloud identity management was already fragmented and hard to manage before agents, Perlmutter said. Once AI started generating roles, permissions, and policies by the minute, on-prem and hybrid environments, which often lacked even basic logging of roles and permissions to begin with, got worse, not better. Existing non-human identity tools, built as an add-on for long-lived, mostly static credentials, simply weren't built for identities that spin up, act, and disappear within minutes, or spawn their own sub-agents mid-task.

Oak's core technical bet is what it calls a live identity graph, built by connecting to a company's identity provider and HR system where APIs exist, and by running lightweight agents directly inside a customer's environment, reading databases and log files, where they don't. That graph updates continuously and links every identity, human or otherwise, back to who's accountable for it, a detail Perlmutter said is consistently the second most surprising thing customers encounter, right after the raw scale of their own agent population. "That's an agent, that's an action, is this a good action? I don't know. If it's a bad action, who's responsible? Who are you going to call?" is the flow he described seeing repeatedly. Being able to trace an action back to the human who actually owns that agent, rather than treating the agent as a dead end, is what Perlmutter says relieves security teams most once they see it work.

Distinguishing a human identity from an agent identity, in Oak's model, comes down to behavior rather than any fixed label. A service account or API key shows recurring, predictable behavior, which makes it straightforward to scope down to a narrow, fixed set of permissions. An agent is different: it's pursuing a goal, and if blocked, it will look for another way to get there, potentially expanding its own scope of action in the process. That means governance has to be reactive and just-in-time rather than fixed at setup, according to Perlmutter, because scoping an agent too tightly from the start effectively turns it into a rigid script incapable of doing the job it was actually built for. To manage unused-access risk without triggering false positives, Oak maps every available action inside a connected app or vendor system, builds a usage histogram for each one, and lets customers set their own thresholds for what counts as rarely used, whether that's five times a month or once a year, with built-in defaults and AI-generated recommendations layered on top for context Oak doesn't have out of the box.

Deployment speed is where Oak is making its most concrete claim. Perlmutter said the company can typically build a new connector for a homegrown or first-party app in about 24 hours, using a mix of an AI-driven acceleration engine and a white-glove implementation team, compared with an industry norm that often runs closer to a month once a request clears an internal prioritization queue. Overall implementation time for Oak, he said, is typically under two weeks, against a year or more for many legacy identity governance platforms, a gap Perlmutter attributes largely to Oak's ability to handle hybrid, multi-cloud, and pre-cloud on-prem environments out of the box rather than addressing only one layer of a customer's stack at a time. Oak itself remains a small team, 16 people as of Black Hat, and uses its own internal agents, which it calls Acorns, to handle monitoring, reporting, and governance actions at a scale the company says its human staff alone couldn't sustain.

Sophos Traces a Ransomware Operation Back to 12 AI Agents Running Inside a Coding Assistant

Wed, 22 Jul 2026 18:55:09 +0000

In May, Sophos found something inside a customer's network that looked less like an intrusion and more like a software team at work. A threat actor, tracked internally as STAC6994, had provisioned four virtual machines and was running roughly a dozen AI agents, coordinated through the Cursor IDE and a commercial coding assistant, to write and test malware against three different endpoint products at once: Sophos, CrowdStrike, and Microsoft Defender.

One agent, running Claude Opus 4.5, handled core operations and rule-setting. Others managed OPSEC hardening, documentation, proxy stress testing, and VM deployment. Code commits flowed to Git through Model Context Protocol. The agents read technique write-ups scraped from the SpecterOps blog, mapped them to MITRE ATT&CK, built a lab to reproduce each one, and logged the results. Over the course of the operation, they produced close to 80 modules and tested more than 70 evasion techniques. Sophos's Counter Threat Unit later confirmed the same operator went on to deploy ransomware and steal data using the tooling built in that environment.

Sophos published the case as the anchor story in its first AI Security report, and the headline finding isn't that AI invented some new form of attack. It's that the same tradecraft moved at a different speed. The report is explicit about this: what used to take a human developer weeks of manual iteration took the agents a few days. Nothing about the malware itself was novel. The clock was the story.

That distinction matters for how you think about defense. The report separates AI threats into two categories: malicious use of AI, where attackers use AI tools the way STAC6994 did, and malicious targeting of AI, where the AI systems and infrastructure themselves become the target. The second category is where Sophos says the more immediate, provable damage is happening right now, and it's squarely a developer problem.

A campaign Sophos calls SANDWORM_MODE planted at least 19 typosquatted npm packages designed to mimic legitimate developer utilities and AI coding tools. Once installed, the packages dropped a rogue MCP server and used prompt injection to get legitimate AI assistants to quietly retrieve SSH keys and cloud credentials on their own. Separately, a compromised Nx Console VS Code extension pulled credentials out of HashiCorp Vault, npm, AWS, GitHub, 1Password, and Anthropic API keys, as part of a broader campaign researchers have linked to TeamPCP. And in March, source code from Claude Code, roughly 1,900 files and 500,000 lines, ended up published inside an npm package by mistake. Anthropic said no customer data was exposed, but the leak still gives attackers a map to work from.

None of that requires a sophisticated attacker. It requires a developer trusting a tool the way developers are supposed to trust their tools, and an attacker who understood that IDE extensions and coding assistants now sit close enough to credentials and repositories to be worth compromising directly.

The identity layer around those tools is where Sophos sees the exposure concentrating. IBM X-Force found more than 300,000 ChatGPT credentials for sale on the dark web during 2025. The Salesloft/Drift breach showed the mechanism clearly: OAuth tokens issued to a chatbot were enough to compromise multiple Salesforce environments. Sophos points to a similar pattern at Vercel in April, where an employee granted broad OAuth permissions to a third-party AI tool from their corporate account; when that tool was compromised through an infostealer infection, the attacker inherited the tokens and used them to reach Vercel's internal environment.

The governance numbers behind all of this are the ones worth sitting with if you're the one setting policy for a team. Citing Saviynt and Cybersecurity Insiders research, the report says 71% of large enterprises have deployed AI agents with access to core business systems, and only 16% actually govern that access. Only 1% of enterprises have a dedicated AI security budget, per Pentera. Three-quarters of CISOs have already found shadow AI tools running inside their organizations, and 95% of them doubt they'd catch misuse if it happened.

Sophos's recommendations read like a checklist for anyone building agentic systems rather than just buying security products: sandbox the agent process, isolate credentials so the agent never sees secrets directly, put a broker between the agent and any tool it calls, restrict and monitor egress traffic, extend EDR coverage to agent hosts and ephemeral VMs, require human approval for irreversible actions, and treat memory writes and cross-agent handoffs as security events worth logging. Sophos tested one of these principles directly against OpenClaw, running its own red team against it and finding 23 actionable issues. Its take: the tool was powerful enough to be worth using, but only after the security framework around it was built first, which took longer than the test itself.

The report ties back to Sophos's own State of Ransomware 2026 data, which found identity had become the top initial access vector for ransomware for the first time in three years. The AI Security report's argument is that this isn't a coincidence. The tools generating the most productivity gains right now, coding assistants, agents, OAuth-connected AI services, are also the newest and least governed part of the identity fabric. STAC6994 is one confirmed case. Sophos is fairly direct that it's unlikely to be the only one; AI assistance mostly doesn't show up in telemetry, and this one only got caught because the framework was left running on a device Sophos could examine.

Sophos Fusion Automates 52% of Ransomware Response as Identity Attacks Hit 79%

Wed, 15 Jul 2026 13:00:00 +0000

Sophos is launching a new security architecture built around a problem its own data just confirmed: identity, not software vulnerabilities, is now the primary way ransomware gets in.

The company's 2026 State of Ransomware report, released today alongside the launch of Sophos Fusion, found that 79% of ransomware attacks now start with compromised identities. Two-thirds of victims said the ransomware incident was also their most serious identity attack of the year. Multi-factor authentication was in place for 97% of the incidents where stolen credentials were the root cause, which says a lot about how far MFA alone can carry an organization at this point. For the first time in four years, exploited software vulnerabilities aren't even the top root cause anymore. Malicious email (26%) and phishing (24%) have taken over that spot. Encryption success also rebounded to 56% of attacks, reversing a two-year decline, and the average recovery cost per incident has climbed to $1.7 million.

Sophos Fusion is the company's answer to that shift. It's built on Sophos Central, which already protects 625,000 organizations, and now incorporates Secureworks Taegis analytics following Sophos's 2025 acquisition of Secureworks. The pitch is straightforward: instead of stitching products together after the fact, Fusion runs on one shared data layer, so a detection at any control point, whether that's endpoint, firewall, identity, email, or cloud, triggers a coordinated response across all the others in real time.

CEO Joe Levy frames it as a shift from platform thinking to system thinking. "Sophos Fusion is built as a defense system optimized for Human-AI workflows," Levy said. "We bring the most complete solution to a new category, a timely advancement demanded by the AI era."

The architecture rests on four ideas. One shared context lake, where every signal from every control point lands in the same place in real time. Synchronized response, where a detection at one layer triggers action at the others simultaneously rather than in sequence. Agentic autonomy inside boundaries that human analysts set and adjust. And compounding intelligence, where a threat caught at one customer strengthens the defense at every other customer almost immediately.

Sophos already runs this model internally, and the numbers are the part worth sitting with if you build or evaluate security tooling. Across more than 40,000 managed detection and response customers, the company says 52% of cases are resolved entirely by AI, with an average of 89 seconds between alert and automated response. That figure matters because 89 seconds is roughly the window an attacker needs to go from a stolen session token to lateral movement across a network. A defense system has to move on the same clock, or the response arrives after the damage is already done.

There's a distinction in how Sophos describes the human role here, and it's relevant to anyone architecting agentic systems of their own. Levy called the setup "human-on-the-loop" rather than "human-in-the-loop." Agents act on their own for high-volume, well-understood tasks: isolating an endpoint, revoking a session, blocking a malicious IP. A person stays accountable for the calls that require judgment, like confirming whether a suspicious inbox rule change is an accident or the setup for wire fraud. Put a human in the loop for every single action, and the system loses the speed advantage that justified building it agentic in the first place.

Fusion keeps expanding through the rest of the year. Sophos Next-Gen SIEM and a rebuilt Sophos XDR, powered by Secureworks Taegis analytics with added detectors and built-in SOAR automation, both reach general availability August 15. Sophos AI Defense, which gives visibility into AI tools already running inside a company, shadow AI included, gets early access in August and general availability in October. Sophos CISO Advantage, aimed at organizations without a dedicated security leader, starts rolling out in October.

That last piece connects to a stat Levy raised at Sophos's press briefing earlier this month: there are roughly 359 million organizations worldwide and fewer than 35,000 full-time CISOs to lead them, or about one for every 10,000 organizations. Fusion's underlying bet is that agentic AI can close part of that gap by putting CISO-level judgment into a system that runs continuously, instead of depending on headcount that mostly doesn't exist.

More than 500 third-party integrations feed into the same data layer, so existing tools from other vendors aren't replaced, they're folded in. For security teams already running a stack of 45-plus disconnected tools, a figure Sophos and Gartner both cite, that's arguably the more useful claim than "AI-native" on its own. The value isn't the AI by itself. It's what happens once everything already in place starts sharing context in real time.

Whether "cybersecurity defense system" becomes a real category, Gartner is reportedly building a new Magic Quadrant for it, expected in November, or just turns out to be Sophos's name for consolidation done well, is worth watching over the next couple of quarters. The ransomware numbers aren't really in dispute, though. Identity is the front door now, and a lot of the tooling built for perimeter and vulnerability defense wasn't built for that.

CrowdStrike tracks AI agents, human identities, and data across hybrid environments in real-time.

Fri, 19 Sep 2025 01:22:18 +0000

CrowdStrike's Identity Security and AI Data Protection: What Developers Need to Know

CrowdStrike tracks AI agents, human identities, and sensitive data across hybrid environments in real-time.

CrowdStrike's final day of announcements focuses on two critical areas for development teams: identity management for AI agents and data protection for generative AI workflows. The company introduced FalconID for passwordless authentication and expanded data protection to monitor how AI tools handle sensitive information.

Identity Security for the AI Agent Era

The FalconID announcement addresses a growing challenge: managing authentication for both human users and AI agents across hybrid environments. Traditional identity and access management (IAM) systems weren't designed for autonomous agents that operate without direct human oversight.

FalconID provides phishing-resistant, passwordless multi-factor authentication built on FIDO2 standards. The system integrates with CrowdStrike's endpoint telemetry to make access decisions based on device posture and user behavior patterns, not just credential verification.

This matters for developers building AI applications because it provides a unified authentication framework that works for both human users and autonomous agents. Instead of managing separate authentication systems, development teams can use a single platform that understands the context of who or what is requesting access.

Enhanced Privileged Access Management

The Enhanced Falcon Privileged Access capability addresses Active Directory and Entra ID complexity through automation. The system can automatically grant and revoke permissions via Microsoft Teams and Fusion SOAR, reducing the manual overhead that typically slows development workflows.

For DevOps teams, this means service accounts and application identities can be managed more dynamically. Instead of requesting elevated permissions through lengthy approval processes, automated systems can grant temporary access based on predefined policies and real-time risk assessment.

The real-time visibility into access patterns helps identify over-privileged accounts and unused permissions, which is particularly important for AI agents that may accumulate excessive permissions over time.

AI Data Protection Beyond Browser Controls

CrowdStrike's data protection expansion addresses a significant gap in how organizations monitor AI tool usage. Most current solutions only monitor web-based AI interactions, missing desktop applications and cloud runtime environments.

The Complete GenAI Data Protection feature monitors local applications like desktop AI assistants, code completion tools, and cloud-based development environments. This means organizations can detect when developers accidentally expose credentials, API keys, or sensitive code to AI systems.

For development teams, this provides visibility into how AI coding assistants handle proprietary code. The system can differentiate between approved enterprise AI tools and unauthorized services, allowing teams to use AI productivity tools while maintaining data security.

Shadow AI Discovery

The AI Discovery capability scans managed endpoints to identify unauthorized AI applications and agents. This addresses the common scenario where developers install AI tools without IT approval, creating security blind spots.

The system can detect locally installed AI applications, browser-based AI services, and cloud-deployed AI agents. This gives security teams visibility into the actual AI footprint across development environments.

For development managers, this provides insight into which AI tools teams are actually using versus what's officially approved, helping align policy with practice.

Technical Implementation Details

The Identity-Driven Case Management feature automatically correlates security detections across endpoints, cloud services, and SaaS applications into unified cases. This reduces the time spent investigating incidents that span multiple systems.

The AI-powered data classification uses machine learning to identify sensitive data types including credentials, secrets, and API keys. This is particularly relevant for development teams who work with various authentication tokens and configuration files.

The system claims 10x improved detection coverage through unified monitoring across endpoints, cloud environments, and SaaS applications. This consolidation reduces the number of security tools that development teams need to integrate with.

Practical Implications for Development Workflows

The unified approach means development teams can use a single platform for identity management, data protection, and compliance monitoring. This reduces the integration complexity that typically comes with security tooling.

The real-time monitoring capabilities provide immediate feedback when AI tools access sensitive data, rather than discovering issues through periodic audits. This allows teams to address problems before they escalate.

The automated case management reduces the back-and-forth between development and security teams during incident investigation, as all relevant context is automatically collected and correlated.

Integration Considerations

The FIDO2 implementation for FalconID means development teams can integrate passwordless authentication using standard WebAuthn APIs. This provides a migration path from password-based authentication without requiring proprietary integrations.

The Microsoft Teams integration for privileged access management fits naturally into existing development workflows, allowing access requests and approvals to happen within familiar collaboration tools.

The Model Context Protocol support means these identity and data protection capabilities can work with other AI systems and security tools that support the standard.

Security Architecture Implications

CrowdStrike's approach represents a shift toward unified security platforms that can handle traditional endpoints, cloud workloads, and AI agents through a single system. This contrasts with the typical approach of adding specialized tools for each new technology.

The real-time telemetry and behavioral analysis capabilities provide more context for security decisions than traditional rule-based systems. This is particularly important for AI agents whose behavior patterns may differ significantly from human users.

The unified case management reduces the fragmentation that typically occurs when security incidents span multiple tools and domains.

Development Team Considerations

Teams building AI applications will need to consider how their agents authenticate and what permissions they require. The enhanced privileged access management provides tools for implementing least-privilege access for AI systems.

The data protection capabilities require development teams to understand which data their AI tools access and whether that data should be classified as sensitive. This may require updates to data handling practices and documentation.

The shadow AI discovery means teams should expect greater visibility into their AI tool usage, which may require conversations about approved versus unapproved AI services.

Strategic Implications

These capabilities position CrowdStrike as a platform for managing the security implications of AI adoption across enterprises. Rather than treating AI as a separate security domain, they're integrating it into existing security operations.

The focus on consolidating legacy data loss prevention and security posture management tools suggests CrowdStrike sees an opportunity to replace specialized security tools with a unified platform approach.

For development organizations, this could simplify security compliance by providing a single platform for identity, data, and AI security rather than managing multiple specialized tools.

The effectiveness of this approach will depend on how well the unified platform performs compared to specialized tools and whether organizations are willing to consolidate their security tooling around a single vendor.