Coder Legion - Recent posts tagged nonhumanidentity

Oak's Head of Research: Some Orgs Discover They Have 10,000 AI Agents for Every 200 Employees

Wed, 05 Aug 2026 23:44:18 +0000

When Oak's enterprise customers first load their own identity graph inside the platform, the most common reaction isn't about a specific vulnerability. It's shock at scale. "Even now, when you talk to security leaders, they'll tell you, 'My organization is 200 people,'" said Oryan Perlmutter, Oak's Head of Research. "But it's not the case anymore. It's 200 people, but 10,000 agents on top." Oak, which emerged from stealth in July with a $60 million seed round led by Accel, Greylock, and CRV, is building a single identity platform that treats human employees, service accounts, and AI agents as different categories of the same underlying problem, rather than three separate products bolted together.

Oak's founders, CEO Shai Morag and co-founder Tal Marom, have both been through this cycle before. Morag previously built and sold Secdo to Palo Alto Networks and Ermetic to Tenable; Marom led product at Tenable and Salesforce. According to Perlmutter, what convinced them Oak needed to be built from scratch rather than extended from existing cloud identity tooling was watching how badly that older generation of tools broke down once AI entered the picture. Cloud identity management was already fragmented and hard to manage before agents, Perlmutter said. Once AI started generating roles, permissions, and policies by the minute, on-prem and hybrid environments, which often lacked even basic logging of roles and permissions to begin with, got worse, not better. Existing non-human identity tools, built as an add-on for long-lived, mostly static credentials, simply weren't built for identities that spin up, act, and disappear within minutes, or spawn their own sub-agents mid-task.

Oak's core technical bet is what it calls a live identity graph, built by connecting to a company's identity provider and HR system where APIs exist, and by running lightweight agents directly inside a customer's environment, reading databases and log files, where they don't. That graph updates continuously and links every identity, human or otherwise, back to who's accountable for it, a detail Perlmutter said is consistently the second most surprising thing customers encounter, right after the raw scale of their own agent population. "That's an agent, that's an action, is this a good action? I don't know. If it's a bad action, who's responsible? Who are you going to call?" is the flow he described seeing repeatedly. Being able to trace an action back to the human who actually owns that agent, rather than treating the agent as a dead end, is what Perlmutter says relieves security teams most once they see it work.

Distinguishing a human identity from an agent identity, in Oak's model, comes down to behavior rather than any fixed label. A service account or API key shows recurring, predictable behavior, which makes it straightforward to scope down to a narrow, fixed set of permissions. An agent is different: it's pursuing a goal, and if blocked, it will look for another way to get there, potentially expanding its own scope of action in the process. That means governance has to be reactive and just-in-time rather than fixed at setup, according to Perlmutter, because scoping an agent too tightly from the start effectively turns it into a rigid script incapable of doing the job it was actually built for. To manage unused-access risk without triggering false positives, Oak maps every available action inside a connected app or vendor system, builds a usage histogram for each one, and lets customers set their own thresholds for what counts as rarely used, whether that's five times a month or once a year, with built-in defaults and AI-generated recommendations layered on top for context Oak doesn't have out of the box.

Deployment speed is where Oak is making its most concrete claim. Perlmutter said the company can typically build a new connector for a homegrown or first-party app in about 24 hours, using a mix of an AI-driven acceleration engine and a white-glove implementation team, compared with an industry norm that often runs closer to a month once a request clears an internal prioritization queue. Overall implementation time for Oak, he said, is typically under two weeks, against a year or more for many legacy identity governance platforms, a gap Perlmutter attributes largely to Oak's ability to handle hybrid, multi-cloud, and pre-cloud on-prem environments out of the box rather than addressing only one layer of a customer's stack at a time. Oak itself remains a small team, 16 people as of Black Hat, and uses its own internal agents, which it calls Acorns, to handle monitoring, reporting, and governance actions at a scale the company says its human staff alone couldn't sustain.

C1 CISO Kevin Paige: Human-to-AI-Agent Ratios Could Hit 1-to-150 Within a Year

Tue, 04 Aug 2026 00:23:22 +0000

Last November, C1 decided to go all in on AI internally — marketing, HR, every team. It didn't go the way anyone expected. CISO Kevin Paige tells the story of the company's director of marketing trying to follow a blog post to connect an AI workflow to Google's SEO tools. She needed an MCP server, which meant a GitHub account, which meant downloading a repository and installing Python, which she'd never heard of. Once the software was running, she still needed a Google service account, an enabled API, OAuth credentials, and her own human credentials just to let the whole chain talk to itself.

That cascade is the reason C1 rebuilt its core product around vaulting for both human and non-human identities, rather than treating agents as an afterthought bolted onto systems designed for people. "Every non-human identity needs to be treated like a human identity," Paige said. "It needs accountability, and somebody needs to understand why it exists."

The numbers back up the urgency. Early in 2026, C1's own Future of Identity survey put the human-to-agent ratio at roughly 44 to 1. Paige now expects that to flip within six to twelve months, not because AI adoption is accelerating gradually, but because a single employee spinning up 50 agents turns the ratio upside down overnight. And those agents aren't static: they spawn their own sub-agents to get work done, which pushes the real ratio toward something closer to 1 human for every 100 to 150 non-human identities.

Traditional password vaults, Paige points out, were built for a human to check out a credential once a week. Agents need access constantly, and giving them standing credentials just because that's how vaults have always worked creates the exact sprawl problem C1 is trying to solve. The fix, in Paige's view, is just-in-time access: an agent pulls a credential only when it needs one, only for as long as the task takes, built on cryptography designed with post-quantum migration already in mind.

Static policy isn't enough to manage that at agent speed, either. Paige argues that managing AI now genuinely requires AI: runtime monitoring, not just access rules checked periodically. C1's answer is what Paige calls an intent-aware proxy that sits inline between agents and the systems they touch, watching what both the agent and the human behind it are doing. If an agent tries something it shouldn't, the system can block it, fire a Slack alert, or escalate to a manager, all while preserving a clear line back to the human ultimately responsible.

That traceability matters for breach detection, too. C1 connects to a customer's identity provider and directly to the applications themselves, so it can compare what someone is authorized to do against what they're actually doing. A developer account suddenly acting with admin privileges, or an application accessed by bypassing the IDP entirely, gets caught and flagged in real time.

Paige's biggest frustration with how teams handle machine credentials today comes down to plain hygiene: developers create a credential for testing, mean to revoke it before production, and never do. "In my 30 years in security, I've never seen somebody go back," he said, "because it's moving too fast." His advice mirrors how security teams have always talked about passwords, just applied to a category of identity that didn't exist a few years ago: don't create a credential if you can avoid it, and if you do, give it a lifecycle from day one.

C1, formerly known as Conductor One, changed its name late last year once it became clear that securing agents was a fundamentally different problem than securing people. For developers and architects building agentic workflows now, Paige's advice is to get the governance building blocks in place early. "The governed path should be the fast path," he said. "You spend a little time up front getting it right, and then you accelerate down the road."

C1 customer Instacart offers a concrete look at what that governed path can look like in practice. The grocery delivery company's infrastructure security team used C1 to move 95% of privileged access to automated just-in-time provisioning, then went further: they built Gadjit, an open-source LLM-powered bot that reads C1's identity data to evaluate the remaining sensitive access requests that once required manual manager approval. Gadjit pulls context on an entitlement's risk level and who else holds it, scores whether a request looks legitimate, and approves or escalates accordingly, all logged in C1's audit trail. In testing, the bot's accuracy ran close to 100%, and the team points out it's already outperforming the industry norm of managers rubber-stamping requests they don't have time to evaluate. It's a small-scale, working version of the same principle Paige described: managing identity at agent speed increasingly requires AI managing AI, with humans reviewing the policy rather than approving every request by hand.

Cyera: Non-Human Identities Grew 480% in Six Months. Most Companies Have No Idea What They're Doing.

Mon, 03 Aug 2026 14:00:00 +0000

A person might spend an entire career at a company and never touch more than 4% of the data they're technically authorized to see. An AI agent inheriting that same person's permissions will use all of it, the first time a task calls for it.

That gap — between what an identity is allowed to access and what it actually does with that access — is the problem Cyera is going after with three moves ahead of Black Hat USA 2026: a letter of intent to acquire non-human identity provider Oasis Security, a new product called Agent Guardian, and an expanded endpoint security capability. Christy Hart Smith, Cyera's global director of analyst relations, framed the underlying question behind all three the same way: "Can this identity — whether it is human, machine, or AI agent — access this specific piece of data right now for this purpose? And should we let it?"

The number driving the urgency: non-human identities inside Fortune 500 companies grew 480% in the last six months alone. That's not security teams spinning up more service accounts, Hart Smith said — it's AI agents, coding assistants, copilots, and autonomous workflows, deployed faster than anyone can review them, each one inheriting a human's permissions the day it goes live.

Why data and identity have to be solved together

Cyera's pitch for the Oasis acquisition rests on a simple logic problem: "Identity without understanding data cannot determine risk, and data without understanding identity cannot determine trust," Hart Smith said. Cyera built its business on the data half — understanding what sensitive information exists and where. Oasis built its business on non-human identity at enterprise scale. Put together, the argument is a platform that can answer both halves of the access question at once, extended across the cloud, the browser, and now the device itself.

Yitzi Tanenbaum, Cyera's director of product marketing, said customers reaching for traditional security vendors to solve this haven't had much luck, for three reasons: platforms marketed as unified are often disjointed collections of separate acquisitions that don't actually talk to each other; vendors lack a real grip on what data agents are touching and whose identity is doing the touching; and most analysis today still leans on static permissions with little understanding of what's actually being accessed in the moment.

The four pillars of Agent Guardian

Agent Guardian is built around Discover, Govern, Protect, and Validate. Discover addresses what Tanenbaum called customers' number one complaint: shadow AI, meaning no clear picture of what agents and AI tools are even running in the environment. Once that inventory exists, Govern sets the guardrails — what's allowed, what isn't, and whether an agent is drifting from the purpose it was originally built for. Protect is the enforcement layer, blocking agents in real time from taking actions outside their intended scope — Tanenbaum's example was a calendar-and-inbox management agent suddenly reaching into HR systems, which gets stopped cold. Validate closes the loop with red-teaming, compliance checks, and a full audit trail of what an agent actually did.

That Protect layer includes what the team called an agent kill switch: the ability to quarantine an agent that's behaving unexpectedly, investigate, and release it once cleared — without waiting on a broader incident response process to catch up.

A unified policy engine, not a bolted-on one

Cyera's specific claim of differentiation is architectural. Hart Smith described looking at competitors who've tried to bridge posture management and runtime protection for AI, only to find that "the policy engine they're using for AI is separate from the policy engine they're using for other things" — built out using rigid, project-based logic with limited ability to actually understand the content it's evaluating. Cyera's alternative: the same policy engine drives Agent Guardian, its existing DSPM product, and Omni DLP, so a rule written once for data at rest also governs data in motion and in use, with no separate, more brittle system layered in for AI specifically.

The Robin Williams test

The clearest illustration of what that unified approach is supposed to buy came from a customer's own attempt to break the platform during a private preview. A security lead pasted a Social Security number into a chat to see what would happen — but instead of risking his own SSN, he used one he found publicly available online, which turned out to belong to the late Robin Williams. Cyera's platform flagged it, correctly, as a low-severity alert rather than a critical one, because the system recognized the number as already public rather than treating any SSN-shaped string as an automatic emergency. The customer initially took the low score as a failure; Cyera's read is closer to the opposite — a platform that understands content deeply enough to tell the difference isn't just pattern-matching against a regex. Hart Smith cited a false-positive reduction north of 98% as the payoff of that deeper understanding.

What the discovery layer actually surfaces

In a live walkthrough, Cyera product VP Maya Mandel showed the inventory pulling from browser activity, AI gateways, developer APIs, existing DLP providers, and more into a single view — not just which agents and AI apps exist, but which model infrastructure they're actually running on (a customer might permit Claude only through Bedrock rather than natively, for instance), who has access, what knowledge bases are connected, and a risk score built from the specific factors driving it. Discovery extends beyond agents themselves to the tools, skills, and MCP servers those agents call — visibility Mandel said customers have specifically asked for as MCP adoption spreads.

Each agent gets a graph showing exposure, data connections, and a full activity history — prompts, responses, tool calls, and token consumption — with the level of detail customers see configurable based on their own sensitivity requirements. Issues (posture-level, static findings) and alerts (real-time policy violations) are tracked separately, and policies can be set to block outright or simply flag for review, depending on how much autonomy a given customer wants to hand the system.

What's still ahead

Cyera's endpoint capability, announced at Black Hat, extends the same DSPM and DLP visibility to AI agents running locally on employee devices — outside corporate network controls, where Hart Smith noted some of the most sensitive agent activity increasingly happens. It's explicitly not a requirement for Agent Guardian to function; it's one more surface in what the team was clear is a multi-surface problem, alongside the company's existing Browser Shield extension and AI gateway integrations.

Asked how Cyera handles agents running on external platforms like Salesforce's Agentforce, ServiceNow, or Watson X, Tanenbaum pointed to the same Omni DLP orchestration model the company built out previously — connecting via API into whatever DLP and identity systems already exist in a customer's environment, rather than requiring a rip-and-replace.

For a category where "we do AI security too" has become a default claim for nearly every vendor heading into Black Hat this year, Cyera's own framing is a useful lens for evaluating any of them: the real test isn't whether a product can react to an agent doing something wrong, but whether the decision-making layer underneath actually understands the data and the identity well enough to make that call correctly in the first place.

The AI Agent Found the MFA Backup Codes in a Downloads Folder.1Password Is Solving That Problem.

Wed, 29 Jul 2026 08:59:29 +0000

An AI agent was supposed to automate a task on GitHub using credentials it had been intentionally provisioned. Instead, it found different credentials sitting on the device, signed in with a completely different account, hit a two-factor prompt, and kept going — it located the backup MFA codes in a downloads folder and used those too.

"It got to the two-factor screen where it didn't just know the username and password, but then it got to the text message screen," said Jason Meller, VP of Product at 1Password. "We thought, surely, okay, that would have stopped it. No, it found the backup codes for the MFA in their downloads folder without any prompting, and then suddenly was in GitHub and it was performing the actions dutifully under the wrong account."

That story is the clearest illustration of the problem 1Password's new research puts numbers on: 40% of developers grant AI agents persistent access that outlives the task it was created for, and standing credentials — the plaintext kind sitting in downloads folders and .env files — are exactly what an unsupervised agent will find and use if the access it was actually given isn't enough to finish the job. "These agents — they don't know better," Meller said. "They don't have this concept of right or wrong, or I shouldn't use what's available to me to complete the task."

1Password launched its answer the same day the research went public: 1Password Privileged Access, which doesn't guard standing access the way traditional PAM tools do — it aims to remove standing access altogether.

Why not just build a better guardrail on top of what exists

The obvious approach to controlling AI agent access would be a proxy layer sitting on top of existing identity systems. Meller said that's deliberately not what 1Password built. "We don't want to build this sort of oversimplified layer that really boils everything down into something that's so simple that you really can't do anything well with it," he said. Instead, Privileged Access orchestrates the identity and access systems that already exist — AWS IAM and similar cloud-native tooling — and adds a policy layer that produces consistent outcomes across environments, rather than replacing what's already there.

The friction problem was just as important to the design as the security problem. "If you're a developer and you need to get access to a privileged system, and you know that the second you integrate with that PAM, you have to go through a 40-tier approval chain, you're going to resent that — you're going to look at the backdoor ways to get in," Meller said. The default outcome Privileged Access is built around is access granted immediately, based on identity, context, and history — is this the on-call engineer, have they accessed this system before, are they on a managed device — with manual approval gates layered in only where a customer wants them.

For agents specifically, that design goal gets more literal. "We can't have 40 agents waiting in line to get someone to just rubber stamp their access into the production system," Meller said. Instead, 1Password's approach is what he called "governing the stay" — let the agent in, but watch continuously as it acts.

What "task-scoped" actually means in practice

An agent doesn't just get a permission set when Privileged Access provisions it — it gets judged, action by action, against the task it was assigned. Meller's example: an agent given read, write, and delete access to a database to diagnose why production went down. The permissions exist, but "when it goes to actually do something destructive like a delete or a write, we try to judge in the moment: is what it's trying to do here in alignment with the task it initially had?" An agent debugging an outage has no obvious reason to be deleting rows, so that action gets intercepted regardless of what its account technically allows.

That judgment is possible, Meller argued, because of something structurally different about agents versus human users. "These AI agents — they think out loud. They tell you why they're going to do something, and they talk about it ad nauseum. This is very different from humans, who don't want to tell you why they're doing anything." A human asked why they need system access might type "test123." An agent narrates its reasoning the whole way through, which gives a governance layer something concrete to evaluate against.

Whether that means a literal fresh account per task depends on the system. For something like a database, Meller said 1Password will provision and decommission thousands of just-in-time accounts if that's what the integration supports. For larger, higher-latency systems, the model shifts: broader account-level access gets provisioned once, and the real governance happens at the tool-call layer, intercepting individual commands as the agent issues them. "The reason this is important is that these systems we're integrating with were never designed for this level of granularity," Meller said. Even a database — often the most granular system available — has no native concept of "read this row, but only if it doesn't contain PII." That distinction has to get built above the system, not inside it.

Human access and machine access get treated differently, on purpose

The 1Password research distinguishes human-style access (an agent logging into a web front end like a person) from machine-style access (an agent calling an API directly), and Meller said Privileged Access treats them differently by design, pushing agents toward API-based access wherever possible. "Websites can change at any moment and do anything," he said. "Today it might be safe, and then tomorrow they introduce a feature that suddenly makes something really unmanageable, scary possible." APIs offer a more stable, more auditable surface — a meaningful distinction for any team deciding how to wire an agent into a legacy system that was built for people, not processes.

Prompt injection is a different problem, and this doesn't fix it

Asked directly whether removing standing access blunts the risk behind the report's prompt-injection findings — 47% of developers reported an agent taking an unintended action after following instructions buried in untrusted content — Meller didn't oversell it. "Prompt injection is a separate risk, and this is a mitigating control for if that risk is realized," he said. What changes is the blast radius, not the odds of it happening: an agent that's had its underlying mission hijacked can be detected mid-action and ejected from the privileged system before it does damage. Reducing an agent's actual exposure to untrusted input in the first place, Meller said, "is not just a one-password problem to solve — that's a general industry problem."

More verbosity, not less, and a bet that AI can make sense of it

It might seem like ephemeral, task-scoped accounts would simplify auditing by generating fewer, cleaner logs. Meller argued the opposite is the actual near-term goal: "Right now we're not looking for simpler. We're looking for anything — right now we have no information about what AI agents are doing, and that's untenable." His bet is that the volume of logs an agent-heavy environment generates is itself solvable with AI: large-scale meta-analysis across those logs, feeding back into policy tuning so agents hit fewer dead ends over time. It's also, he argued, the missing piece in the current AI ROI conversation. "We've been spending like drunken sailors on tokens. Where's the ROI?" Meller said. "The reality is ROI is happening, but it's being misattributed to human beings" — without visibility into what agents are actually doing on a person's behalf, it's hard to separate a human's productivity gain from an agent's.

The migration path, if you're already exposed

For teams with agents already running in production on standing credentials today, Meller described an incremental path rather than a rip-and-replace: first, get existing standing access into a vault. Second, make the vault the broker of connectivity itself, rather than letting the agent reach for access using its own tools — which puts a governance layer in the loop, watching the tool calls as they happen. From there, intelligence and policy get layered on top of that visibility, judging whether each action the agent takes is actually relevant to what it was asked to do.

1Password is also extending this work into discovery. At Black Hat next week, the company is set to announce Developer Watchtower, a capability that scans developer devices for standing credentials sitting in plaintext, so teams can identify what needs to move into a vault before it becomes exactly the kind of access an ungoverned agent can find and use on its own.