Latest / The Identity Blueprint / The Identities Nobody Hired

Transcript

The Identities Nobody Hired · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome to season three of the Non-Human Identity Blueprint.
• 0:03
  SPEAKER_00: Over the course of this series, we are tearing down the single largest unmanaged attack surface in modern enterprise security.
• 0:12
  SPEAKER_00: The non-human workforce.
• 0:14
  SPEAKER_00: Across 12 podcasts, we lay out the complete operational architecture, from discovering hidden machine accounts and establishing strict human custodianship to decoupling governance from secrets vaults, eliminating static passwords, securing autonomous AI agents, and establishing an evidence-based operating model that survives long term.
• 0:35
  SPEAKER_00: That brings us to episode one.
• 0:37
  SPEAKER_00: The Identities Nobody Hired.
• 0:40
  SPEAKER_00: In this opening episode, we examine the systemic failure of trying to govern machine credentials with workforce HR tools.
• 0:47
  SPEAKER_00: We break down the six distinct classes of non-human identities, the structural absence of joiner-mover-lever lifecycle triggers, and why vaulting passwords without lifecycle accountability only secures unmonitored risk.
• 1:01
  SPEAKER_00: Let's step directly into the technical reality.
• 1:05
  SPEAKER_02: Okay, let's unpack this because um right now, inside your enterprise network, you have these invisible contractors just roaming the halls.
• 1:13
  SPEAKER_00: Yeah, and quite a lot of them, actually.
• 1:14
  SPEAKER_02: Right.
• 1:15
  SPEAKER_02: I mean, I am not talking about a handful of them.
• 1:17
  SPEAKER_02: Depending on your environment, these unseen workers outnumber your actual human employees by as much as 144 to one.
• 1:24
  SPEAKER_00: Which is just a massive scale.
• 1:26
  SPEAKER_02: It really is.
• 1:26
  SPEAKER_02: And some of them are carrying master skeleton keys that open every single digital door in your company.
• 1:31
  SPEAKER_02: Oh, for sure.
• 1:32
  SPEAKER_02: While, you know, some are just walking around holding handwritten sticky notes that basically just say, let me in.
• 1:37
  SPEAKER_02: But here is the kicker: they don't have an HR file, they don't have a background check, and honestly, worst of all, when the human who hired them leaves the company, these invisible contractors just keep on working indefinitely.
• 1:50
  SPEAKER_00: Aaron Powell They just stay forever.
• 1:52
  SPEAKER_02: Exactly.
• 1:53
  SPEAKER_02: So welcome to this custom tailored deep dive.
• 1:55
  SPEAKER_02: Our mission today is to completely break down the non-human identity problem or NHI in the enterprise.
• 2:01
  SPEAKER_02: And this is specifically designed for you, the security and identity leaders on the front lines.
• 2:06
  SPEAKER_01: Yep.
• 2:06
  SPEAKER_02: We are going to explore exactly what this problem is, why it exists, and well, why it critically matters to the business.
• 2:13
  SPEAKER_00: And to do this right, we are pulling from a massive stack of source material today.
• 2:18
  SPEAKER_00: We are looking at 2026 architectural blueprints, uh NIST technical series publications, and some really deeply researched white papers from industry heavyweights.
• 2:30
  SPEAKER_02: Like Sailpoint and CyberArc, right?
• 2:32
  SPEAKER_00: Right.
• 2:32
  SPEAKER_00: SailPoint, CyberArc, Okta, and Ping Identity.
• 2:36
  SPEAKER_00: And we are also cross-referencing all of that with the latest threat reports from Git Guardian, Verizon, and Intro Labs.
• 2:43
  SPEAKER_00: So we can show you exactly how attackers are exploiting this space today.
• 2:48
  SPEAKER_02: So if you are managing enterprise security right now, you know the landscape is shifting rapidly.
• 2:54
  SPEAKER_02: I mean, we spend so much time and budget putting multi-factor authentication and conditional access on our human workforce.
• 3:00
  SPEAKER_00: Oh, absolutely.
• 3:01
  SPEAKER_02: But you know, human beings are rapidly becoming the minority of actors on the network.
• 3:06
  SPEAKER_00: Aaron Ross Powell And that shift is exactly where we need to start.
• 3:10
  SPEAKER_00: Because before we can even solve the non-human identity problem, you have to understand the sheer variety of the landscape.
• 3:17
  SPEAKER_02: Aaron Powell Right.
• 3:17
  SPEAKER_02: It's not just one thing.
• 3:18
  SPEAKER_00: Aaron Powell Exactly.
• 3:19
  SPEAKER_00: When people hear machine identity or service account, they tend to picture one specific type, usually some old server in a basement running a batch script.
• 3:28
  SPEAKER_02: Yeah, totally.
• 3:28
  SPEAKER_00: Aaron Powell But the reality is that the enterprise is currently juggling six distinct classes of non-human identity, and each one operates completely differently.
• 3:38
  SPEAKER_02: So let's actually walk through how these different invisible contractors operate, starting with uh the oldest part of the network infrastructure, your directory service accounts.
• 3:47
  SPEAKER_00: Aaron Powell Right.
• 3:48
  SPEAKER_00: So think of directory service accounts as the grandfathers of the network.
• 3:52
  SPEAKER_00: They usually live right inside your core directory, like Active Directory on premise.
• 3:57
  SPEAKER_01: Okay.
• 3:57
  SPEAKER_00: And structurally, they carry a static, non-expiring password.
• 4:02
  SPEAKER_00: These were set up maybe 10 or 15 years ago to run a critical background service, you know, like syncing databases or managing print spoolers.
• 4:09
  SPEAKER_02: Aaron Powell And nobody ever changes the password because everyone is just terrified that updating it will somehow crash the entire European payroll system.
• 4:16
  SPEAKER_00: Aaron Powell Exactly.
• 4:17
  SPEAKER_00: The risk of breaking a legacy system paralyzes the IT team.
• 4:21
  SPEAKER_00: So that static password just sits there forever.
• 4:24
  SPEAKER_02: Wow.
• 4:25
  SPEAKER_02: Okay, what's next?
• 4:26
  SPEAKER_00: Moving up the stack, we get into the second class, application and database accounts.
• 4:31
  SPEAKER_00: So when a web app needs to pull data from a back-end database, it doesn't log in through a web portal like a human.
• 4:38
  SPEAKER_00: It relies on passwords that are embedded directly into the database connection strings.
• 4:42
  SPEAKER_02: Aaron Powell Which means the username and password are literally just sitting in plain text inside a configuration file on a server somewhere.
• 4:48
  SPEAKER_00: Aaron Powell Yeah, exactly.
• 4:49
  SPEAKER_02: Aaron Powell So if a bad actor gets read access to that single configuration file, they instantly have the keys to the entire customer database?
• 4:56
  SPEAKER_00: That is the exact mechanism.
• 4:58
  SPEAKER_00: Now, as enterprises migrated away from those traditional on-premise servers, they created the third class, which is cloud workload identities.
• 5:06
  SPEAKER_02: Okay, so this is the newer stuff.
• 5:09
  SPEAKER_00: Right.
• 5:09
  SPEAKER_00: We are talking about modern ephemeral infrastructure running in AWS, Azure, or Google Cloud.
• 5:15
  SPEAKER_00: These are your virtual machines, your containers, and your serverless functions.
• 5:19
  SPEAKER_01: Aaron Powell, break down ephemeral for a second because that changes the nature of the identity, right?
• 5:24
  SPEAKER_00: Aaron Powell It changes everything.
• 5:25
  SPEAKER_00: I mean, an AWS Lambda function might spin up, execute a piece of code for three seconds, and then completely destroy itself.
• 5:32
  SPEAKER_00: But to do that three-second job, it still needs an identity to prove it is allowed to access other cloud resources.
• 5:39
  SPEAKER_01: I see.
• 5:40
  SPEAKER_00: So these cloud workloads authenticate using client secrets or access keys.
• 5:44
  SPEAKER_00: And because the infrastructure scales up and down dynamically by the minute, these identities just proliferate at a massive rate.
• 5:51
  SPEAKER_02: Aaron Powell Which leads us right into the fourth class, and this is one that developers absolutely love, but security teams constantly struggle to manage.
• 5:59
  SPEAKER_02: API keys and tokens.
• 6:00
  SPEAKER_00: Yeah, API keys are essentially the glue of the modern internet.
• 6:04
  SPEAKER_00: When your marketing software needs to talk to your CRM, they use an API key.
• 6:09
  SPEAKER_00: But structurally, these utilize what we call bearer tokens.
• 6:13
  SPEAKER_01: Okay.
• 6:14
  SPEAKER_00: A bearer token is exactly what it sounds like.
• 6:16
  SPEAKER_00: Whoever bears the token gets the access.
• 6:18
  SPEAKER_02: Aaron Powell It's like a hotel key card.
• 6:20
  SPEAKER_00: Exactly.
• 6:21
  SPEAKER_02: The door doesn't look at your driver's license to see if you are actually the person who booked the room.
• 6:25
  SPEAKER_02: If you hold the plastic card, the door opens.
• 6:27
  SPEAKER_02: But the terrifying part about these API bearer tokens is that they have absolutely no expiry, right?
• 6:34
  SPEAKER_00: Aaron Ross Powell That is the crucial flaw.
• 6:36
  SPEAKER_00: I mean, a human session token expires after a few hours, but an API key generated for a background script is effectively a permanent blank check for whatever permissions it was originally granted.
• 6:47
  SPEAKER_00: Aaron Powell That's wild.
• 6:48
  SPEAKER_00: Aaron Powell If a developer pastes that key into a Slack channel or drops it into public code, that blank check is just out in the wild forever.
• 6:56
  SPEAKER_02: Aaron Powell Which brings us into the automation side of the house.
• 6:59
  SPEAKER_02: Class five is RPA or robotic process automation bots.
• 7:03
  SPEAKER_02: These are the software robots that companies buy to do repetitive data entry, like a bot that reads PDF invoices and types the information into an accounting system.
• 7:11
  SPEAKER_00: Aaron Powell Right.
• 7:12
  SPEAKER_00: And because these RPA bots are literally designed to mimic human actions on a graphical screen, they carry interactive capable directory credentials.
• 7:21
  SPEAKER_02: Oh, interesting.
• 7:22
  SPEAKER_00: Aaron Powell Yeah, those human-style credentials are securely stored in a central orchestrator, and the bot just checks them out to log into systems exactly like an employee would.
• 7:31
  SPEAKER_02: Okay.
• 7:31
  SPEAKER_02: And finally, the category that is keeping everyone up at night right now, class six AI agents.
• 7:38
  SPEAKER_02: And we aren't just talking about chatbots anymore.
• 7:40
  SPEAKER_02: We are talking about autonomous systems that read your emails, analyze your data, and take actions on your behalf.
• 7:46
  SPEAKER_00: Right.
• 7:47
  SPEAKER_00: And to do that, AI agents depend on inherited user tokens, or they use API keys that are embedded directly in the agent itself.
• 7:56
  SPEAKER_00: Often these permissions are defined in what is called a model context protocol configuration file, an MCP file.
• 8:03
  SPEAKER_01: Okay.
• 8:04
  SPEAKER_00: This file basically tells the AI what data repositories it is allowed to read from and write to.
• 8:10
  SPEAKER_02: So the AI agent is essentially operating with the exact same access rights as the human developer who set it up, even when that developer is asleep.
• 8:18
  SPEAKER_00: Exactly.
• 8:20
  SPEAKER_00: What's fascinating here is how all six of these machines, from the oldest legacy directory service to the newest autonomous AI agent, are essentially masquerading on the network.
• 8:31
  SPEAKER_00: They are authenticating with credentials that were fundamentally designed for human beings to use.
• 8:36
  SPEAKER_02: Right.
• 8:37
  SPEAKER_02: The network just sees a username and a password or a token and says, okay, come on in.
• 8:42
  SPEAKER_02: But because they are carrying human-style credentials, it is incredibly tempting for IT teams to just manage them using the exact same paradigms we use for our employees.
• 8:52
  SPEAKER_02: And that structural misunderstanding is what creates these massive blind spots.
• 8:56
  SPEAKER_00: Oh, it really does.
• 8:58
  SPEAKER_00: And let's break down why that structural difference is so critical.
• 9:02
  SPEAKER_00: Workforce identity, human identity, relies entirely on an authoritative source.
• 9:07
  SPEAKER_02: Aaron Powell, which is usually HR.
• 9:08
  SPEAKER_00: Right.
• 9:09
  SPEAKER_00: In almost every enterprise, that authoritative source is the HR system.
• 9:13
  SPEAKER_00: When a new person is hired, HR enters their data into a system like workday.
• 9:17
  SPEAKER_00: That HR event triggers the automated creation of their digital identity.
• 9:22
  SPEAKER_00: When they change departments, HR updates the file and their access shifts.
• 9:26
  SPEAKER_02: And when they leave, it's cut off.
• 9:28
  SPEAKER_00: Exactly.
• 9:29
  SPEAKER_00: When they are terminated, HR cuts the cord and all their access is revoked globally.
• 9:34
  SPEAKER_00: But non-human identity has absolutely no authoritative source.
• 9:38
  SPEAKER_02: Aaron Powell Because there is no HR department for Python scripts and API keys.
• 9:42
  SPEAKER_00: None.
• 9:42
  SPEAKER_00: And the systemic consequences of this missing HR link are just severe.
• 9:47
  SPEAKER_00: First and foremost, you lack life cycle triggers.
• 9:50
  SPEAKER_00: Right.
• 9:50
  SPEAKER_00: There are no joiner, mover, or lever events for a machine.
• 9:54
  SPEAKER_00: Nobody tells the identity management system when an application is decommissioned.
• 9:58
  SPEAKER_00: So its credentials just stay active.
• 10:02
  SPEAKER_02: And you can't layer on the security controls we rely on for humans, right?
• 10:05
  SPEAKER_02: You cannot enforce a second factor.
• 10:08
  SPEAKER_00: Right.
• 10:08
  SPEAKER_02: I mean, if an automated script is running at two in the morning, you can't prompt it to look into a camera for facial recognition or ask it to tap a number on a mobile authenticator app.
• 10:17
  SPEAKER_00: Aaron Powell You really can't.
• 10:19
  SPEAKER_00: And you also run into the issue of shared and interactive capable credentials.
• 10:24
  SPEAKER_00: Because these machines use human-style passwords, multiple systems might end up sharing the exact same credentials just as simplify deployment.
• 10:32
  SPEAKER_02: Which sounds like a nightmare.
• 10:34
  SPEAKER_00: It is, because worse, an attacker could theoretically steal that credential and log in interactively through a VPN, looking exactly like a normal background process.
• 10:44
  SPEAKER_02: Aaron Powell We also provision them completely backward, don't we?
• 10:47
  SPEAKER_02: When a new employee starts, we usually give them the bare minimum access and make them request more as needed.
• 10:52
  SPEAKER_02: But with machines, privilege is granted by default at install time.
• 10:57
  SPEAKER_00: Oh, constantly.
• 10:58
  SPEAKER_02: We over-provision the service account with global admin rights just to make absolutely sure the application installs correctly, and then we never, ever go back to revoke that excess privilege.
• 11:08
  SPEAKER_00: Which leads to the single most dangerous consequence.
• 11:11
  SPEAKER_00: Ownership completely dissolves the moment the human creator changes roles.
• 11:15
  SPEAKER_01: Oh yeah.
• 11:16
  SPEAKER_00: Imagine a senior cloud architect spins up a workload identity, attaches a client secret with administrative access, and then six months later leaves the company.
• 11:26
  SPEAKER_00: Their human account is deactivated by HR immediately.
• 11:29
  SPEAKER_00: But the machine identity they built just keeps running.
• 11:32
  SPEAKER_02: It's just left behind.
• 11:34
  SPEAKER_00: Yeah, it is completely orphaned in the environment, holding administrative keys with absolutely no human accountable for it.
• 11:41
  SPEAKER_00: This raises an important question about how governance frameworks struggle to keep pace with technology.
• 11:47
  SPEAKER_00: Because the reality is that no formal assurance standard exists for machines right now.
• 11:51
  SPEAKER_00: The official playbook literally leaves them out.
• 11:54
  SPEAKER_02: Wait, if NIST literally wrote the book on digital identity, how can they just leave out the fastest-growing category of identities?
• 12:01
  SPEAKER_02: Are enterprises just expected to fly completely blind?
• 12:05
  SPEAKER_02: I mean, you look at NIST's special publication 800-63-4, which was just finalized in July 2025, it explicitly states that machine-to-machine authentication is out of scope.
• 12:16
  SPEAKER_01: Right.
• 12:16
  SPEAKER_02: That feels like writing a fire safety code, but saying it only applies to human beings, not the actual electrical wiring causing the fires.
• 12:22
  SPEAKER_00: Aaron Powell It is a massive gap.
• 12:24
  SPEAKER_00: And because there is no formal standard and no HR system for machines, this structural governance gap has resulted in a quantifiable explosion of enterprise risk as we look at the data for 2026.
• 12:37
  SPEAKER_02: The numbers are staggering when you actually isolate them.
• 12:40
  SPEAKER_02: Let's look at the sheer volume first.
• 12:43
  SPEAKER_02: Depending on how an organization measures an identity, the machine-to-human ratio ranges drastically.
• 12:49
  SPEAKER_02: According to Rubrik Zero Labs data spanning 2025 to 2026, the average ratio is about 45 to 1.
• 12:57
  SPEAKER_02: But if you look at EntroLab's 2025 research, specifically targeting cloud native and DevOps environments, it skyrockets to 144 to 1.
• 13:06
  SPEAKER_00: And this is not a static problem.
• 13:08
  SPEAKER_00: It is an exponential curve.
• 13:10
  SPEAKER_00: That same EntroLab's data from 2024 to 2025 tracked a 40 to 44% year-over-year growth for machine identities and AI agents alone.
• 13:20
  SPEAKER_02: And how are developers handling the credentials for this massive influx of machines?
• 13:25
  SPEAKER_02: Well, according to Git Guardian's State of Secret Sprawl 2026 report, it's getting worse.
• 13:30
  SPEAKER_02: There were 28.65 million hard-coded secrets pushed to public repositories in 2025.
• 13:37
  SPEAKER_02: That is a 34% year-over-year growth in developers accidentally pasting API keys and database passwords into public GitHub repos.
• 13:45
  SPEAKER_00: But the data point from that Git Guardian 2026 report that truly highlights the lifecycle failure is this.
• 14:09
  SPEAKER_00: Exactly.
• 14:10
  SPEAKER_02: But a highly privileged database password gets leaked onto the public internet and it just sits there, completely valid and active for four years.
• 14:18
  SPEAKER_00: It sits there because nobody knows what it connects to.
• 14:22
  SPEAKER_00: And nobody wants to be the person who breaks a production system by turning it off.
• 14:27
  SPEAKER_00: And attackers know this is our blind spot.
• 14:29
  SPEAKER_00: The Verizon Data Breach Investigations Report for 2024, combined with the IBM cost of a data breach reports for 2025 and 2026, show that stolen or compromised credentials are the leading initial access factor, accounting for 16% of all breaches.
• 14:45
  SPEAKER_02: And these breaches heavily feature credential abuse and third-party NHI involvement.
• 14:50
  SPEAKER_02: I mean, a perfect example of this in the source material is the UNC 6395 incident from 2025.
• 14:56
  SPEAKER_00: That was a textbook execution of this vulnerability.
• 14:59
  SPEAKER_00: The attackers didn't fish a human.
• 15:01
  SPEAKER_00: They stole OAuth tokens that belonged to a third-party integration.
• 15:05
  SPEAKER_00: And by impersonating that trusted integration, they utilized the embedded cloud access keys to move laterally across multiple environments, completely bypassing traditional perimeter defenses.
• 15:16
  SPEAKER_00: A single, poorly governed machine identity compromised the entire interconnected trust system.
• 15:22
  SPEAKER_02: The wild part is that enterprises know they are failing here.
• 15:25
  SPEAKER_02: Okta's AI at Work 2025 survey notes that 44% of organizations admit they have absolutely no governance in place for these identities, and 23% report direct credential exposure.
• 15:49
  SPEAKER_00: The overarching theme of all these surveys is just fear.
• 15:53
  SPEAKER_00: Organizations are actively retaining dormant machine identities because they lack real-time visibility into what those credentials actually do, and they are terrified of the operational impact of deletion.
• 16:05
  SPEAKER_02: So IT teams have essentially become digital pack rats.
• 16:08
  SPEAKER_02: They are hoarding tens of thousands of dormant, unnamed API keys because they are terrified that deleting one will accidentally shut down the primary e-commerce server.
• 16:17
  SPEAKER_00: Aaron Powell Pretty much.
• 16:19
  SPEAKER_02: So what does this all mean for the business?
• 16:21
  SPEAKER_02: Looking at this 2026 landscape of exponential sprawl and millions of endlessly valid, leaked secrets, it is painfully obvious that halfway measures are not going to stop the bleeding.
• 16:32
  SPEAKER_00: Which brings us to the core thesis of a truly defensible NHI program.
• 16:37
  SPEAKER_00: You have to address both sides of the coin: governance and modernization.
• 16:42
  SPEAKER_01: Right.
• 16:43
  SPEAKER_00: If you only do governance, meaning you just run a discovery tool to figure out who owns what account, you simply produce a highly accurate registry of accounts that are still authenticating with decade-old static passwords.
• 16:55
  SPEAKER_00: You know who owns the risk, but the attack surface hasn't actually shrunk.
• 17:00
  SPEAKER_02: Right.
• 17:00
  SPEAKER_02: A list of weak passwords is still a list of weak passwords.
• 17:04
  SPEAKER_02: But on the flip side, if you only do credential modernization, meaning you just buy a PAM system, a privileged access management solution, you end up with a different problem.
• 17:13
  SPEAKER_00: Right.
• 17:13
  SPEAKER_02: A PAM system is basically a high-tech digital safe that automatically changes the combination to your passwords every day.
• 17:19
  SPEAKER_02: But if you just sweep all your existing accounts into that vault without governance, you just fill a highly secure safe with rotating secrets for accounts that nobody can actually justify the existence of.
• 17:30
  SPEAKER_00: Exactly.
• 17:31
  SPEAKER_00: You are securing the secret itself, but you have absolutely no idea if the underlying machine holding that secret should even be authorized to operate on your network.
• 17:40
  SPEAKER_00: Therefore, a truly defensible program must run both tracks, governance and credential monetization, simultaneously, actively referencing the exact same registry of identities.
• 17:51
  SPEAKER_02: Here's where it gets really interesting.
• 17:54
  SPEAKER_02: Because I can hear IT operations teams groaning right now, they are under massive pressure to show immediate security improvements.
• 18:00
  SPEAKER_02: They're going to argue, can't we just vault the passwords first to stop the immediate bleeding?
• 18:04
  SPEAKER_02: Let's put everything in the PAM safe today so attackers can't steal static passwords, and we'll figure out who actually owns the accounts next year.
• 18:11
  SPEAKER_00: If we connect this to the bigger picture, taking that shortcut is incredibly counterproductive.
• 18:17
  SPEAKER_00: Vaulting an unjustified orphaned account just creates highly secure ghosts in the machine.
• 18:22
  SPEAKER_01: Yeah.
• 18:23
  SPEAKER_00: You are now spending valuable compute cycles, software licensing, and administrative overhead to automate password rotation for a legacy background service that hasn't actually executed a legitimate business function in three years.
• 18:35
  SPEAKER_00: Well, yeah.
• 18:36
  SPEAKER_00: That identity shouldn't be vaulted, it should simply be deleted.
• 18:39
  SPEAKER_00: Governance and modernization have to inform each other.
• 18:42
  SPEAKER_00: The governance engine tells the vault which accounts are officially approved to exist by a human owner, and the vault tells the governance engine that those specific approved accounts are utilizing secure, actively rotated credentials.
• 18:55
  SPEAKER_02: But even when security leaders understand that dual track thesis conceptually, enterprises routinely stumble when it comes to actual deployment.
• 19:03
  SPEAKER_02: They fall into the exact same predictable operational traps over and over again.
• 19:08
  SPEAKER_00: So let's walk through the five exact reasons we see NHI programs fail in the enterprise.
• 19:13
  SPEAKER_00: The first trap is treating the inventory as the deliverable.
• 19:17
  SPEAKER_02: This is the spreadsheet trap.
• 19:18
  SPEAKER_02: A team runs a massive network discovery scan.
• 19:22
  SPEAKER_02: They find 50,000 service accounts, they export it to a spreadsheet, and they declare to the board that they have achieved visibility.
• 19:29
  SPEAKER_02: But a list is not governance.
• 19:31
  SPEAKER_02: If you aren't forcing human beings to attest to owning those accounts and you have no automated lifecycle policies to manage them moving forward, you haven't governed anything.
• 19:40
  SPEAKER_02: You've just cataloged a massive pile of risk.
• 19:43
  SPEAKER_00: The second failure is treating the vault as the governance platform.
• 19:47
  SPEAKER_00: We see companies deploy a secret manager or a PAM solution and assume the problem is solved.
• 19:52
  SPEAKER_01: But it's not.
• 19:52
  SPEAKER_00: No, because vaults manage secrets, they do not manage lifecycle policies or ownership.
• 19:58
  SPEAKER_00: The vault does not know if the human developer who originally requested that API key was fired yesterday.
• 20:03
  SPEAKER_00: It only knows how to rotate the key.
• 20:05
  SPEAKER_02: Aaron Powell, which feeds directly into reason number three: modernizing credentials before ownership is known.
• 20:10
  SPEAKER_02: Like we just talked about, rotating a secret for a completely orphaned account is useless.
• 20:15
  SPEAKER_02: If you don't know the business application an account belongs to and you don't know the human responsible for it, you have no business modernizing its credentials.
• 20:23
  SPEAKER_02: You should be actively quarantining it.
• 20:25
  SPEAKER_00: But that requires organizations to overcome reason number four, avoiding deletion indefinitely.
• 20:30
  SPEAKER_00: The fear of breaking legacy systems leaves the attack surface wide open.
• 20:34
  SPEAKER_01: Right.
• 20:35
  SPEAKER_00: If you discover a dormant database credential that hasn't authenticated 90 days, you cannot just leave it active just in case it's needed next quarter.
• 20:45
  SPEAKER_00: An attacker doesn't care that you are afraid of an outage.
• 20:48
  SPEAKER_00: They just care that the credential still grants access.
• 20:51
  SPEAKER_00: If you refuse to delete or quarantine dormant accounts, you're actively choosing to maintain a massive, unmonitored attack surface.
• 20:59
  SPEAKER_02: And finally, reason number five, deferring AI agents to a later phase.
• 21:03
  SPEAKER_02: So many teams build a multi-year roadmap and say, we will clean up our legacy on-premise service accounts in phase one, and we'll deal with the AI bots in phase three maybe next year.
• 21:14
  SPEAKER_00: You absolutely cannot do that.
• 21:15
  SPEAKER_02: No, AI agents are the fastest-growing and highest-risk category of non-human identity.
• 21:20
  SPEAKER_02: They operate at machine speed, often with highly dynamic shifting permissions.
• 21:24
  SPEAKER_02: They cannot wait for phase three.
• 21:26
  SPEAKER_00: If you defer them, you are ignoring the most volatile and heavily targeted part of your entire identity landscape.
• 21:32
  SPEAKER_02: It's absurd.
• 21:33
  SPEAKER_02: I mean, failing on these five points is exactly like putting a state-of-the-art cryptographically sealed smart lock on a door, but having absolutely no idea what room that door leads to, who is holding the key card, or if the room should even exist in your building in the first place.
• 22:01
  SPEAKER_02: And addressing this requires a unified program that tackles governance and credential modernization simultaneously, avoiding common pitfalls like deferring AI agents or treating vaults as governance platforms.
• 22:14
  SPEAKER_00: Ungoverned service accounts and unmonitored API tokens do not remain passive.
• 22:19
  SPEAKER_00: In episode two, Beyond Fishing, breaking the enterprise through non-human access, we perform a technical breach autopsy on the top five machine identity exploitation paths, detailing curb roasting ticket extractions, stolen credentials from continuous integration and continuous delivery pipelines, and the August 2025 third-party OAuth CRM compromises.
• 22:42
  SPEAKER_00: Tune in next Tuesday for the next episode in this series.
• 22:46
  SPEAKER_00: Our dual track release schedule airs the non human identity blueprint every Tuesday and identity threat and defense every Thursday.
• 22:54
  SPEAKER_00: Connect with me on LinkedIn at www.linkedin.com forward slash IN slash Ernie Prescott.