5 posts
A detection engineer's map of the NHI vendor landscape — and why it's being acquired into platforms before it built the part that catches breaches.
Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host — use from elsewhere is theft.
An AI agent is a non-human identity with an opaque decision layer. You can't detect the prompt injection — so watch what the agent's credential does.
92% of identities are over-permissioned and creep leaves no log line. Stop treating the blast radius as cleanup — instrument it instead.
You have ~45 non-human identities per human — and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.