AI News - Mid-October 2026

0:08Aaron Good morning, good evening wherever you are, and welcome back to the Enterprise AI Show. This is your host, Aaron, and our topic this week is agents, identities, and security. Now, AI agents are multiplying across the enterprise, and attackers armed with AI can now go from an initial access to stolen data in about an hour.

0:29Aaron This week, Brandon sits down with Amy Blackshaw, SVP of Identity Marketing at Palo Alto Networks, to talk about zero standing privileges, securing agents as first-class identities, and why identity has become the control point for enterprise AI. And all of that is coming up right after this quick break.

0:55Aaron What does the outside world already know about your company? Cybercriminals could be seeing leaked credentials, compromised session cookies, exposed infrastructure, and even impersonations of your brand and executives. NordLayer Intelligence by NordStellar gives security teams visibility into those threats across the deep and dark web, data breaches, attack surfaces, and brand impersonation all in one platform.

1:23Aaron Find out what attackers know before they can use it. Visit nordlayer.com/intelligence/enterpriseai and use code enterprise10 for ten percent off your NordStellar plan

1:42Brian Today's show is sponsored by Palo Alto Networks. Every time your team deploys a new cloud workload or AI agent, another identity gets permanent access to your critical systems. Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged. That's why Idira by Palo Alto Networks comes in.

2:01Brian Human, machine, AI, one identity platform for all of them. Idira replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with Idira by Palo Alto Networks. Visit paloaltonetworks.com/idira. Again, that's paloaltonetworks.com/IDIRA.

2:28Brandon And we're back. Joining me today is Amy Blackshaw, Senior Vice President, Identity Marketing, Palo Alto Networks. Welcome to the show, Amy

2:36Amy Thanks for having me. Super excited to be here

2:39Brandon Well, listen, as I was just saying, we're gonna talk about one of my favorite subjects, identity management, today. But before we get into that, we always like to learn a little bit about our guests and if you will hear your origin story. So how did you get to Palo Alto Networks? Tell us your story

2:53Amy okay. That sounds great. I have been in cybersecurity for almost 20 years. I've spent most of that running product marketing across large vendors who are trying to help our customers solve very complex problems. The past four years I spent leading product marketing at a company called CyberArk, the leader and the pioneer of privileged access management.

3:17Amy Hopefully, a lot of listeners have heard of CyberArk. And as of February 2026, CyberArk became part of Palo Alto Networks when we were acquired. So I found myself at Palo Alto Networks leading marketing across the identity business unit under the new brand, Ideera. And we're very excited to bring CyberArk into the Palo Alto Networks fold.

3:41Amy Get lots of innovation, lots of speed, lots of scale, and it's been just a great, fabulous experience thus far, and we're looking forward to continuing the thrust of identity security under Palo Alto Networks moving forward

3:53Brandon Well, that's fantastic. It sounds-- And congratulations on the acquisition. Sounds sounds like it's going well, which is always good to hear. I was, I s- I was mentioning before, like I really personally, have an affinity for identity management. I feel like sometimes it doesn't get as much love as it maybe should, but maybe that's just my own bias.

4:07Brandon But maybe for everybody, 'cause I think a lot of us, a lot of people get ex- are exposed to identity management without knowing it all the time, and all the things are going behind the scenes. So why don't you just level set for us, what exactly is identity management? And more importantly, like what are the problems that either people should know that are being solved or being solved maybe behind the scenes for them?

4:27Amy Yeah, it's a great question, and I think there is a long history of identity management within sort of the IT confinement, where, you know, for a long time, identity was really about managing identities. And what does that mean? That means when you log in as an employee, you need to have the right credentials, the right entitlement in order to get access to the things that you need to do your job.

4:52Amy And what does an IT team want to do? They wanna make sure you can do your job and not get in your way. So for a very long time, identity management was exactly that. It was about the management of identities from an operational perspective versus a security perspective. And then really what came along was this idea that identities needed to be far more than just managed, they actually needed to be secured.

5:18Amy Because attackers started to realize very quickly that, "Man, if I get access to an identity, I can really pretend to be that identity, act as if I am that identity, move laterally, find privileges, find, the data, the access, whatever my end goal is, if I can just simply get access to that, that identity."

5:39Amy So this idea of identity security has been around for a long time. CyberArk, now Palo Alto Networks being a major leader in this space, which has moved beyond just the management of your identities. Single sign-on or m- multi-factor authentication. These technologies have been along for a long time. They're uber important, and they are controls that organizations absolutely need.

6:02Amy But the idea that you can just manage an identity at that point in time of authentication is a false one. Identities need to be secured throughout their full life cycle. And guess what? Of course, they're not just about human identities. We're talking about machine identities like service accounts. We're talking about code and API calls.

6:19Amy But more and more, guess what we're talking about? AI agents and agentic workflows needing identity security. Because without it, we're not gonna get ahead of this problem, and we're going to see continued headlines, where attackers are taking advantage of identity over and over again

6:36Brandon Yeah, so identity more than important, more important than ever, I think, to to your point, and certainly with agents, it's getting a little bit more complicated. But, there's one other area before we dive a little bit more on the security side is I think people should know a little bit about the governance side, because I think s- a lot of times people are actually part of the governance process, they don't know it, right?

6:51Brandon Someti- many people, I bet you listening to this, get some quarterly email that says "Do you still need access to Salesforce or to some other system of record usually?" So why don't you talk a little bit about what exactly is that, and then how that maybe ties into a little bit with security as well?

7:06Amy Sure. And to even expand upon that a little bit, there are three sub-segments within identity security. There's identity access management. This is the traditional access management, MFA, SSO capabilities I was just talking about. You have privileged access management, which was for the few and far between, these IT admins who we knew had access to the keys to the kingdom, so we wanted to lock them down.

7:27Amy And guess what? They would tolerate that because that was their job, and so very often they would have to go through harder access controls, and it was not transparent to them. They had to participate in logging into the vault. We've changed that entire industry as well. And then what you're getting to is identity governance administration, this idea that identities need to be governed throughout their life cycle.

7:48Amy And then, yes, organ- people sitting across the lines of business need to make these quarterly attestations that people on their team, yes, need access to that. And whenever you have a human-based workflow like that first of all, it's painful if you're on the receiving end of those, right? It's also riddled with error.

8:07Amy It's riddled with people being like, "Man, I don't wanna do this again this quarter, so I'm just gonna approve everything." And this is why identity scope and identity creep happens, and this is why entitlements can follow somebody from… I was at RSA for 11 years as an employee. Where I started was very different from where I ended, and my identity probably remains very similar throughout those 11 years, right?

8:34Amy Nobody updated my access to systems that I probably didn't need access to anymore. And again, this, only gets exacerbated by, the continuation of SaaS applications, agentic applications. All of the things that we want to use day to day, it becomes very hard to stay on top of. So identity governance administration really is being upended today by vendors like IDR and Palo Alto Networks who are saying, "You don't need a standalone IGA capability.

9:05Amy You need to pull this into your identity security platform. You need to use agentic workflows to do this." There is a way to say, "I can probably pre-approve, 80% of my employees just abase- upon looking at AI-driven roles. What does this person actually need access to? What does somebody who looks like them from a role and and what they do day to day, and let's just pre-approve a lot of these."

9:31Amy That, again, is moving away from a very heavy technology to one in which we can put the right governance across the full cy- life cycle, and again, it has to be across all identities, not just human

9:43Brandon I really like that. And, for me, this has been like, I don't know, my own little pet peeve. It's like for a long time, the governance side was, I would say more like a checkbox item. Like you have an auditor has like this spreadsheet, and these emails go out. And then just what you said, everyone, most everyone just approves it.

9:57Brandon And you just end up with a whole surface, a massive surface of attack, right? And but everyone just goes off and the auditor's like, "Fine, you've demonstrated control, but you haven't really made anything more secure." So I always, personally, I've always been like, shouldn't be that way. So I'm glad to see you guys are making some inroads into making that better.

10:13Brandon Now, you already mentioned it, so of course, agents changing everything, changing the way we write code, changing w- how we do business. And you mentioned it earlier, now that I have Claude and I've got, all my agents running, maybe I've got 10, maybe I've got 50,000, depending who I am, how are you addressing this kind of whole new world with agents?

10:30Brandon What's Palo Alto doing?

10:32Amy Yeah, I think there are so many different ways to think about answering that question because, first and foremost, we need to enable our customers to secure against a new attack landscape, which is dramatically changed with frontier models, right? That's one. Number two is protecting the agents that your employees are using as a first-class identity, which they are.

11:02Amy So that's number two. And then number three, it's using AI within our product set to make sure that our pred- products are fighting AI with AI. So there's three, there's th- three layers there. I'll first start with this idea of the frontier model, if it's okay with you, and that, what we're seeing from an attack landscape is dramatically changing because of the cost that it takes to enter an enterprise if you're an attacker now.

11:30Amy So getting in is faster. AI agents are tireless, right? They're gonna continue to try to find vulnerabilities. They're gonna try to get in as fast as they can at a speed that we don't understand as humans 'cause it's a machine speed, right? They're able to get into organizations far faster than we have ever seen.

11:49Amy So this sort of idea of entry like drops down to zero And that means that you need to think about, yes, of course, detection and response, and all of the ways that you can identify if a threat has breached your enterprise. But far more important from a control perspective is understanding that once an attacker gets in, even if they are an AI attacker, if they're a human attacker, no, no matter if they're using the oldest trick in the book to get in or some new zero-day attack, which by the way, a lot of times it's just the old attacks that are getting used faster and faster versus like some magical zero-day.

12:27Amy But the, the point is, no matter what happens, the attacker, once they get in, are looking for an identity. Why? Because once they find an identity, they can abuse a standing standing access. They can escalate privileges, move laterally until they find the thing that they are looking for. And oh, by the way, if they do it through an identity attack vector, they're flying under the radar.

12:51Amy Many different security controls be compliant because they're tr- acting as a trusted user. You need to make sure that you are securing identity in a way that strips away standing access, that strips away entitlements that just sit there. Like y- to your point, time and time again, we need to move to zero standing privileges.

13:10Amy We need to move to just-in-time access, so that if an attacker finds an identity, guess what? They can't do anything 'cause the entitlement doesn't exist, even if they have their hands on their credential. So that's that's about using identity security, even in the face of frontier AI threats today, to ensure that identities are controlled and secured so that the a- attacker gets a dead end.

13:33Amy That's what we want. We want a dead end and stop attackers in their tracks. And then, of course, I'm sure we're gonna talk about what does it mean to secure an AI agent itself? Because that's the whole other angle of making sure that we're securing identities in the age of agentic workflows and AI agents

13:54Brandon So before we get to the agent side, 'cause we definitely want to get to that, I think it's good to talk about like how much faster things happen now. 'Cause you were talking before obviously you talk about the zero day, and I used to joke about this a lot when I used to work in this. It was everyone likes to talk about the zero day, but it's really like the, the most boring attack is usually the, the best.

14:08Brandon It's like someone finds a very bad c- password, an easy password to guess, and, no 2FA, and they get in. And then what typically happens is they use that account, and they just hunt around, right? To see if they can find another account, and then they, over time this is how like, smart attackers would eventually, a- accrue privileges, and they get some like a, maybe even get like your old product, get into your privileged identity manager, right?

14:29Brandon And so before, I would say like it wasn't instantaneous. It took a while, right? Like someone had to get an account and then do it. But what are you seeing now? It feels like with AI and an agent kind of on the other side is they're, they can hunt m- at like the speed of a computer, which is quite a bit faster.

14:44Brandon So are you seeing that? Like, how is that actually playing out in the quote unquote "real world"?

14:49Amy Yeah, absolutely. And we see this every day at Palo Alto Networks. So our Unit 42 organization is on the front line hand-in-hand with our customers, and they publish metrics about what you're talking about every year. And so I think it was in 2025, the fastest quarter of intrusions that they saw reached data exfiltration in about 72 minutes, right?

15:13Amy In 72 minutes, lots of things can happen, right? A, a security operations team can get an alert. They can take action, right? So 72 minutes, even though that's fast, felt manageably. Now, what we're seeing now is that's nearly five hours do- down five hours just from the year before. So AI is pulling more and more attackers towards this fast end of the spectrum, and that's what we have to pan- plan for because the latest Unit 42 investigation said that the entire intrusion, so where they actually hijacked the victim's own AI infrastructure along the way, took under 10 hours total.

15:55Amy So 10 hours for the entire attack, not just, the initial entry. And 10 hours that, that becomes harder and harder to think about how you're going to take full action to stop an attacker. So the, the timelines are shrinking, and we need to make sure that we have the right controls in place to stay a-ahead of them

16:18Brandon Yeah, no, it's pretty shocking and I think, sometimes we've all maybe experienced, maybe a lot of people listening have written a small app, maybe they've written a large app, and how quickly it generates source code and how fast you can move and stuff like that. So you do have to remember, like on the other side, the attacker side, it has the same access to how fast things can come, right?

16:33Brandon And I do think that's, it's shocking, right? It's you can't just like the old days of "I'll see it, it'll show up in a firewall, and maybe I'll lock that account down." It's like, it's impossible. If you're not like doing some type of, AI solution yourself or some type of programmatic solution, you're just, you're fighting, if you will, like almost with a bow and arrow.

16:48Brandon Like you don't have any-- you're almost defenseless in this day and age, which is important.

16:51Amy Yeah. Yeah. Like an attacker gets to try as many times as they want. A defender has to be right every single time, right? And that's always been the uneven playing field that we've lived in. But the fact of the matter is at the speed, like I was just talking about 10 hours for f- for full breach life cycle, but the difference in the initial intrusion is also like staggering, right?

17:18Amy Like initial access just happening in 25 minutes it's so quick, and that, that's what I was talking about when the price of entry is getting so close to zero that, we can talk about all the cool zero days that we want, but when you have an AI agent or an, a, some type of agentic infrastructure that is told to go do something, it's going to figure out how to do it.

17:42Amy And as we have all seen in these well-publicized, public- publicized breaches they're doing it very quickly. And so again, that's why we believe control in tandem with detection and response is the only way that you can stay one step ahead

17:57Brandon Absolutely. All right let's talk agents 'cause that's obviously where the, the action is. Old school identity management, I'm a new employee, I show up, I would get some common privileges, and then based on my job, maybe they give me some different access, and for the most part, off I'd go. And then maybe I'd ask for privileges, maybe I'd have some taken away, depending on my specific job role.

18:14Brandon But now we're in the world of agents, and I'm spinning up agents all day long. So how should people be doing this? How should we be, if you will, giving our agents an identity and managing them? What's the solution?

18:25Amy Yeah. I think first we need to think about not what is an agent, but from an identity perspective, how can we categorize a-agents? Because for so long, identity management, identity access management has been about humans, obviously. Privilege access management has extended to machine identities, and I think what's interesting about agents is that they are a machine identity.

18:49Amy At the core, they're software, they're machine, they're non-human. But they have very many attributes that make them human-like. They can reason, they can decide they can escalate their own privileges like a human might try to do, right? They have this very unique blend of human and non-human attributes, which again, makes them an interesting problem to solve from an identity perspective.

19:14Amy You can't MFA an agent, right? They have to be treated like a, a non-human. However, we also have to say we gotta strip away privileges to zero until we actually have a way to elevate that privilege just in time for when the agent needs it and then take it away back to zero so they, they don't abuse it themselves or become abused like we see identities happening today.

19:38Amy So I think that's the first thing that we need to think through. A-and then on top of that is that there are different types of agents, obviously. There are agents that work on behalf of… if I have an agent that is going out there and pulling information for me and working on the back end, that agent might be working on behalf of me.

19:56Amy And then you have agents that are autonomous, right? And so this makes the problem even more difficult. And so even though standards are being developed and most companies are deciding sort of agent by agent how they want to secure, we, believe that, first of all, an agent identity needs to be treated as a first-class identity within your infra- within your organization.

20:23Amy It needs to have an identity of its own, and then it needs to be the same way a human or a machine is. It needs to have least privilege, it needs to be able to use just-in-time access, it needs to be governed, the life cycle needs to be governed. It needs to make sure that it is going through some type of gateway that helps deploy policy and control and governance to ensure that these agents aren't running rampant within our infrastructure and causing major issues from an identity perspective

20:58Brandon Yeah, so it makes sense. So how does it actually work today? So if I, let's say I've created an an autonomous agent, and I-- it, it goes off and it does something me- for me every day, maybe a briefing or something along those lines. Maybe I even want it to read some of my corporate email and things like that.

21:11Brandon So think of a, a old school, in the old school world, like you would maybe say "I have a person, and I wanna give this person this access," and then go into the console, and I could do that. I could set it, and maybe it would expire, and things like that. So are you advocating for something along those lines, like where I actually take the time to if you will, register my agent and ask for permission, or is it done programmatically?

21:31Brandon Like how do people-- how do people-- how should people be doing it?

21:35Amy Yeah. It's a really good question. And listen, if we are going to try to say, "Hey, Mr. or Mrs. Developer," or anyone for that matter "You need to bear onus for making sure your your agent is registered," it's not gonna work, right?

21:49Brandon No, everyone would be annoyed.

21:50Amy Yeah, it's just not gonna happen, right? We just know that. And we have to approach both sort of human-in-the-loop agent access s- similarly to the way that we do autonomous agents. And it… We have to share sort of the same foundation, but there is a different source of trust between human-in-the-loop agent access and autonomous agents.

22:13Amy Both need to get their own unique identity, for sure, and that's not the onus of the person using the agent, right? That is on the, the s- the security standards and tools that are enabling an organization to leverage agents across their infrastructure. And it has to be their unique identity only with the access they specifically need with this idea of a complete audit trail, right?

22:38Amy We were just talking about sort of governance. When it comes to agents, we can't rely upon the LLM in the background to say, "Oh, we, we have auditability, and it's a black box. Don't worry about it." No, we need auditability about what the agent is doing with a complete trail so we understand that. And when, with a human in the loop, the person is the anchor.

23:02Amy The agent can borrow the person's authority, which needs to be really strictly reduced to the task at hand, and the human does approve that in the moments that matter, okay? So if you're working with an agent, there do… There should be steps where a human is approving whatever that may be. Whether it's b- pushing code to production or a- reaching out to a new API.

23:28Amy There needs to be areas in which the human needs to approve. Now, with an autonomous agent, policy has to be the anchor. So permissions have to be set tightly in advance, and behavior needs to be monitored, it needs to be watched, it needs to be continuously understood if something's happening that's an anomaly, and there has to be a kill switch.

23:48Amy There has to be a way to shut it off based on behav- behavior or if it's trying to work outside of its policy, right? That, those two things working hand-in-hand the technology underneath and how you deploy that is all, what our team is deploying for our customers within the IdeaRobo platform and a- across the board within our Prisma Airs platform.

24:08Amy But that's fundamentally at the bottom of it, this, this idea of the two different types of agents and how you have to think about controlling them

24:15Brandon All right, so let's kinda g- talk about the autonomous agent. Maybe give us a little flavor of the platform. So seems like most people, and obviously, Palo Alto has a long history here are watching the network, right? And s- it's that way, like seeing what's happening and controlling it that way. So if you will, they can kinda stay out of the way of the person, right?

24:29Brandon Let them do their work, and then if you will, in the background, make sure "Hey, I'm gonna, I'm gonna look at what's happening." So is… Are you taking that approach? What's your secret sauce behind the scenes to, if you will, provide the security, but at the same time let me get my job done?

24:44Amy Yeah. I think, it- we first fundamentally have to be thinking about the overall security across the board. That's where I think, again, coming in from CyberArk, we had a platform that secured every identity, human, machine, and i- and agents with the right level of privilege control. So that was about putting the right level of control commiserate with the amount of risk based on what that identity was trying to do.

25:09Amy That still exists as part of the identity and the Ideera platform. But what we see in the security landscape is that… And this is a a micro statement to this idea of platformization, right? That you can't have these piece puzzles of solution just securing one part of the problem. You have to have best-in-class technology across the entire the entire landscape of a security that you're trying to provide a solution for.

25:41Amy And so as part of Palo Alto Networks, being part of Prisma Airs, right? The runtime security solution that is, yes, looking at identity as part of Ideera, but also looking at red teaming, looking at runtime, looking at the, the gateway itself provides far more value for organizations across securing the the new agentic world.

26:06Amy Now, when it comes to identity, right? We are that, the solution that is providing that as part of Airs. And we believe that, you have to carry least privilege, separation of duties, this definition of a life cycle, and then again, back to that audit- auditability, having a complete record of everything privileged.

26:26Amy And that's the way that we are solving the agentic problem from an identity perspective

26:31Brandon Okay, that all makes sense. That's good. So it's if you will the network, the proxy in between there. Now what about, you mentioned it a little more, human, a human in the loop. So everybody is coding these days. Everyone's using Cloud Code or something to the equivalent. And if you've ever used Cloud Code, you've been prompted to be where it asks you some complicated question like "Can I do this?" And then it gives you this very long thing, and you're like, "I think so." Like, why not?

26:53Brandon YOLO. And we don't really always know what it's asking for, but we know we wanna get our job done. So in that part of the world, and maybe for the developers that are at your company and other companies, like how are you trying to solve that problem while simultaneously not frustrating them and being like, "Hey, I can't get my job done because you keep rejecting access 'cause my agent wants to do this thing."

27:11Brandon That's a… There's like always a lot of tension there, and I know with your privileged identity background it's always like you wanna keep the developers… You don't want them to do the wrong thing, but you also want them to do their job. So it's always tension. How do you deal with that?

27:23Amy Yeah. It's a really great question. I think just to pull the thread on privileged access for developers, and I talked about this when we were in the opening around this idea of when privileged access management was invented by CyberArk 20… over 25 years ago now. It was this idea that an admin, an IT admin were the only privileged users, which we know is 100% not true now, right?

27:44Amy Every identity can become privileged in their day. But this idea that IT admins needed privileged access and so that they would log into a vault, copy and paste, and use that shared credential, that would be rotated and very secure within the vault, but it changed the way that they had to access things to do their job.

28:05Amy But it was commiserate with their risk, right? L- high level of security because there was high level of risk, and also commiserate with the level of friction that they would take on, right? They… It was part of the job. You try to put that control in front of a developer and forget it, right? A developer is never gonna stop their workflow for a security control.

28:27Amy It's just not the way that developers work. And guess what? Organizations don't wanna stop their developers. Developers, many times, are, like, the lifeline of revenue, right? So you don't wanna get in their way or slow them down. If anything, you wanna speed them up. And so leveraging privileged controls for developers, absolutely still fundamental and critical.

28:46Amy How do you do it? You do it in a way that doesn't get in their way, and this is this idea of a zero-standing privilege where the developer does not have entitlements associated with their credential until the point of time in that they need it. It's easily granted within their own workflow. You don't have to go outside of their, native workflow.

29:06Amy It's granted, and then it comes back down. Why do we do that? Because you and I were talking about this. An attacker will find that credential, their password, whatever it is to get in, and if it has entitlement, they'll use it, and they'll move laterally. If the attacker gets access to a developer credential but there is no entitlement to AWS, there's no entitlement to the code pod- po- repository, the CI/CD pipeline, they're stopped in their track.

29:30Amy They literally can't take the next step, and that's what we see with privileged controls. When deployed correctly, they will stop the attacker in their chain because they just can't do anything. They don't have entitlements. Where we see attackers become very successful, specifically with machine identity, is because they find some hard-coded credential, and that has entitlement, and they get to use it, okay?

29:52Amy So that sort of l- sets the landscape. The, the world started in one way. We've had to adapt. In the same way, we have to adapt to human-in-the-loop access of agents, as you're saying, because You can get consent fatigue. If an agent continues to ask you, for some human approval on everything, people are just gonna click yes, right?

30:14Amy So we have to make sure that, A, there is a way that autonomy is earned and limited in scope, and that when there is a human in the loop, which in many cases there will be, that you are watching for consent fatigue and you are not just letting the human hit yes without reading, without understanding what the risk is.

30:41Amy So you need to make sure you have the right guard, guardrails, and they have to be tighter controls because, consent f- fatigue will be a real thing, just like MF- F- MFA fatigue became a thing, right?

30:52Brandon Absolutely. No, totally. You mentioned it a couple times, but let's like, I think we should draw a distinction. There used to be like least privileged, right? That was one of the key comments. And then you, I think you called it zero standing privilege a little bit. So like maybe draw that out a little bit.

31:03Brandon Not so much what it means. I think we could probably de- derive what it means from the name there. But how does that actually work? How do I like i- I assume it's some type of policy-based thing, but take us through like kind of the, for how it works for an agent and then how it works for maybe just me as a general employee.

31:15Brandon It seems like it's working both ways there.

31:17Amy Yeah. So the way to think about ZSP is that nobody holds powerful access at rest, right? I don't have access all the time. It's not standing privilege just because of my role or what I need to do. I should only have that powerful access where and when I need it. So let's let's think of an admin. They start their day with zero admin rights.

31:38Amy They don't-- they're not just given admin rights because they log into their computer. But when they need to say, "Let's change a production system," they can get elevated. They get elevated to the privileged access, most of the time automatically because of policy and context, right? So what they are trying to do is something that, that this user normally tries to do, and so there is policy and context around their behavior.

32:05Amy So that single change on that specific system is just something that gives that admin the right access, the right privilege to do that. But the second they are done with it, they disappear back to zero. So there's zero permission, zero entitlement left tied to those credentials, rendering those credentials just normal credentials that have no standing access that an attacker wants to get.

32:31Amy And if then you think about like a, a developer, 'cause I like to think about a developer use case where they might be needing to deploy to the cloud and they get a role that is required for that deployment, but it's not a permanent one, right? And so that application will fetch the secret dynamically at runtime instead of storing them locally.

32:51Amy Again all we have to do is look at the news and what is the crux of so many attacks, it's these standing credentials. Don't store them locally. Have them dynamically created at runtime injected, and then they disappear. And that same exact pattern can cover AI agents what we're talking about. Because you cannot hand-approve a thousand agents, but you can set an overarch-arching policy once, right?

33:16Amy So you can have these tight guardrails and these policies around when and where this access is granted, and that the fact that it's not standing minimizes that blast radius. You're minimizing the potential of an attacker coming in and finding standing access that an agent might have

33:33Brandon I really like that, and I'm really-- and I'm just gonna repeat it 'cause I think you're-- that you phrased, the phrase you said there, policy and context, right? That's really what, if we were just like, we could just wave a wand that's what you want to be doing to protecting yourself, right? Looking at obviously if I'm in the office, I'm a developer, and I'm pushing code, or I'm deploying to AWS, and I'm-- it's middle of the workday, and I've done this a million times before.

33:55Brandon That, that gives you a pretty good sense that's a good thing versus it's the middle of the night, it's a VPN from a foreign country. It's it's an API key I've, haven't really used much, right? And it's like those are the types of things that like, we all need to kinda move to, right? This idea that you can just get access to it and just forget about it.

34:12Brandon It's just, it's like crazy. Now I look back on it and I'm like, "It's crazy we ever did that." So good. I'm glad you did it. For the executives and managers maybe type li-listening to this, one of the questions comes up all the time is who ultimately owns this, this problem? It's like we talked about developers, we talked about line of business, we talked about CISOs, we talked about security people, identity managers, administrators.

34:30Brandon But I think the easy answer is everyone. I know it's everyone. But when you're out there talking to these executives, they don't hold everyone accountable when something goes wrong. What do you see out there? Who's ultimately the person that needs to get this right because it's their job, to do it?

34:44Amy Yeah. I think w- what's really interesting is that this is also you have to look backwards to look forwards, is that in many large enterprises and organizations, for a very long time, identity management, as we started our conversation, which was decoupled from security, it could have been under IT. They were… Who was thinking about how to get people access and set up those God-awful reviews we talked about and audit trails?

35:12Amy It was an IT function. And I, I, the, the times have changed 100%, where identity is now rolling up through the CISO, the, the security office. And more and more, there are, conversations happening far higher than at the CISO, at the CIO, all the way up to the CEO, and that's really because of AI. AI from a threat landscape perspective, but also from an identity perspective.

35:42Amy But who actually owns it? The office of the CISO. But it becomes complicated. It becomes complicated from an organization perspective because listen the security operations team, they don't deploy identity. They don't necessarily probably have full visibility into all of the different identity controls in a large organization, but they need to understand the data, and it's a bi-directional conversation when you think about data.

36:11Amy The security operation teams obviously needs rich context from the identity tools, but identity can be a great response from a, a control perspective if the security team or the SOC team is seeing an anomaly. And so we talk a lot about bringing these, the identity team and the security operations team and the network team closer together, and the way you do that is through data.

36:35Amy So not everyone can own identity, but I will say identity is becoming far more horizontal across a lot of different security technology, forcing the conversation at the CISO and the CIO level. Absolutely.

36:50Brandon Couldn't agree more, and I would even say, I would even go further and be like, really what the simple thing, even in the world of agents, like it'd be great if people just talked more. I always think if we get the developers and engineering teams to talk a little bit more to the security teams and like just the better, the better relationships you have there, I've- just feels like nothing substitutes for that, right?

37:06Brandon Is if they understand your problems and you understand their problems and you're working together and you're… They don't see you as constantly impeding them, and you don't see them as like these crazy developers trying to make everything insecure. So I don't know. I don't know if you have any thoughts on that.

37:18Brandon Maybe it's st- maybe in the end it's still human-based, right?

37:20Amy Yeah, 100%. But I also think listen security vendors, identity vendors also cause some of this problem. You think about the, the cybersecurity market is so fragmented because a problem pops up, and a startup pops up to solve the problem. Then all of a sudden you have a feature that's masquerading as a product or sometimes even a platform.

37:43Amy And some of this is just in the madness of the cybersecurity market itself, where we have so many thousands of vendors out there that have, have this fragmented and segmented approach where we're really all trying to do the same thing. And of course you need best of breed, and of course you want, the right solution for the right problem.

38:07Amy But if we, and of- obviously I'm talking from a Palo Alto Networks perspective, and we are the platformization company, right? Which is saying, "Mr. or Mrs. CISO, you don't need to buy everything from us. We integrate, and we're open, and we have an ecosystem because we understand that you have made bets elsewhere from a market."

38:25Amy But man if the tools that we created could serve multiple different end users across the SOC, across the IT, across network security and s- and have the same data and have the same data pipeline, man, would we be in a better place from a security perspective. So I think some of it is just the, the insane state of the market, and that's why I'm really excited at being at Palo Alto Networks because I do believe in platformization, and I do believe by doing that you get to serve your right security audience.

38:58Amy But you're going to… We're gonna do it in a way that's gonna up-level security and the ability that we have to stay ahead in the arms race, right? I really believe in that.

39:08Brandon I like it. I feel your passion. Let's do it. Let's do it. Let's all come together. Let's make it better. All right. Listen, if someone w- does want to get started on maybe a better identity management journey how could they contact you? Or maybe there's something at Palo To- Palo Alto Networks, a site or something they could co- go check out to learn more

39:25Amy I love it. Yeah, so best way to get me is on LinkedIn for sure. I am pretty active on LinkedIn. I don't know my handle or whatever it is, but Amy Blackshaw at LinkedIn you'll be able to

39:35Brandon link will be in the show notes. We'll find you for sure.

39:37Amy Awesome. Thank you. And, I think I like to share a lot of content about Idira, about the market, about Palo Alto Networks, where we are. You'll find a lot of great content on AI agents. I think I have a, a recent blog about how the time window is shrinking and security teams don't have as much time as they, they think they do around zero standing privileges and agent identity.

40:02Amy So definitely check that out. But also go to paloaltonetworks.com/idira. There's so much rich content. Again, like CyberArk was a 25-year-old leader in identity security, and we have just gained innovation, resources, scale, investment from Palo Alto Networks. And so I'm really excited about, how we're helping customers.

40:29Amy You can see great customer stories. You can see more information on our really broad portfolio when it comes to identity security, and then find out what's coming next from different websites webcasts. We're all over the map, so make sure to check it out.

40:43Brandon No excuses, everyone. You got a lot to go look at. No reason you can't make yourself more secure. Amy, really enjoyed the conversation. Thanks a lot for coming on the show today.

40:50Amy Thank you so much for having me. I really enjoyed talking with you

40:53Brandon And for everyone, thanks for listening to the show. Of course, we always appreciate if you leave us a quick review. We prefer five stars. And with that, we will talk to you next time Thanks for listening. Check us out at theenterpriseaishow.com for past shows, newsletters, and all things enterprise AI