My father used to say that about garages and toolsheds. Turns out he was describing enterprise identity security thirty years early.
Palo Alto Networks' 2026 Identity Security Landscape report says machine identities, including AI agents, now outnumber human identities by 109 to 1 inside the average enterprise. Other published estimates are lower, but that spread is the point: this is not a settled inventory. It is an exposure most organizations still cannot fully see.
You cannot secure what you cannot count. And while security teams spent years hardening the front door, the population already inside the building kept growing.
Hackers had to hack.
Now they just log in.
Act one: convince the receptionist
The oldest attack in the book still works. IBM's breach research puts the average cost of an incident that starts with a physical security failure at just over $4 million. The mechanism has barely changed in decades: look confident, carry a box, say you are new, and ask someone to hold the door.
What has changed is what happens after an attacker gets inside.
In one case, a consultant posing as an ISP technician was politely escorted into a co-working space's server room by staff trying to be helpful. He planted rogue devices and left. In a healthcare setting, a man followed a nurse through a secure door, claimed he was there for an IT meeting, sat at an empty desk, plugged in a USB device, and walked out with hundreds of patient records. That did not just create a data-loss event. It created HIPAA exposure, legal cost, and a longer-term trust problem.
A rogue wireless access point plugged into an unused conference room port can be even worse. That is not just theft from one desk. It can give an attacker persistent internal wireless access from the parking lot until someone notices hardware that should not be there.
Digitally, the same con moved to the phone. Mandiant's 2026 M-Trends report found voice phishing was responsible for 23 percent of cloud compromises. Same play, different channel: sound like you belong, sound urgent, ask the help desk for one reset, and let the organization do the rest for you. Scattered Spider did not need to break MGM's encryption. They called somebody and got help.
Act two: one login from domain admin
Once an attacker has a foothold, physically or digitally, the next destination is usually the same: identity infrastructure.
That is why security teams built the tiering model. Tier 0 is the identity layer itself: domain controllers and other systems that decide who gets to be who. Tier 1 is servers and applications. Tier 2 is user workstations.
Without separation between those tiers, the path from one compromised workstation to broad control of the environment can be measured in hours. A flat network does not have walls between those tiers. It has hallways.
NotPetya showed the business cost of that reality. Maersk was hit through a compromised software update in 2017. The attack encrypted 45,000 PCs, 4,000 servers, and all but one of the company's 150 domain controllers. Seventeen ports stopped operating. Container ships were stranded for ten days. Reported cost: at least $300 million.
Nothing about that outcome was exotic. Identity infrastructure failed, and everything that depended on it failed with it.
That is the part many organizations still underestimate. When Active Directory or Entra ID goes down, the company does not merely slow down. Email, file access, SaaS access, admin workflows, and core business processes all begin to fail together.
When identity breaks, the outage is not technical.
It is operational.
Act three: the codes are the new locks
Multi-factor authentication helped, but it did not solve the underlying problem.
At my house, one of the most common text messages between my wife and me is not "pick up milk." It is "what code did you just get?" If I do not answer quickly enough, the follow-up is usually "never mind, I sent another one."
That is harmless at home. At enterprise scale, it is a liability.
MFA fatigue and help-desk vishing work because the code itself is not the real control. The control is the human being deciding whether to approve, relay, or trust the request. A text code does not stop an employee who has been patiently convinced that the person asking for it is legitimate.
That is why the lock metaphor still works. A lock only keeps an honest person honest. A texted MFA code does the same thing. It helps with casual misuse. It does very little when trust has already been manipulated.
Act four: the fight is already inside
This is where a lot of security strategy still lags the threat. The instinct is to keep investing at the edge: better perimeter tools, better blocking, better doors.
But the data keeps pointing inward.
Stolen credentials were the initial access method in 31 percent of breaches last year. Cloud account compromise hit 46 percent of organizations. Mandiant also reported that the median time between an attacker's first foothold and the handoff to a ransomware crew dropped from more than eight hours in 2022 to 22 seconds in 2025.
That number should reset how people think about detection. A lot of security programs were built around the assumption that defenders would have time to notice, triage, and respond. Twenty-two seconds is not a detection window. It is an automation problem.
The bigger issue is not just who is trying to get in. It is who is already in, what privileges they hold, how those privileges were granted, and whether anyone would notice misuse before the business feels it.
That is also why identity infrastructure itself deserves more scrutiny than it usually gets. Microsoft disclosed a CVSS 10.0 remote code execution flaw in Entra ID in August 2026. Even with the usual cloud-service nuance around patching and exposure, the point stands: the identity layer is not just a control point. It is a target.
When that layer fails, the cost is not abstract. Ransomware downtime now averages 24 days. For manufacturers, that can run roughly $1.9 million per day. For healthcare, closer to $900,000 per day. Total downtime cost can far exceed the ransom itself.
Take over the identity system and you have more than data access. You have the keys to nearly every workflow in the business, including the ones nobody has documented well enough to rebuild quickly.
Act five: now the keys have agents
The next version of this problem is already here.
Agents now function like identities too. They authenticate, inherit permissions, call systems, and take actions on behalf of users or workflows. In many environments, they do it with little direct oversight once deployed.
That changes the scale problem and the trust problem at the same time.
The cleanest example this year did not involve a rogue model. It involved ordinary over-trust. Vercel disclosed that its April 2026 incident originated with a compromised third-party AI tool used by an employee. The attacker used that path to take over the employee's Google Workspace account, pivot into Vercel systems, and operate there for an extended period. No dramatic AI rebellion. Just a small tool that had been granted broad access without enough review.
That is not only an enterprise problem. It is the same pattern showing up anywhere software gets broad delegated access: a small business using an AI scheduling agent tied into email and calendars, or a household assistant connected to locks, cameras, garage doors, and thermostats.
The blast radius may be smaller. The mechanism is the same.
Grant broad access to something you have not fully inventoried, governed, and reviewed, and you have created a new trust path that attackers will gladly use.
The real fix is not a better lock
Every era tells the same story in a different accent. Convince the receptionist. Tailgate through the door. Pivot from a workstation into identity infrastructure. Ask for the MFA code. Over-permission the agent.
Same outcome.
The perimeter may still matter, but it is no longer the whole story, and in many cases it is not even the main story. The real problem is unmanaged trust plus poor visibility inside the environment itself.
That is why the practical response is not more perimeter theater. It is better identity visibility, better privilege context, and a clearer inventory of who and what already has access across the business.
That is also the gap Quest has been building toward with the addition of Anetac's non-human identity discovery into its identity security lineup. The point is not a shinier lock on the front door. It is seeing the human and non-human identities already in the hallway, understanding what they can reach, and reducing trust that nobody meant to grant forever.
The next big breach probably will not begin with someone dramatically breaking in. It will begin with someone, or something, that was already trusted a little too much.
Reach Out, Let's Talk. @RandyJRouse