One compromised update. 150 domain controllers down.
One compromised update. 45,000 PCs. 150 domain controllers down. Ships stranded 10 days. $300M+.
Read field note →Topic archive
identity-security
They didn't hack MGM's encryption. They called somebody.
They didn't hack MGM's encryption. They called somebody.
Read field note →Hackers had to hack. Now they just log in.
Machine identities now outnumber humans 109 to 1 inside the average enterprise.
Read field note →A Lock Only Keeps an Honest Person Honest
Every era of identity attack tells the same story: unmanaged trust plus poor visibility inside the environment.
Read field note →No hacker required.
The wildest AI story this week needed zero attackers.
Read field note →The agent wasn't broken.
Some of the most important AI incidents are not product bugs.
Read field note →Sometimes AI is too helpful.
Helpful AI without hard limits can become a security problem fast.
Read field note →Agents Don't Get Hacked. They Get Asked.
Three AI-agent stories broke this week. A ransomware crew didn't hack an agent; they told it the attack was a test. It believed them. Seven companies were breached.
Read field note →Agents Don't Get Hacked. They Get Asked.
Three incidents this week prove the same point, and it isn't the one most of the coverage led with.
Read field note →