1040: Cybersecurity for the Agentic AI Era, with Amy Blackshaw

Speaker A: For four and a half days, autonomous AI agents moved through hugging faces infrastructure at, uh, one action every 20 seconds. How did they get so far? A plain text password and a single master key that opened 136 doors. Welcome to another episode of the Super Data Science Podcast. I'm your host, Jon Krohn. Today's guest is Amy Blackshaw, a senior vice president at Palo Alto Networks, the world's largest independent cybersecurity company. In this episode, Amy explains why Frontier AI has made the thinking part of a cyber attack nearly free, thereby making cyber attacks inexpensive, fast, and relentless. Like we saw with the recent Hugging Face breach. Amy magnificently explains cybersecurity and how to protect ourselves and our businesses from cyber threats in the agentic era. That's here and that's coming. It's a riveting episode. Enjoy. Amy, welcome to the Super Data Science Podcast. How's it going today?

Speaker B: It's good, John. Thanks so much for having me. I'm excited to be here.

Speaker A: Yes, yes, we're excited to have you as well. You work for a company that is actually gigantic. I was just looking at its stock price before we started recording. Over $300 billion in market valuation. It's called Palo Alto Networks. And my understanding is that for anybody who works in cybersecurity, they will already know what Palo Alto Networks is. But not all of our listeners work in cybersecurity. So do you want to tell us about the company?

Speaker B: Yeah, absolutely. So, yes, we are a very large, uh, cybersecurity company, the largest independent cybersecurity vendor in, uh, the world, and we're the global AI security leader. So we protect over 75,000 customers in the way that they go about in their business. And, and we offer a portfolio of cybersecurity solutions, um, spanning across network security, cloud security, security operations, AI security, and identity security. We also have, um, a unit 42, which is our threat intelligence, um, which helps customers eliminate sort of complexity and help empower our customers to modernize and ultimately secure themselves so they can move fast in what they need to do.

Speaker A: Nice. Let's double click on that identity security that you mentioned there. What is that? Uh,

Speaker B: yeah, so that the simplest way to think about identity security is that every breach today, um, that you read about or that you see in the news or that you've heard from a peer or a friend comes down to the idea that an attacker has gotten hold of an identity that they should not have had access to. So whether that's a login or a key or a token and then they use that to move so they don't have to break encryption, they don't have to do some zero day attack that you might hear in sort of movies or, uh, you know, different wild ideas of what attacks look like. It's just becoming someone or something that the system has already trusted. And once that happens, everything downwind of that identity is at risk. So identity security is this sort of discipline, this idea that you have to decide who and what is allowed to act inside of a company and how long they have access to do what they need to do. And for years it was treated as plumbing. We, uh, are now moving in a different motion with AI in the threat landscape that we live in. And it's all about securing every identity with the right level of privilege control.

Speaker A: And it sounds like you have a specific solution to this identity security problem. It's called Idera, which seems to be related to an acquisition that Palo Alto Networks made, a company called Cyberark.

Speaker B: That's right. Cyberark was the pioneer and the founder of the privileged access management space 26 years ago, um, and over time became the identity security leader. Palo Alto Networks acquired Cyberark as of February in 2026. So we, I was part of the CyberArc team that was, um, joining Palo Alto Networks and we have rebranded the Cyberark platform into Idira. Um, so the Idera platform secures every identity, whether it's a human, a machine, an AI agent, um, with that right level of privilege controls. Um, and we're very excited to be part of the Palo Alto Networks, um, organization because we are being infused with resources, innovation, scale, speed, to bring more technology to our customers to help them secure their identities.

Speaker A: Nice. Thanks for giving us the idea behind Idera. And if people are looking to know how to spell that, it's id I R A I. Um, so let's talk about why identity security is now so much more important in this agentic AI era. So what has changed about how attacks unfold now that frontier AI, uh, models can chain security vulnerabilities together all on their own?

Speaker B: Yeah, I think the part that surprises a lot of people is that attacks themselves didn't change. We didn't wake up with frontier AI and just say, wow, we now have all of these new vectors that we've never seen before. It's uh, that the techniques that an AI driven attacker are the same ones that we have known for years and for decades in some cases. But what has changed is the economics. So for the entire history of the cybersecurity industry, the expensive Part of the attack was sort of the thinking, right? How, how does one get in? How does a skilled human have to sort of understand their target environment, work out how to look at one vulnerability in one system and like you said, sort of chain them to understand how a foothold could be turned into something catastrophic for the target organization. Uh, sometimes that took weeks and it took experts. Uh, there was an expense in that attack. Now Frontier AI has deleted that cost. The thinking is now it's instant, it's tireless, it's exhaustive. When you're talking about these agentic models, it can check every door, not just the open, obvious ones. And it's happy to do that for a small company or a large company. And I, uh, think I want to take a quick second to be very specific about something. It's about who the villain is. Because the villain isn't the models that are enabling this tireless approach of attack vector chaining. The villain is still the attacker. They just now have the same capabilities that we do and they're operating under a new economics. So the entry is cheap and enumeration is free.

Speaker A: Yeah, there's all kinds of wonderful positive things about abundant, uh, very inexpensive intelligence. Uh, you can imagine, you know, in education, in food security, in, in health care, there's all kinds of positive things. But that same intelligence can be used by bad actors.

Speaker B: Exactly right.

Speaker A: So speaking of which, something that we did, an episode focused on this. But you're a, uh, security expert and so I'd love to hear from your perspective what happened in July with OpenAI's agents getting into the hugging face systems. What did the agent do and how did it reach Cluster admin Authority in a matter of hours?

Speaker B: Yeah, yeah. Ah, it's an incident that I think has gotten well deserved coverage, um, because I think it really helps provide a clear example of, of Frontier AI models and sort of this idea of machine speed and how it can play out in an actual incident. So they were dealing with an intrusion into their production infrastructure. Hugging face, where the attacker was inside for four and a half days and it carried out 17 and a half thousand attacker actions. That's about an action every 20 seconds sustained. A human can't do that. Right. That is machine speed. Um, and that is what persistent machine speed looks like. So these autonomous AI agents, they escaped the sandbox that they were being tested in, they reached the Internet, they commandeered a third party server, and then they got to work. But this is what the important point is. Speed got them through the door, but speed didn't get them to the critical resources because to achieve their goal, an attacker, whether it's this swarm of AI agents or just a human, they need to get access to an identity and the resources and permissions that are associated with that identity. So an attacker doesn't care if it's an identity that belongs to me, Amy Blackshaw, or if it's a service account or an AI agent. If they can use that identity to get where they're going, it is valuable to them. So that's what we saw here. Right. Those four and a half days of continuous exposure wasn't just some incredibly sophisticated AI technique. It was actually fundamentally a problem of identity and privilege hygiene that was non existent in this infrastructure. So there was this plaintext password sitting where the process could access it. There was one master key that opened 136 doors, and there was an unreviewed service account that had standing admin privileges across two clusters. So what does that mean to people who maybe, uh, aren't in cybersecurity? It's like you lock the front door, um, but you make it really easy to get into somebody who's going to be persistent with a pick lock.

Speaker A: The old key, uh, under the front mat.

Speaker B: Exactly. But this one's even worse. They open the door with the key and then on the kitchen table are all of the safe keys. They just laid them out and said, now that you're in here, you might as well get into where all of our crown jewels are or where all of our, uh, silverware and uh, things that are jewelry that are really important to you. So none of the weaknesses here required a, uh, sophisticated AI exploit. None of them did. It was getting in that was enabled by AI models from in that machine speed. But what essentially happened was that privilege was left standing and that it was never reviewed and that was taken advantage of by the attacker. It's the tale as old as time. They get access, they elevate privileges, they move laterally, they elevate privileges and then they get to where they're going. It is a hygiene of identity security that could, uh, really change the outcome in an attack like this.

Speaker A: Excellent. We'll talk more about privilege and hygiene. And I've got to say, anytime we have some big AI cybersecurity incident, we're going to have to get you back on the show. Because that was by far the best explanation I've heard of that incident. Having read about it dozens of times, Amy, that was the best one for sure. So thank you for coming and sharing that with us before we get back to privilege, something that came up in our research for this episode that I don't even really understand why this is so important. So I'm looking forward to being illuminated about this. But you've cited a 72 minute breakout time in real cybersecurity incidents versus 25 minutes in simulations. So less than half the time in simulations relative to real incidents. Where do those numbers come from? What is the significance of those numbers? And what can a defender do, do in that window?

Speaker B: Yeah, it's, it's a great question. So to think about it, first, they come from our unit 42 specialists, right, who every day are holding hands with our customers and helping respond to real incidents. And so what they see is that we measure an attacker going from sort of first entry point or foothold into real impact, whether that's breach or wherever that attacker is trying to go in about 72 minutes. In simulations, like where we are able to um, do testing to simulate these type of incidents, it's closer to 25. And so when we're talking about that speed, even 72 minutes, there's a few things that come to mind. So first and foremost, the idea that a human led, uh, incident response is going to be able to identify an attack, see the depth of it, and then respond even within that 72 minute window is hard, right? 25 minutes is really hard. And so we believe that security teams need to be fighting AI with AI. And by using AI within their own security teams to not be on their back foot when the attacker is leveraging AI, they need to be leveraging AI and so using, you know, the different frontier models within their security tools which Palo Alto Networks does, and enabling them to respond with agentic workflows so that you obviously have humans in the loop in security teams, but that you are leveraging AI to fight AI. Number two, virtual patching and testing for vulnerabilities using frontier AI models again, right, because we know the attackers are, is absolutely necessary, again something that we help our customers with. And then when we're talking about if an identity is compromised, that attacker can often fly under the radar of traditional security tools because as I was talking about in the opening, they're often trusted, acting like a trusted user. And the speed is so fast that even an AI driven security operations team isn't going to find an anomaly in that actor's movements until the very end of the attack chain. And so that is why the AI driven security teams, the virtual patching, understanding vulnerabilities, have to go hand in hand with identity security. Because if you can truly secure all the identities, human, machine and AI, you are going to stop the attacker before they even need to be detected and responded to. So that's where identity security comes in.

Speaker A: All right, yeah, let's dig more into that all important identity security. You've argued that the line between privileged users and ordinary users completely disappears when we're in this now machine speed agentic AI environment where being able to enumerate all of the security vulnerabilities costs nothing and takes very little time. Why has that line between privileged and ordinary users disappeared?

Speaker B: Yeah, it's a really important point because in the security um, industry for a long time we've sorted into tiers this idea that privileged users are one thing, most likely an IT admin, and they're ordinary users, um, that used to work in a different world. When we were on premise, we didn't have people accessing cloud and we didn't have developers working at the speed that they work at today. And we absolutely didn't have this AI foundation of throw threats changing the landscape. And so we have moved away from this idea that privilege only exists for IT admins. And the interesting thing is that in the old days IT admins had to use uh, tools, uh, like privileged access management that they would sort of bear the friction of using. Right? And so we're talking about 20, 15 years ago, IT admins were put in this bubble and said if we protect them, um, we're protected. What's happened now is that every user, whether you're a developer, a data scientist, whether you are working in cloud infrastructure or if you're just a business user who has access to customer data or financial data or code base, you slip in and out of privilege every day. And so that is this idea that you need to put the right level of privilege control, commiserate with the risk and commiserate with the level of friction that the user will bear. So this has completely changed the way that the privileged access management, um, market and technology has shifted and we also need to apply them to human and machine. And what's been great about sort of this journey from cyberark to idera is that we founded Privilege Access Management. We've reinvented ourselves. We now of course have traditional privileged access management controls, but are now having modern privilege access management controls like zero standing privilege, um, and just in time, Access

Speaker A: Cloud Cowork now runs in the cloud and that's changed how I work. Recently I asked Cowork to pull my scattered notes from Gmail And Google Drive into a research brief for an upcoming podcast guest. Then I closed my laptop and headed out. I checked in from my phone on the subway and Claude was still going strong. By the time I got home, a polished, well cited brief was waiting for me. Claude is the AI for problem solvers. It's the collaborator that understands your entire workflow and thinks with you, not for you. Whether you're debugging code at midnight, building a financial model, or strategizing your next business move, Claude extends your thinking to tackle the problems that matter. Ready to have an AI that can tap tackle real work? Try Claude cowork today on any paid plan at. Ah, Claude AI SuperData. That's Claude AI SuperData. And check out Claude Pro, which includes access to all the features mentioned in Today's episode. Claude AI SuperData. Yes, and we will get to zero, uh, standing privileges and just in time access shortly in this episode. Before we get there, I want to know about something called the trust window and why we need to focus on limiting the trust window instead of just focusing on keeping attackers out of our systems entirely.

Speaker B: Yeah, it is. Is this idea that if every user is privileged or slips in and out of privilege during their day, the way that you secure that identity and that privilege has to be around how long the privilege and the entitlement lasts and how far it reaches. So that's the trust window. How long does that privilege access need to be granted for and how quickly can we take it away? So think about, uh, every piece of access as a key, and every key has two properties. How long it works and how many doors it opens. So that key, a key that works forever and opens everything is your maximum, um, exposure. It was that key to the safe on the door that we were just talking about in the hugging face incident. A key that works for 10 minutes and opens one door has a very small exposure rate. So most organizations are carrying thousands of, uh, forever keys that have long been forgotten and attackers now with AI can find them. And that's why we focus on shortening that time window than just simply keeping attackers out so we know attackers are going to get in. But if we can change that trust window to be the smallest amount as possible, even if the attacker gets that key, it's going to stop them in their track because it's going to be useless to them because it's out of the range of usefulness.

Speaker A: I gotcha. And it sounds like this is going to be important for the zero standing privileges and the just in time access which we will, we are going to still get to. But before we get there, I want to talk about agentic identities because I think that's uh, another piece of the puzzle to understanding zero standing privileges and just in time access in the current agentic AI environment. So this is a data science and AI engineering podcast. Most of our listeners build AI agents. How is an. From a cybersecurity perspective, how is an, how is an agentic identity different from a human user or from a traditional service account?

Speaker B: Yeah, I love this topic. Um, and it's, it's because, you know, agentic identities are so fascinating and like we talked about in the beginning, so there's so much promise and there's so much opportunity, um, that we all see with creating agents. And uh, from an identity perspective, they're very unique. So if you think about it, a human identity is a person, and we move at human speed and we have human judgment and we have human accountability and we will do things to better our goal. But we're limited sort of in our humanness. Now, on the flip side of that, a service account is the opposite. It's static. It's set up once. It's usually set up with too much privilege. And it is, uh, left so that it could run for years and sometimes has a credential that has never been rotated right. So very, very different, uh, static versus ever moving and ever changing now. And agentic identity is sort of a, uh, strangely unsettling combination of the two from an identity security perspective because it has an autonomy of a person. It can make decisions, it can chain tools together, it can sometimes act on someone's behalf. It will elevate its own privileges to get to its goal. Right? Like it will go around security controls if it can, like a human, because none of us like to be stopped by security. But it's provisioned like a machine and it's actually code. And so there are the chances that it can be set up once and sort of act like a service account. And there can be thousands of them, thousands of them we know, um, created overnight. So it carries machines, reach with human, ah, reach with machine sprawl. And sometimes it doesn't have governance. So everyone needs to think about reframing the way that they think about identity security when it comes to this idea of agentic identities.

Speaker A: That is crystal clear. Let's talk about what a rogue agent, like you were just describing, looks like in practice. Maybe you can give us an example of an agent being subverted or drifting from its mission or leaking secrets through flawed Reasoning.

Speaker B: Yeah. So I'll talk about it in three ways. So first, as you're saying, it can be subverted. It can be like fed a, ah, document or instruction that is poisoned or malicious. And because the agent is trusted, its access quietly can become the attacker's access. And there have already been real like cases in the, in the news this year where an agent's own token was lifted and inherited everything it could touch. So that's number one. Number two, it can drift, it can pursue its own goal in a way no one intended, quite like the hugging face, uh, intrusion, reaching into systems that were never in its scope simply because the path was open and nothing stopped it and it got it to its goal. Or it can leak through its own reasoning, do exactly what it was asked and then in the process move a, uh, secret somewhere it shouldn't because it has broad standing access and no reason to think twice. So the main thread that runs across all of these is really the hopeful part. In every single one of those stories. The damage is bounded entirely by what the agent was allowed to do and for how long. So back to our analogy of a key, if the key only is alive, you know, able to access something for 10 minutes and only one door to open. The same way an agent, if it has the right guard rails and only has um, access and privileges to where and when they need it, we're going to limit that ability to go rogue.

Speaker A: It sounds like you might have actually already answered this next question, but you might have a little bit more to say about it. For people like my core audience, AI engineers, data scientists, what can they be doing differently when they grant an agent credentials or tool access? It sounds like obviously having a time limit, a trust window on that credential is key. Is there anything else?

Speaker B: Yeah, you're a fast study, I love that. Um, yeah, it's exactly that. Like you don't give standing long lived credentials, um, but access for the length of the task that expires on it all on its own. So for the rest of the time there's nothing for it to steal. Uh, you've got it. It's about the time window. It's about limiting privilege and setting, uh, just in time, zero standing privilege controls on agents, as you would a human, hopefully.

Speaker A: Yes, it sounds like we might have actually now kind of gotten an intuition around what just in time access is and what zero standing privileges are. It seems to me I can try to, I can try to explain it, you can tell me what I get wrong or what needs to be, uh, Developed on further. But it seems clear to me that this idea of zero standing privileges means you don't grant a standing privileges ever. You never have a key that works indefinitely, and then the just in time access part means that you provide the access. The key only works just in time or just at the moment that it's needed, and then, uh, as soon as it is no longer needed, that access is taken away. Is that right?

Speaker B: You got it 100%. I like to say with zero standing, um, privileges, there's zero privileges, zero permissions, zero entitlement that is left standing for an attacker to come and take advantage of. Because, uh, if there is a credential, a username and password, a token or a secret that is decoupled from the entitlement, then they can get the credential all day long. They can fish, they can come in and laterally move and take over a credential. But if there is zero entitlement, zero privilege tied to that credential at that time, it's, uh, a dead end for them. We've cut off their access. So you got it 100% right. And I think when you think about this in practice, so what does it mean for a user who has zero standing privileges? Uh, is there going to be friction for a user? Because do they have to constantly ask for access? The trick is to grant the access and revoke the access automatically. And driven by policy and risk. If there's an engineer that needs access to AWS infrastructure and there is context and there is policy, when that engineer needs that access, it can be automatically granted. And when that session is closed, it disappears. So you're doing sort of both. You're enabling the user to be able to move as fast as they want, and then you're stopping the attacker because you are stripping that standing privilege that for far too long organizations have been using.

Speaker A: Brilliant. Thank you for more clear explanations. Amy. All of this, you know, a concept around zero standing privileges, just in time access, it seems to me like that could add friction. You know, it would be convenient for me as a developer, as a data scientist, as anyone creating a system to just have a key that unlocks all the doors and works forever. That's super convenient. Uh, so everything that you're describing, just in time access, zero standing privileges, that must add friction. Right? How do we minimize that friction?

Speaker B: Yeah, and again, it goes back to, like, how it is deployed. So if you have a system in which somebody has to constantly come and say, can I have the key? When you have to use the restroom, at a restaurant or a Starbucks and you have to go get the key. It's annoying. Um, the idea is to be able to open that door or request that access just based on who you are and what you're trying to do, which is set by policy. So there are certain things that certain identities are going to do that are legitimate time and time again that can be set to be automatically granted and automatically revoked. So that way you aren't introducing that friction because I always say the best cybersecurity can be the worst cybersecurity because if nobody uses it, it doesn't matter how secure it is. Um, so it has to be granted by policy and by risk level and it has to be done in a way that is natively in line with the user's tools and how they would approach their day to day. So you're don't have that friction.

Speaker A: Makes perfect sense. Looking ahead a little bit, LLMs Frontier models are only getting more and more capable. So you have said previously that defenders have three to five months from them hearing this episode before autonomous exploitation becomes standard. So if my listener, their organization starts a 90 day plan tomorrow to get ahead of this autonomous exploitation wave, what should they do first in that plan?

Speaker B: Yeah, I think like, you know, the countdown. What we know is that attackers are getting faster and that the window to exposure is just, you know, becoming smaller and smaller and that um, it becomes a harder problem to solve for defenders who have to get it right every single time where the attacker just has to be right once. And so whether it's uh, three months or five days, organizations need to get started today. And if they are going to get started today or tomorrow, the first move that I would like organizations to see is to take standing privilege off the board. And it is a uh, journey that many organizations are on and have been on. But if you can take that standing privilege away from where it matters most, that elevate that just in time so an admin isn't lying around waiting to be found. That would be the one thing because, uh, you can move to zero standing privilege for all of your users. But first start with your admins. If your admins are using standing static secrets or access, get them off, get off of standing hard coded credentials in code for machine identities. Get off them, use ephemeral secrets so that way we can stop the attacker. So machines, agents, humans, starting with your admins, get off standing access, move to zsp. Uh, and that would be a ginormous first step for organizations to take.

Speaker A: Fantastic. Amy, we're Going to have to watch closely as this, uh, is this autonomous exploitation becomes more and more standard in the coming months. And, yeah, we'll have to have you on again to explain the latest exploits that our LLMs are getting up to out there in the world and how we can be combating them with solutions like Palo Alto Networks. Idera. Um, before I let you go, Amy, I ask all of my guests for a book recommendation. Do you have anything for us?

Speaker B: Oh, yes, I love, uh, to read. I always have two books going, one for fiction and one nonfiction. So I'll give you a good one in each category. So nonfiction. I always love to recommend the happiness advantage, um, in the world of cyber security and spending a lot of time thinking about attackers, uh, it's nice to think about how happiness can be advantage in the business world. And it is something that I subscribe to 100%. And, uh, you know, it's not about being Pollyanna at all. It's about, um, being able to identify opportunities to leverage, uh, happiness as. As an advantage. So check that one out. Um, and then for fiction, I will say Theo of Golden. I know that it's one of the highest recommended on Goodreads. I have given this book to so many friends and family. It is just such a good read. Theo of Golden.

Speaker A: Theo of Golden.

Speaker B: Yeah, you got it.

Speaker A: Wow. Okay, cool. I've been looking for a good fiction recommendation recently.

Speaker B: Read it and let me know. I'm telling you, it's, uh, a. It's a book you'll. You'll throw across the room out of sadness and frustration, and then you'll go run and pick it up to finish it. It's. It's great.

Speaker A: Okay. All right. Looking forward to that experience. Um, Amy, final thing before you go. How can listeners follow you or Palo Alto Networks after this episode?

Speaker B: The best place is probably LinkedIn. Um, check out the Palo Alto Networks, um, Handle. There's also an idea by Palo Alto Networks, um, Handle and myself. Um, and yeah, you'd be able to find, you know, different blogs and. And pieces and content that we have out around spaces. I think I. I have a piece recently written called you don't have Three years, which is on the topic we talked about a lot of. That's a good place to start, is LinkedIn.

Speaker A: Love it. Amy, thank you so much for taking the time out of your valuable day. All of your time must be so in demand. Uh, but you gave us such a brilliant episode. Our audience will appreciate it for sure. Thanks and hope to have you on again sometime soon.

Speaker B: Thanks so much John. I've enjoyed it.

Speaker A: What an exceptional guest Amy Blackshaw was. Wow. I love that episode. In it, she covered how nearly every breach could comes down to an attacker getting hold of an identity they shouldn't have. Why Frontier AI hasn't invented new attacks, but has changed the economics since. The expensive expert thinking behind chaining vulnerabilities together is now instant, tireless, and cheap. And she talked about how the first move for any organization is taking standing privilege off the board, starting with admins and with hard coded credentials in machine code. I hope you enjoyed the conversation. To be sure not to miss any of our exciting upcoming episodes, subscribe to this podcast. But most importantly, I hope you'll just keep on listening until next time. Keep on rocking it out there, and I'm looking forward to enjoying another round of the Super Data Science Podcast with you very soon.