The agent found your unlocked door

Hey there 👋

For three weeks straight the security industry has been selling me walls. Firewall what enters the agent. Block the agent at the endpoint. Review every skill before it runs. All of it treats the agent as the thing sneaking in. This week two companies shipped the opposite idea, and it is the more honest one: the agent is not sneaking in. It is walking through a door you left unlocked years ago.

That is the story today, and it stung a little to read, because you cannot buy your way out of it. The gap is the access you already own.

Here is my bias. I have run the audit where you finally list every credential and service account with real permissions, and it is always worse than you guessed. An agent does that audit for you, at machine speed, except it does not file a report. It uses what it finds. Read on and decide how confident you are about what your own agents can already reach.

The Big Thing

The agent authorization layer arrived, and it points at a mess you already own

Most of the year, agent security meant guarding the way in. Who is this agent, what can it read, which tools is it allowed to touch. Two identity vendors shipped controls this week that move the question one step later: once the agent is inside and holding valid access, is everything it then does allowed?

Akeyless announced general availability of Agentic Runtime Authority on September 10. It sits on top of its SecretlessAI layer, which keeps credentials out of the agent and brokers access on its behalf, and it adds intent-based authorization that judges each action in the moment and blocks the ones that break policy before they run. The company frames the gap plainly: old access controls decide whether an agent gets into a system, not whether every move it makes inside is legitimate. Akeyless says it now secures more than 220 billion machine interactions, which is its own number, so weigh it as a vendor’s.

Orchid Security came at the same problem from the other side a day earlier. It added identity drift detection, which runs continuously and compares what an agent was built to do against what it is doing right now, plus an application-level kill switch that lets a team strip an agent’s authority the moment it wanders: trim permissions, revoke credentials, cut a tool, suspend the workflow. The line in Orchid’s writeup that I cannot stop thinking about is this. Agents do not need to break your controls. They find and use the identity debt already sitting in your enterprise, the hard-coded credentials, the orphaned accounts, the over-broad permissions, and they do it in seconds. Orchid’s own Identity Gap report puts 57% of enterprise identity in the unseen and unmanaged pile. Grade the exact figure as a vendor’s research, but you already know the direction is right.

Big picture. The reframe is the point. Every control that shipped in the last month treated the agent as the threat to wall off. Identity debt says the agent is the messenger. It exercises the access you never cleaned up, faster than any employee ever would. So the deploy-this-week move is not only a runtime guard. Give each agent its own identity, never a shared human login, scope it to the least it needs, log every action and every outbound call, and watch what it reaches for. The agent is the cheapest access audit you will ever run, if you are willing to read the results.

Sources: Akeyless and Orchid Security press releases (primary); SiliconANGLE on the Orchid kill switch; Help Net Security on the September 11 identity-control products.

Tour de Headlines

🧾 Vendor risk stops being a once-a-year PDF. Scytale shipped AI-powered third-party risk management inside its Vendors module this week, pitched at turning the periodic vendor review into a running feed: automated vendor discovery, risk scoring, and evidence collection across compliance frameworks, updated continuously instead of at renewal. Set it next to today’s lead and the logic clicks. Your agents call third-party tools, skills, and MCP servers all day, so the vendors in your environment change faster than any quarterly questionnaire can track. This is the paperwork side of the same problem runtime authorization solves: one control watches what your agent does, this one watches who it is doing it with. It is a vendor’s product claim and the quality depends on the data you wire in, so treat “continuous” as a claim to verify before you lean on it. Still, the direction is where any team running agents against outside services has to go.

📷 Baidu makes the agent the device’s main control surface. Away from the enterprise for a second. At a September 8 event, Baidu’s Xiaodu line rolled out new hardware, a smart screen, a camera, a companion display, a speaker, all running an upgraded Xiaodu assistant, including a second-generation monitoring agent living inside the cameras for continuous awareness of the room. Baidu says Xiaodu is in more than 55 million households, its own count. The reason it belongs in a B2B brief: the agent is becoming the main way you run the device, replacing the tap-a-button model entirely. That is the same shift the enterprise tools are chasing, arriving first in the living room. It also drags the week’s uncomfortable question home. An always-on monitoring agent is continuous surveillance wearing a friendly voice, and the design choices that make it helpful are the same ones that make it worth reading the fine print.

🧪 Securin ships a platform built to prove the fix held. Securin announced general availability of the Securin Platform, an exposure-management product that folds attack-surface discovery, threat intel, offensive validation, and remediation into one loop aimed at three questions: what can an attacker exploit, what to fix first, and did the fix hold. That last one is the transferable idea, and it rhymes with everything above. As agents start both finding problems and generating the fixes, the discipline nobody has yet is confirming the fix held instead of taking the agent’s word for it. Grade the AI-native label as marketing until you have watched it work. The habit it is selling, verify the close, is the right one to steal even if you never buy the tool.

Tool of the Day

🛠️ Give every agent its own identity and a kill switch

The pattern behind this week’s launches, minus the purchase order.

You do not have to buy Akeyless or Orchid to get most of what they are selling. The mechanics are a pattern you can stand up yourself, and doing the boring 80% this weekend beats waiting on procurement.

What it is for: closing the identity-debt gap on your own agents before one of them finds it for you. Five steps, in order. One, every agent gets its own identity, never a human’s login and never a shared service account, so any action traces to one agent. Two, short-lived, least-privilege credentials, brokered so the secret never sits inside the agent itself. Three, log every action and every outbound call, because you cannot review drift you never recorded. Four, a drift check, even a crude one, comparing what the agent was scoped to do against what it did this week. Five, and this is the step everyone skips, one revoke path you have already rehearsed: cut the credentials, disconnect the tools, suspend the workflow, on a real agent, before you need it at 2am. A kill switch you have never pulled is a hope, not a control.

Worth a Click

• Akeyless’s Runtime Authority GA announcement. The September 10 general-availability release: intent-based, block-the-action-at-runtime, plus the SecretlessAI plumbing and the 220 billion machine-interactions claim. cioinfluence.com
• Orchid Security’s announcement. The drift detection and kill-switch writeup, and the 57% unseen-identity figure. Read it and grade the number yourself. globenewswire.com
• Help Net Security’s products of the week, September 11. Akeyless, Orchid, Scytale, and Securin in one scan if you want the whole identity-control wave at once. helpnetsecurity.com

Stack the last month up and it tells a single story. The thing everyone is fighting to control kept sliding outward, from the model, to the context and the endpoint, to the SOC and the payment rail and the consulting bench, and this week it reached identity and the right to act. But the fresh turn is about fault. Every layer before this one treated the agent as the intruder to keep out. Identity debt says the agent is the messenger. The 57% of your identity that was already unseen did not become a problem when the agent showed up. It was a problem the whole time. The agent just reads it faster than you ever audited it. The base model is still the boring part of the stack. The risk keeps moving into the layers around it, and this week the layer was the access you never cleaned up.

See you tomorrow.
— Ron