Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.
Start free trial →CyberWire Daily · Software Engineering & Infra · November 2026
The host had asked what counts as a non-human identity. The guest explains that ordinary applications only reach what they are coded to reach, while agents can explore, discover permissions and find secrets the way a curious human might, but with no restraint.
…be at 300 to 1. You know, there's 300 application identities for every human identity. And the kind of the 200 of the 300 will be, you know, agentic created. Some will be, some will use LLMs in their processing, some will not, right? But we're going to see a lot more applications being created.
I mean, even that 100 to 1 numbers is hard for me to wrap my head around. Help me understand what counts as a non-human identity.
Well, I think you have a couple of flavors, right? We have for many, many years created applications, right? So let's just kind of use a simple automation that say that when I have a new person joining a department, they need to be provisioned with a set of files. And so I write a script or I write some code that generates up those files for that user and puts them into a directory, right? That little application sits there. There's other applications that do things like scan email for PII. There's applications that are big applications, things like Swift, you know, or SAP that do big functions, right? All these large applications and small applications kind of exist in an environment. The way they do their work, and this I think becomes very important for the generative conversation. The way that they do their work is that they are triggered by something, could be scheduled, could be an event, right? But to do anything in the environment, they need access to the resources in the environment. So for me to, for example, using that simple example of I'm going to look at the HR record, create some file content, and then put it into a directory, right? Put it into a file server. I need access to the HR information. I need…
So given that reality, how should organizations be considering their risk?
I would not be the first person to say this. I think the risks are substantial, right? There is really substantial risk to doing agentic deployments. And I think there's reasonable mitigations for those risks, but the risks of an agent doing something that is a surprise to you using resources you…
What sort of things are you seeing attackers doing in terms of using agentic technologies against identity systems?