How do you secure AI agents when your identity program is already years in the making? Start with the access those agents can use.
Amy ended her last post with four questions that apply to every human, machine, and agentic identity with critical access. Who owns it? How long does it live? What is it scoped to? How quickly can you take its access away?
I’m going to add a fifth: How do we answer those questions in 90 days without tearing up the program we already have?
Key Takeaway: Attackers using frontier AI models are moving fast. Start your 90-day agentic AI security plan with one key system. Find who and what can reach it, cut access they don’t need, and test how fast you can stop access when a threat appears.
I've spent more than a decade building identity programs. I believe the standard list of vaulting, least privilege, and access reviews still has a place in our programs. Most of us have been working through it for a decade without finishing.
What has to change is the order you work in and the clock you run on.
What The 10-Hour Intrusion Reveals About Identity Controls
In the Unit 42 investigation, a human attacker used AI agents to move through secrets, administrator credentials, and cloud keys in under 10 hours. One detail from that report deserves your attention.
The attacker tried to plant backdoors in Terraform configurations, the code used to manage its cloud infrastructure. Branch protection blocked the changes. The intrusion went on, but that move failed.
Why this matters: A familiar control, sitting in the right place, held against an attacker moving at machine speed. This means you don't need new controls first. You need the ones you have on the paths an attacker will actually use. Govern access at the moment an identity acts.
This capability isn’t confined to one incident. Assume any attacker can work this way. Unit 42 has already observed a Chinese-speaking threat actor using DeepSeek through an open-source agent framework for autonomous reconnaissance and attempted exploitation.
The forgotten service account can’t stay as work for year two simply because it’s hard to find. Plan as if every standing privilege on a critical path will be found.
Five Changes to How You Run Your Identity Program
To apply this lesson, we must 1) find the access paths that matter most and 2) put the controls we already have to work on those paths.
To achieve this, here’s what I would change:
Rank Work by Reachability
Accounts vaulted and applications onboarded tell you about coverage, but an attacker doesn't care what share of your estate is vaulted. They look for what isn't, on the paths that reach production cloud, CI/CD or the vault's own admin console.
Stop onboarding applications in the order the audit calendar sets.
Start with the systems where a compromise would be most consequential, and work backward to every identity that can reach them.
Put Machine and Agentic Identities at the Front of the Queue
The Unit 42 chain ran through secrets, admin credentials and cloud keys. Most programs are still human-first because people file tickets and service accounts don't.
Stop treating "too risky to rotate" as a permanent exception.
Give every identity on a critical path the same scrutiny, including the permissions an AI agent inherits or receives through delegation. Exceptions need an owner, a remediation plan, and a deadline.
Treat Time as the Control
The Unit 42 intrusion compressed weeks of work into hours. The window you still control is the trust window, meaning how long a granted privilege stays alive. Every hour it stands, a stolen key or a hijacked agent can inherit it. Zero standing privileges (ZSP) and just-in-time access, or JIT, shrink that window.
Stop treating 90-day credential rotations and quarterly certifications as sufficient protection against an attacker who works in hours.
Track how long privilege lives and who holds it.
Test Taking Access Away
Amy suggested timing how long it takes to end a session, revoke its token, and rotate its credential. Do it, and watch who you have to call. Accounts, sessions, tokens, and credentials are separate control points, often owned by separate teams. Disabling the account may leave existing sessions or tokens usable.
Stop assuming “disable the user” means the access is gone.
Verify that access is denied, time the full revocation drill, and record every manual handoff.
Decide the Response in Advance
In a controlled Unit 42 simulation, an AI-driven ransomware attack went from initial compromise to data exfiltration in 25 minutes. A ticket and a bridge call don't fit in that window. We call this link between identity detection and containment IdentitySecOps.
Stop sending identity alerts to a queue with no action attached.
Select the few high-confidence identity signals that can trigger pre-approved actions, such as revoking a token or ending a session, and test those responses.Attach a tested response to priority identity alerts.
The 90 Day Plan: Start With One Critical Access Path
Under pressure, teams go wide. They assess everything and relaunch the roadmap. A broad first month produces a long list of findings without reducing much risk. I'd take one path through the full exercise, then use what you learned on the next ten.
Days 1–30: Map, Reduce and Test
Choose the path you'd least want an attacker to find. For most organizations, it leads to production cloud administration, CI/CD and infrastructure as code, the privileged access vault or directory admin rights. If you can't name it with confidence, run an identity assessment scoped to that single question.
On that path:
- Inventory every human, machine, and agentic identity that can reach it, and assign each one an owner.
- Immediately remove access that nobody can justify.
- Move remaining privilege to JIT access scoped to a task where feasible.
- Run the revocation drill, timing each step and recording every handoff.
- Connect one high-confidence identity signal to one pre-approved containment action, and test it.
By day 30, aim for one critical path mapped end to end, less unjustified access, a measured revocation time, and a tested containment action. Give any remaining standing access exception an owner and a deadline.
You now have a template and know which organizational blockers to tackle next.
Days 31–60: Repeat On The Next Ten Paths
Apply the template to the next paths, ranked by reachability. Ten is a useful target if you can take each one through the full exercise. Don't trade a verified risk reduction for a round number.. Resolve the blockers from path one: service account ownership, session termination, and cross-team handoffs.
Along the way:
- Cut the links that let one compromised identity unlock the next.
- Authorize each step and constrain delegated permissions for agents and service identities by default.
- Isolate privileged sessions so credentials stay off endpoints, and remove persistent local admin rights on the endpoints.
- Remove persistent local admin rights on the endpoints along these paths.
By day 60, you should have less standing access on your highest-risk paths. You should know where revocation still stalls and which exceptions remain.
Days 61–90: Reorder and Measure
Use what you learned to reorder the broader roadmap:
- Rank remaining work by reachability and let coverage work follow.
- Move identities on critical paths from quarterly certification to continuous review.
- Extend pre-approved containment to the handful of identity detections your SOC trusts most.
- Establish a baseline for how long privilege lives on your critical paths, because the board will ask.
By day 90: Show what access you removed, how quickly you can revoke what remains, and where containment still stalls.
What to Show the Board on Day 90
By day 90, you should be able to show the board what changed on your critical access paths: how much standing privilege you removed, how many identities now have verified owners and revocable, time-bound access, and how quickly you can take that access away. Show which gaps the revocation drills closed and how many high-confidence identity detections now trigger a tested containment action.
Notice that none of these measure coverage. They show whether critical access is becoming harder to misuse and faster to contain.
How Idira Supports the 90-Day Plan
All of this works with the tools you already own, and that's where to start. Idira keeps it in one place. The Idira Identity Security Platform discovers human, machine, and agentic identities, replaces standing permissions with JIT access, and ties identity risk to automated response. The path you fix in week two doesn't end up split across three consoles and three teams.
The Rapid Identity Risk Reduction Blueprint carries the full plan, plus a checklist of what an identity program needs when attackers have frontier AI model capabilities.
The revocation drill tells you how long it takes to take access away. But how long does that access remain useful in the first place? In the next post, Andy Klein will introduce the Mean Trust Window, show how to measure it and explain what that number tells the board.
If you'd like help choosing your first path, our team can walk through an assessment of where standing trust still lives in your environment.
FAQs
Why Can't We Keep Running Our Existing Identity Program?
You can keep most of it. The controls still apply. What changes is the order and the clock: rank work by which identities can reach critical systems, measure how long privilege lives and rehearse revocation as seriously as you design approvals.
What Should We Do in the First 30 Days to Reduce Agentic AI Security Risk?
Pick the one access path you'd least want an attacker to find. Map every human, machine, and agentic identity on it and assign owners. Remove unjustified access, move the rest to JIT access, drill revocation and connect one identity signal to a pre-approved containment action.
How Do ZSP and JIT Access Reduce Risk?
Zero standing privileges remove access an identity doesn't need to hold continuously. Just-in-time access grants privilege for an approved task and removes it when the work ends. Together, they shrink what an attacker can inherit from a compromised identity.
How Can We Test Whether We Can Take Access Away During an Attack?
Choose a high-risk access path. End a privileged session, revoke its token and rotate the credential behind it. Confirm the access is denied, time the drill and record every manual handoff.