Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Proactive security means measuring your posture against clear policies on a steady rhythm and fixing risk before it becomes an alert or an audit finding. Most teams still work reactively: they wait for an auditor or an alert, investigate, and then act. SOC 2, ISO 27001, and NIST CSF already expect ongoing improvement. Getting there takes a shift in mindset and tools that make the rhythm easy to keep.

AI agents are multiplying faster than most organizations can track, let alone govern. IDC predicts there will be 1.3 billion agents by 2028. Every team that adopts one is also, often without meaning to, creating a new identity. And it’s one that can access systems, move data, and act on someone's behalf. The rush right now is to get ahead of that before it spirals, and the first step is to answer a basic question: whose job is this?

Part 2 of 3 in our Rethinking Privileged Access series. Start with Part 1: The password was never the only problem. In Part 1, we drew the line between the vault-and-checkout model of legacy PAM and the session-and-Activities model of modern PAM with Netwrix Privilege Secure (NPS). One protects the password; the other eliminates the standing privilege behind it. That framing is a good starting point, but it understates the case. In Windows and Active Directory, the password is just the seed.

Service accounts, app integrations, and AI agents often have more access than any person, and they get reviewed last. That gives them one of the largest blast radiuses in the environment, meaning they can reach more if they're compromised. The Uber and Cloudflare breaches and the Salesloft Drift campaign against Salesforce customers show how attackers exploit these accounts. Check them for open, stale, orphaned, and privileged access, then cut access back to what they really use.

Unmanaged data stores let permissions drift while sensitive data accumulates unnoticed. They are repositories an organization doesn’t actively govern, leaving them without an owner, an access-review cadence, or a retention policy. Securing them means assigning ownership, correcting access, and maintaining continuous governance and visibility.

Most organizations have a removable media policy. Few enforce one, and that shortfall drives breach costs and compliance exposure. Closing it takes a default-deny baseline, an approved-device register, encryption on everything you allow, expiring exceptions, and audit evidence proving each clause works. Writing a removable media policy takes an afternoon, and most organizations already have one covering USB drives and other portable storage.

AI agents are non-human identities. They hold credentials, carry permissions, and act on systems around the clock, usually with standing access nobody reviews. The Salesloft Drift breach reached more than 700 organizations through exactly that kind of over-scoped, non-expiring token, with no prompt injection involved. The controls already exist: inventory every agent, scope it to least privilege, expire its access, review it on a schedule, and detect when it's abused.

Insider risk is often framed as an external attacker problem, but a real blind spot sits closer to home: who inside your own security stack can open sensitive files they never needed to see. Classification tools that require broad scanning access often hand that same access to every admin who configures them, turning the tool meant to reduce exposure into another path to it. The people with the least oversight, your own admins, can end up with the most unchecked visibility into regulated data.

Our 2026 Identity and Data Security Report put compromised identity ahead of misconfigured permissions as the leading route to unauthorized access, 41.8% against 33.9%. If identity is the way in, the controls around identity belong together, and that's the reasoning behind most of the consolidation we've seen over the past few years. But how is the work split up?

Operations require elevated access and organizations grant it on trust, so privileged user monitoring has to turn that trust into evidence. An authorization record shows only that the system permitted an action. Monitoring produces a reviewable account of which elevated rights each person used and when, which lets an auditor or investigator test activity without disrupting administration.