Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

5 Lessons from Watching an AI Agent Swarm Self-Organize

This summer, we launched Identity Security for AI. That post described an upcoming wave of attacks and security challenges unique to Large Language Models (LLMs) and agentic workflows. As the traditional MITRE ATT&CK framework reached its limits, Google DeepMind published TRAIT&R, a taxonomy of rogue AI tactics and routines closely modeled after MITRE ATT&CK.

AI Agents vs. Audit Logs: What We Learned at Security Game Day

Teams of three to four, detective aliases, a magician, and a flag hidden on a Manhattan billboard. This is our second Identity Security Game Day, a tabletop CTF where Teleport engineers and customers team up to simulate the incidents that don’t happen often, but matter when they do. Game days put customers and Teleporters at the same table. You find out how people actually deploy Teleport versus how you expected, spot better ways of doing things together, and build the personal connections remote work rarely gives you.

Offense vs. Defense in the Age of AI | Red Team vs. Blue Team Panel

Who has the edge in AI security when attackers and defenders have the same models? In this red team vs. blue team panel, Teleport's Ben Arent (Director of Product) talks with Rob (Director of Security, Teleport) and Marcus (founder, maker of Nemesis) about how AI is reshaping infrastructure security: frontier models like Mythos, the Hugging Face incident, prompt injection and the "lethal trifecta," alert fatigue in the SOC, and Teleport's "Pressure Washing" project, where 13 engineers spent a quarter hunting vulnerabilities with LLMs and found more high-severity bugs than in 2024 and 2025 combined.

How to Tie Kubernetes Audit Logs to Individual Engineers

Kubernetes audit logs may show multiple engineers as one user and do not capture what is typed after a kubectl exec session starts. Assign each engineer a unique identity, make sure it stays consistent through proxies and cloud IAM, and use a session recorder if you need to review terminal activity.

How to Reduce Overprivileged Kubernetes Service Accounts

Overprivileged Kubernetes ServiceAccounts persist when broad RBAC, cloud IAM permissions, and long-lived credentials outlive their intended use. Reduce overprivileged access with least privileged RBAC, scoped cloud permissions, and short-lived certificates that eliminate static credentials. I spent two days last quarter tracking down why a developer could delete production secrets. The RBAC looked fine. The ClusterRoleBinding said edit, not cluster-admin.

What PCI DSS 4.0 Requires for Infrastructure Identity and Access Evidence

Most conversations about PCI DSS 4.0 start with the requirements, but I’d rather start with a habit. As a GRC & Cybersecurity Consultant advising organizations preparing for PCI DSS 4.0 assessments, I’ve developed a habit of observing how findings move from identification to ownership, remediation, and documented closure. That’s often where accountability gaps and unresolved findings surface first.