Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In our last post, we shared how we began to scale our security code review process with SAGE. We discussed how we gathered historical Product Security (ProdSec) review records to create a 1Password-specific ruleset, the three-stage Finder/Critic/Judge pipeline, and the limitations of our v1 implementation.

AI agents are doing more than just generating code. Increasingly, they are working autonomously on complex coding challenges, touching production APIs, databases, and infrastructure across development environments, often without thorough human review. To perform these operations and access multiple systems, agents rely on developer secrets and non-human identities (NHI). But often, developers lack a secure way to share these secrets, leading to overprivileged, invisible access.

Every mature cyber program eventually hits the same wall. Security teams collect enormous amounts of telemetry, threat intelligence, and control data, and yet the conversation with the CFO about what to fund next still feels like an argument about opinions rather than evidence. The reason is not that the data is missing.

AI agent identity is a unique, digitally verifiable credential assigned to an autonomous AI system that defines who the agent is, what resources it can access, and on whose behalf it is acting. As AI systems move from answering questions to executing real-world actions independently, agent identity has become the new control plane for enterprise cybersecurity. Legacy identity and access management tools were built for humans behind a login screen and static service accounts running deterministic code.

Future-proofing organizations in the face of AI requires a unified defense strategy that secures both the human workforce and autonomous AI agents. One of the key requirements is shifting security cultures from reactive compliance to proactive, measurable behavioral change. As artificial intelligence evolves from a supporting tool into an autonomous digital workforce, organizations must adapt their defense frameworks to mitigate both human and agentic risks.

In business, calling something a dinosaur is meant to suggest it is slow, outdated and overdue for extinction. Which is unfair to dinosaurs, who enjoyed one of the most successful runs in the history of life. Here is what people think they mean when they use the word. Lumbering. Doomed. Obsolete. A fat target waiting for the meteor. They imagine a tar pit. They imagine extinction. They picture something huge and slow, magnificently unsuited to the world it finds itself in.

Most phishing attacks pick a target and commit to a tactic. This one picks the tactic based on the target, which happens dynamically, per device, in milliseconds, without the victim ever knowing a decision was made.