by Gary Zimmerman | Oct 12, 2026 | AI, Cybersecurity, Governance, Identity
Last week I asked where your AI policy actually fires LINK: Your AI Policy Isn’t a Control Until It Fires. This week I want to ask what happens after it fires. Can you prove it did? Here’s the scenario I keep coming back to. An agent in your environment...
by Gary Zimmerman | Oct 5, 2026 | AI, Governance, Identity
Last week I asked which way your guardrails fail when they stop working Which Way Does Your Guardrail Fail?. This week I want to back up a step and ask something more basic. Is your AI policy connected to anything at all? That sounds like a rhetorical question. It...
by Gary Zimmerman | Sep 28, 2026 | AI, Cybersecurity, Identity
Last week I argued that a short-lived, tightly scoped credential is the one gate that doesn’t depend on the agent’s cooperation [LINK: Your Credential Policy Was Written for Humans]. That argument has an assumption buried in it. It assumes the gate holds....
by Gary Zimmerman | Sep 21, 2026 | AI, Cybersecurity, Identity
Last week’s FuBAC analysis listed credentials as the sixth attribute of the Artificial Identity: short-lived, task-scoped, cryptographically verifiable, issued per function and expired at completion. It is the attribute that sounds most like routine hygiene and...
by Gary Zimmerman | Sep 14, 2026 | AI, Governance, Identity
The governance architecture that Black Hat 2026 defined — the five-layer control plane for AI agents built from identity outward — depends on a premise that most enterprise identity programs have not yet confronted: role-based access control does not work for AI...
by Gary Zimmerman | Sep 8, 2026 | AI, Identity
There is a version of the AI governance conversation that has been happening for two years in conference rooms and board briefings and risk committee agendas. It is a conversation about frameworks and policies and responsible AI principles and vendor attestations and...
by Gary Zimmerman | Aug 4, 2026 | AI, Governance, Identity
On July 28, Cyera announced it was acquiring Oasis Security for $1 billion. The same day, Hush Security announced a $30 million Series A. Two days later, Okta announced it was acquiring Permiso Security — financial terms undisclosed, but strategically significant...
by Gary Zimmerman | Jun 22, 2026 | AI, Governance, Identity
The CISO role has always carried accountability that outpaced authority. What changed in 2026 is that the accountability became legally enforceable, personally, and the regulatory mechanisms to enforce it are no longer on the horizon. They are active. Splunk’s...
by Gary Zimmerman | Jun 15, 2026 | AI, Cybersecurity, Identity
Your identity governance program almost certainly has a blind spot. It is not a configuration error or a policy gap. It is architectural. The IGA platforms most enterprises run were designed when “identity” meant a person. Joiner-mover-leaver workflows,...
by Gary Zimmerman | Jun 2, 2026 | AI, Cybersecurity, Identity
The question we keep getting from security architects right now is some version of the same thing: “We have a zero trust program. We have identity governance. We have PAM. Why does none of it cover our AI agents?” The honest answer is that it was never...
Recent Comments