If that's the case, if it is impossible and no one's safe, what are the foundational steps that you do try and get across to organizations to at least best prepare themselves for the environment that they now find themselves operating in?

Yeah, and this is where we talk a lot about going back to the fundamentals.

What are the standard practices from a security program.

So whether that's making sure that all defaults are changed, resets in software and configurations, ensuring that you have now increasingly speedy and faster, but patching processes that you have.

We've talked about for decades, zero trust, least privilege, minimal access, but we never did a good job of implementing it.

And we're paying the price for that now with agents happily taking advantage of Actis that employees might have that they didn't even realize that they had because we've had complex environments with nested access and unknown credentials just being passed through.

And they were never used because a human never tried it, but agents are very happy to try anything at their disposal.

Given the rapid kind of evolution of the market, what are the emerging threats that you're thinking about right now that you think the industry needs to be aware of, possibly in the short to medium term?

Do you think the previous identity and access models that we've built over these years are fit for purpose? Or are we trying to retrofit agents and AI in a square peg round hole and try and force it in? Do you think we need to completely reinvent the models?

Identity and access has always been a challenge, and it's been a topic over, I've been in security for over 25 years, and there hasn't been a time that I've seen identity and access be well managed, or at least we feel like we have our arms around it.

And agents, AI, and applying that within our environments is just making it worse.

So if you look at humans, we talk about concepts of least privilege, and the zero trust concepts, but we've never done very well in actually deploying that.

And that's because as humans, we want to get our jobs done.

And the easiest way to do that oftentimes is to just open up the access instead of taking the time just to try to figure out what exact access do I need and the trial and error to make that happen.

Teams just often don't have the time and the cycles to go through that.

So do you think, though, in the midst of an incident, Is there any risk, any real risk of overtrusting AI, whether it's in terms of detecting something that wasn't real or providing analysis of something that is a false positive? Actually, you give too much faith that it can handle it, but in reality, it can't.

What's your view in having different vendors, having consolidated view? I mean, what has been solutions that you found are interesting to cover holistically this problem?

There's a lot of different solutions available and the effectiveness really depends on each organization, how they operate, what they see their risks being.

I think for me, a couple of key areas are that AI has continued to increase in importance for non-human identities.

Certainly a lot of conversations the last few years with threat actors just leveraging exposed credentials, API keys to log into environments.

AI is only creating a much larger impact of that.

We're creating many more identities to support agents.

And so solutions that are helping identify, manage life cycle of non-human identities as area solutions.

How did you see this from your perspective?