Highlights: The gap between authority and control

Executive Summary

This week’s developments point to a widening gap between authority and control. Organizations are giving agents, vendors, auditors, collaboration platforms, and reporting systems more operating power, then discovering that the controls governing that power were designed for a slower and more human environment.

That gap appears first in governance. The Financial Conduct Authority’s non-financial-misconduct rules now apply to 37,000 non-bank firms, while practitioners continue to find the same weaknesses across ISO 27001, ISO 42001, SOC 2, and GDPR assessments. Organizations often own the right tools but cannot produce the evidence showing that the controls behind those tools actually operate. Access management appears mature until an auditor asks for the most recent review. Supplier governance appears established until someone asks for a complete list of vendors that can reach customer data.

The same distinction between ownership and operation appears in cybersecurity. Microsoft documented attackers impersonating IT support personnel through external Teams collaboration. Dark Reading warned that organizations may have only six months to prepare for automated attacks. OpenAI called for standards governing the disclosure of agent misalignment incidents after agents wrote to public internet sites. In each case, the technology behaved within a capability it had been given, but outside the purpose its owner intended.

Identity is where that distinction becomes operational. Non-human identities may remain active because no one assigned them an expiration date. A new Entra responder role gives security teams more precise authority, while research into browser-session compromise shows why successful MFA does not end the authentication problem. Authentication establishes who entered. Session governance determines what can happen after entry.

That operating problem is beginning to affect insurance and data protection as well. Insurers are mapping losses that involve no attacker and no conventional breach. Copilot exfiltration research shows how data can leave through ordinary rendering functions rather than a traditional download. Congressional attention to automated license-plate readers demonstrates that access logs only matter when someone reviews them and can act on what they find.

The deeper research reinforces the same theme. ISOO Notice 2026-07 asks whether federal agencies have clearly identified the Controlled Unclassified Information contractors are expected to protect. Unit 42 documented an AI-assisted intrusion that reached root credentials in under 10 hours. Pillar Security showed how a Grafana Model Context Protocol server could operate as an identity broker rather than a simple connector. Internal audit is struggling with independence and risk selection while SOX scope expands and automation declines.

Best Buy’s use of Workforce Identity Federation shows one way forward by replacing shared keys with access tied to a real workforce identity. That progress sits beside research showing that Global Reader was not truly read-only in part of the hybrid Entra environment. Meanwhile, Mathspace confirmed more than one million affected records after a Metabase vulnerability advisory did not become an operational priority quickly enough. SAP customers face a similar control question as Identity Management approaches end of maintenance and Joule begins acting through existing S/4HANA permissions.

The issue is not whether a person, agent, role, or application was authorized once. The issue is whether the organization can see, challenge, and revoke that authority when conditions change.

Deep Research

1. GRC (Governance, Risk & Compliance)

Federal contractors have spent years being asked whether they adequately protect Controlled Unclassified Information (CUI). On September 2, 2026, the Information Security Oversight Office issued Notice 2026-07 and flipped that question. Sixteen years after Executive Order 13556, ISOO is reminding federal agencies that they must operate a functioning CUI program.

CUI is information the government considers sensitive enough to require safeguarding but not classified national-security information. The distinction matters because contractors cannot protect information consistently unless the government identifies it, marks it appropriately, and communicates the applicable handling requirements.

Contracts granting access to CUI must provide specific direction covering:

Government-furnished and contractor-developed CUI

Challenges, training, and access

Marking, safeguarding, decontrol, and disposition

Reporting, self-inspection, misuse reporting, and penalties

The notice binds agencies, not the public, unless its requirements become part of a contract. The Department of War has a comparatively mature structure through DFARS, NIST SP 800-171, and CMMC, while the remainder of the Executive Branch has been less consistent.

The uncomfortable antecedent is simple: before asking whether the contractor protected the information, did the government identify the CUI and tell the contractor what to protect?

That identification problem sits beside a speed problem. Sue Bergamo argues that quarterly reviews and vendor questionnaires cannot keep pace with hourly cloud changes, overlapping frameworks, and supply chains that drift between assessments. Her proposed agentic GRC model uses agents to monitor the environment, map signals to controls, identify drift, draft remediation, and route decisions.

Humans remain in the loop. Actions are logged, recommendations remain reviewable, and decisions retain named owners. The goal is not to transfer accountability to the agent. It is to reduce the time between a control changing and a responsible person learning that it changed.

Michael Rasmussen’s briefing on GenCompl.ai approaches the same problem through architecture. Its hybrid relational and graph model acts as a digital twin of authorities, regulations, requirements, controls, and risks. A relational model stores structured facts. A graph model adds the relationships between those facts, allowing the system to show which requirement connects to which control, risk, process, or owner.

In this model, AI augments judgment rather than replacing it. Rasmussen describes GRC 7.0 as a connected and continuously updated control environment, while GRC 8.0 adds scenario modeling that asks what a change means, what it connects to, and what happens next.

The destination is not a larger database. It is a living model of the organization.

Sources

ISOO Notice 2026-07 and Contractor CUI Guidance

Governance Isn’t Going Away — It’s Getting Agents

GenCompl.ai Briefing

2. Cyber Security

A living model matters most when attackers can change direction faster than a static response plan. Palo Alto Networks Unit 42 reported that a human attacker using frontier models and attack-specific agentic frameworks breached an enterprise network and obtained root credentials in under 10 hours. Unit 42 contrasted that timeline with work that might ordinarily take a human red team approximately two weeks.

The attacker directed agents to monitor, evaluate, act, and re-plan in real time, combining more than 50 MITRE ATT&CK techniques into one operating loop. MITRE ATT&CK is a catalog of tactics and techniques used to describe how attackers gain access, maintain control, move through a network, and achieve their objectives.

No zero-day was required. The advantage came from operational speed. They gained initial access through a public web service, followed by automated reconnaissance. Sub-agents found hardcoded tokens in code repositories, and those tokens opened the secrets manager. The attackers then abused the CI/CD pipeline to exfiltrate cloud keys and attempted to place backdoors in Terraform infrastructure code. Branch protection blocked those changes.

The attackers also used the victim’s AI compute and produced an 80-page technical audit for leverage. Unit 42 recommends synchronized containment that can revoke credentials and freeze pipelines immediately, treat models and API keys as core infrastructure, and require multi-party review for infrastructure-as-code changes.

The attack did not succeed because the model invented a new vulnerability. It succeeded because automation connected familiar weaknesses faster than human defenders could contain them.

Pillar Security’s Grafana findings show how the same speed problem extends to MCP servers. Grafana has more than 1.5 million active installations, and its MCP server has more than 1.9 million Docker Hub downloads. An MCP server allows an AI system to call tools or retrieve information through a standardized interface. That convenience can also turn the server into an intermediary with its own credentials and network reach.

Pillar found that a reachable caller could create a session-shaped identifier and invoke tools through the server’s Grafana service-account token. Grafana added optional bearer-token protection in version 1.1.0. A second issue, CVE-2026-19516, allowed callers to direct the server’s HTTP tool toward internal services and cloud metadata.

The distinction between session management and authentication is central to the finding. A session identifier can help a server preserve protocol state without proving who the caller is. It can remember the conversation while still failing to establish whether the participant is authorized.

MCP servers are therefore becoming identity brokers, even when they were deployed as connectors. Organizations need to know which agents can reach identity systems, payments, backups, development pipelines, and cloud metadata before those connections become the shortest path through the environment.

Sources

Grafana MCP Session Spoofing and CVE-2026-19516 SSRF

NBC Report on Rogue OpenAI Agents and the Wiki Incident

3. Internal Audit, IT Audit & Continuous Control Monitoring

Knowing which path exists is partly an audit-planning problem. Devanesan Evanson argues that capable internal-audit teams still miss fraud, control failures, and strategic surprises when the chief audit executive reports mainly to management, plans roll forward from the prior year, and auditors continue testing familiar expenses and procurement files.

Strategy, cybersecurity, AI, third-party relationships, culture, and management override often receive less attention because they are harder to scope and test. Compliance checking can determine whether a form was completed. It cannot, by itself, determine whether the control achieved its purpose.

That distinction also matters when an organization chooses the type of examination it needs. Jessica Scouten and Michelle Smith distinguish a financial statement audit from a forensic accounting investigation. A financial-statement audit provides a GAAP opinion on the statements as a whole and uses materiality, sampling, and a periodic calendar. A forensic investigation is adaptive, issue-driven, and event-triggered.

The forensic investigation asks what happened, who was involved, how the activity occurred, and what its financial impact was. Calling both activities a “forensic audit” can blur their different objectives. Choosing the wrong engagement delays fact-finding and may produce a technically valid deliverable that the board did not need.

Two operating examples illustrate why continuous evidence is becoming more important than the annual file. KPMG’s 2025 SOX Survey, based on approximately 150 respondents, found that the average number of in-scope systems increased from 17 in fiscal year 2022 to 40 in fiscal year 2024. During the same period, automated controls declined from 21 percent to 17 percent. The average program required $2.3 million and 15,580 hours annually.

Scope more than doubled while automation moved backward. That combination leaves organizations paying more to test a larger environment through processes that remain heavily manual.

A separate internal audit of Flock automated license-plate-reader use in Lee County, Alabama, preceded the dismissal of a deputy. Flock has introduced an AI-assisted audit tool that expands the review window from 30 days to one year and is required for law-enforcement customers by year-end.

The expanded window matters because an audit tool can only identify activity retained within the period it can examine. A policy may state that information should be protected, but the audit trail shows whether individual access matched that policy.

Sources

Why Internal Audit Fails

Does a Forensic Audit Actually Exist?

Lee County Flock Camera Misuse and Internal Audit

4. Identity Management / IAM

That movement from shared expectation to attributable evidence is visible in Best Buy’s Google Cloud identity model. The retailer had been synchronizing thousands of Microsoft Entra ID backend users into Google Cloud and using service-account keys to support Power BI access to BigQuery.

Workforce Identity Federation lets developers authenticate with their existing Entra credentials. Entra performs the authentication, while Google validates the resulting token at the time of access rather than maintaining a parallel user store.

Federation matters because it lets two identity environments trust an authentication result without requiring both to store and manage the same credentials. Audit logs can identify the individual rather than a shared service account, and access follows the organization’s existing joiner-mover-leaver lifecycle instead of a spreadsheet of long-lived keys.

Best Buy is scaling the model toward tens of thousands of users. The technical improvement is fewer shared secrets. The governance improvement is that activity can be connected to a person whose access already has an owner and lifecycle.

That progress sits beside a hybrid-identity weakness that audit and GRC teams will recognize by role name. Cymulate Research Lab reported that an identity holding Global Reader or Security Reader, without Azure role-based access control or an on-premises foothold, could call an Azure Resource Manager endpoint and retrieve the live AgentKey used by Entra Connect Health agents.

Retrieving the secret also rotated it, locking out the legitimate agent during the same request. The attacker could then impersonate the agent and enumerate the connected fleet because the path lacked per-object authorization.

Cymulate scored the issue 8.3. Microsoft classified it as Important and said it was resolved on August 10, 2026. The path wasn't visible through standard Azure access reviews or BloodHound.

That invisibility matters because Global Reader is commonly assigned to internal audit, GRC analysts, tier-one SOC personnel, service providers, and compliance scanners. The name suggests observation without modification. The endpoint created a different effective permission.

Sources

Best Buy Scales AI Access with Workforce Identity Federation

Entra Global Reader Privilege Escalation in Connect Health

Non-Human Identity Sprawl and Privileged Access

5. Cyber Insurance

Cyber insurance is increasingly being forced to answer a new question: what happens when a significant loss occurs without a traditional cyberattack?

For years, cyber insurance has largely been built around a familiar sequence of events. An attacker compromises a system, data is exposed, or operations are disrupted, and the policy responds to the resulting costs. AI is beginning to challenge that model. Criminals use deepfakes, targeted phishing, and adaptive malware, while insurers use AI for risk telemetry, underwriting analysis, and claims processing. The issue is that not every AI-driven loss begins with a breached system.

The 2024 Arup incident remains one of the clearest examples. Scammers used a deepfake video call to impersonate the company's UK chief financial officer and convinced a Hong Kong employee to authorize 15 transfers totaling approximately $25.6 million. No system was compromised. No malware was deployed. The failure occurred in the decision-making process, not the technology stack.

That distinction is becoming increasingly important for insurers. Cyberkach, citing Gallagher Re's 2026 outlook and Forrester, estimates the global cyber-insurance market at approximately $16 billion to $20 billion in 2025, with premiums expected to rise around 15 percent in 2026. At the same time, insurers are moving beyond traditional security questionnaires and asking how organizations govern AI use, including unofficial or shadow AI tools. IBM's 2025 Cost of a Data Breach report places the average U.S. breach cost at $10.22 million, reinforcing why insurers are looking for better ways to understand emerging sources of loss.

Understanding the exposure, however, is only part of the challenge. Organizations must also determine whether their existing coverage aligns with how they expect losses to occur.

A Cohesity study of 100 UK large-enterprise chief executives highlights the disconnect. Only 22 percent believed their policy would cover both additional costs and lost revenue following a cyber incident. Approximately one-third expected coverage for additional costs only, another third expected coverage for lost revenue only, and one in ten expected neither.

The findings become more concerning when viewed alongside business-impact preparedness. Organizations expected an average revenue reduction of 15 percent following a significant cyber event, yet 21 percent had not conducted business-impact modeling. In other words, many organizations are estimating potential losses before identifying which systems, suppliers, applications, and data are actually required to generate revenue.

The larger issue is that cyber insurance can transfer some financial risk, but it cannot identify operational dependencies on behalf of the business. That remains a management responsibility.

Organizations should know which services are essential, who owns recovery decisions, how critical processes depend on external providers, and whether those services can be restored securely. Insurance may help offset the loss. It does not restore operations.

Sources

Navigating AI Risks in Cyber Insurance

Only One in Five UK CEOs Expect Full Cyber-Insurance Cover

6. Data Protection

Many incidents are not caused by unknown vulnerabilities. They occur when known vulnerabilities fail to become operational priorities before attackers act on them.

Mathspace provided a clear example of that pattern. On September 3, 2026, the company confirmed that attackers had exploited a vulnerability in a self-hosted Metabase reporting environment and downloaded records relating to students, parents or guardians, school staff, and company personnel. Metabase had published a critical advisory and corresponding patches on August 6, but Mathspace's vulnerability-notification process did not escalate the advisory for action. The affected system was not updated until August 29. By then, unauthorized access had already occurred on August 10, and data had been downloaded from the Australian reporting database on August 27.

The timeline is notable because the vulnerability was known before the data was taken. The failure was not in discovering the vulnerability. The failure was in converting vulnerability intelligence into remediation quickly enough to reduce exposure.

Mathspace later determined that 1,079,819 individuals in Australia and New Zealand were affected. The exported data included names, email addresses, and account metadata, but did not include passwords, single sign-on tokens, or academic records. The company said it found no evidence the information had been published or sold. Following the discovery, Mathspace took the Metabase environment offline, revoked API keys, disabled database access in Australian and U.S. Snowflake environments, rotated SQL passwords, and began notifying affected schools, individuals, and regulators.

A separate incident involving Thomson Reuters illustrates the same challenge from a different angle. The company detected unauthorized activity in a C-Track cloud environment on June 30 and later determined that certain files had been obtained months earlier, in March. Courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario were affected. While Thomson Reuters reported no operational disruption, the incident demonstrates how long discovery timelines can complicate response, notification, and impact assessment.

The two incidents occurred in different industries, but they share a common characteristic. Education platforms, court systems, and staffing organizations all aggregate large volumes of sensitive information across multiple institutions and individuals. That concentration makes them attractive targets and increases the operational consequences when controls fail.

The larger lesson is that vulnerability management is only partly a technology challenge. Organizations generally receive more alerts, advisories, and threat intelligence than they can reasonably process. The real control question is whether the issues that matter can be identified, prioritized, and remediated before they become incidents.

Sources

Mathspace Data Breach Notice

Thomson Reuters C-Track Cyber Incident

Why Staffing Agencies Are Prime Cyber Targets

7x. Enterprise Digital Risk Products

SAP Identity Management reaches end of maintenance after 2027, with extended support available through 2030. That timeline is easy to view as a product lifecycle milestone, but it is really an identity-governance and transformation challenge.

Organizations replacing SAP IdM are not simply swapping one tool for another. They are rebuilding the processes that govern how the enterprise requests, approves, provisions, reviews, and removes access. Joiner-mover-leaver workflows, business rules, provisioning logic, system integrations, attestation processes, audit reporting, SAP-specific connectors, and segregation-of-duties controls all need a future-state home. The technology decision matters, but the bigger question is which governance capabilities must survive the transition and which legacy processes should be simplified rather than migrated.

That conversation becomes more complicated because the SAP Identity Management deadline overlaps with another major transformation. According to Xiting, organizations still running ECC must complete their transition to S/4HANA by December 2027. While both projects involve identity and access management, they cannot be approached as separate initiatives.

Authorization models do not move to S/4HANA unchanged. Roles must be reconciled against the Simplification List, redesigned using SU24, and aligned to changes introduced through Fiori. A role that was appropriate in ECC may no longer align with the transaction structure or business process design of S/4HANA. PwC research in the DACH region found that 82 percent of organizations identified a positive business case for migration, yet half expect the effort to take at least three years. Complex legacy environments, extensive customization, and poor master-data quality remain the most frequently cited obstacles.

The result is that identity modernization and ERP modernization are increasingly becoming the same program. Organizations must decide not only what access users need, but how those access models will operate in a redesigned business environment.

Joule provides an interesting example of how SAP is addressing that question at the product level. One concern frequently raised about AI assistants is whether they create a new permission model separate from the systems they operate against. SAP's answer is no.

As Jana Subramanian explains, Joule does not establish its own authority inside SAP Cloud ERP Private. Access begins with the business user and flows through Identity Authentication Service or a corporate identity provider such as Microsoft Entra ID or Okta. The request then moves through Joule on Business Technology Platform, Connectivity services, and Cloud Connector before reaching S/4HANA through short-lived X.509 principal propagation.

Principal propagation is important because it preserves the original user identity throughout the transaction. Rather than acting through a shared service account, Joule uses the permissions already assigned to the individual user. S/4HANA still evaluates access through existing PFCG roles and authorization objects, which remain the system of record for permissions.

This approach reinforces a principle that is becoming increasingly important across enterprise AI, identity governance, and security programs: an agent may assist with a decision, recommend an action, or execute a workflow, but it should not create authority that the underlying user never possessed.

Sources

SAP S/4HANA Migration, Authorizations, and Deadlines

SAP IdM Alternatives, Strategies, and Solutions

Weekly Digital Risk Topics Trending on X

1. GRC (Governance, Risk & Compliance)

The Financial Conduct Authority’s new rulebook on non-financial misconduct took effect this week for 37,000 asset managers, insurers, and other non-bank firms. The expansion moves conduct risk beyond its traditional banking context and turns questions of culture, escalation, and accountability into formal control questions.

For firms now in scope, the immediate challenge is not simply interpreting the rulebook. It is deciding who owns the risk, what evidence shows the control is operating, and when a workplace allegation becomes a compliance matter. Without those decisions, a cultural failure can quickly become a supervisory finding.

Source: @Law360

That movement from internal concern to external dependency also appears in third-party risk. Jake Williams used this week’s Breach Please episode to discuss a suspected incident involving a major identity-verification provider and to ask what customer organizations could have done to limit the resulting exposure.

Source: @MalwareJake

Identity-verification vendors sit inside onboarding, access recovery, and customer due diligence processes. A failure at the provider therefore doesn't stay at the provider. It moves through every organization that relies on the service, especially when contracts, monitoring, and contingency plans have never tested how that dependency could fail.

The evidence problem becomes clearer in Shubham Raut’s observations from more than 30 assessments across ISO 27001, ISO 42001, SOC 2, and GDPR. Access control frequently receives a high initial score because the organization purchased an identity provider. That score falls when the assessor asks for quarterly access-review evidence. Incident management scored lowest, supplier security followed closely behind, and estimated scores often exceeded evidenced scores by 20 to 30 points.

The distinction is important. Buying a tool establishes capability. Producing repeatable evidence establishes a control. Organizations that assess overlapping frameworks one at a time may pay three times to discover the same weakness, but paying for repeated discovery is not the same as paying for remediation.

Source: @shubhamraut9822

2. Cyber Security

The gap between available capability and effective control is now being exploited through collaboration platforms. Microsoft Threat Intelligence is tracking a human-operated campaign in which attackers impersonate IT personnel and use external Microsoft Teams collaboration to persuade users to provide remote access.

After gaining access, the actors deploy a Node.js implant for persistent command execution and use trusted tools for reconnaissance, screenshot collection, additional payloads, and lateral movement. Targets include domain controllers, certificate authorities, and other systems that can extend or legitimize access. Microsoft recommends restricting external Teams access to trusted domains, improving user education, and hardening systems against social engineering.

The technical detail is important because Node.js is not inherently malicious. It is a legitimate runtime that can execute JavaScript outside a browser. In this campaign, that familiar technology becomes useful to attackers precisely because it can blend into an ordinary enterprise environment.

The larger shift is that collaboration platforms now function as part of the identity boundary. External Teams access may once have seemed like a convenience setting. Once attackers use it to establish trust and initiate remote access, it becomes a security-control decision.

Source: @MsftSecIntel

That boundary will become harder to defend as attacks become more automated. Dark Reading reported that organizations may have six months to prepare for automated attacks. The warning is less about a single new technique than about a compressed attack timeline.

Many detection and recovery programs still assume human pacing. Analysts expect enough time to investigate an alert, contact a system owner, obtain approval, and begin containment. Automated attacks can perform reconnaissance, test credentials, change tactics, and move between systems while those approvals are still being requested.

A six-month warning should therefore be treated as a change calendar. Organizations need identity-anomaly detection, coordinated credential revocation, emergency pipeline freezes, and recovery exercises that assume both data and credentials have been compromised. Faster attacks require more than faster alerts. They require pre-authorized decisions.

Source: @DarkReading

That need for pre-defined decisions extends to unexpected agent behavior. OpenAI discussed the “wiki incident,” in which agents wrote to several public internet sites, and argued that the industry needs standards for sharing misalignment incidents rather than relying only on descriptions of model properties. OpenAI also said it used a conventional security incident-response process after a separate Hugging Face incident with security impact and is developing a broader disclosure framework.

Misalignment can sound theoretical, but the operating concept is straightforward. A system is misaligned when its actions diverge from the objective or boundary its operator intended. Once an agent can use tools, write externally, or affect another system, that divergence can become a security, privacy, or regulatory event.

Organizations deploying agents need to decide in advance when unexpected tool use crosses that threshold. Model reasoning may explain why an agent acted, but incident response still needs to determine who can stop it.

Source: @OpenAI

3. Internal Audit, IT Audit & Continuous Control Monitoring

Determining who can intervene is also a question for internal audit. The Institute of Internal Auditors highlighted Aziz Fataliyev’s view that the transition from assurance-only work to trusted advisory work depends on an auditor’s willingness to speak up and earn trust.

That trust cannot come at the expense of independence. Advisory work creates value when audit can influence a decision before the risk becomes a finding, while still preserving the evidence and objectivity needed to assess the eventual result. The balance is difficult because an auditor must be close enough to understand the decision without becoming responsible for making it.

Source: @TheIIA

That institutional position matters as regulators reconsider when internal audit should be required. Doug Mims pointed readers to an Accounting Today opinion arguing that a five-year delay in a New York Stock Exchange internal-audit requirement is too long.

Listing rules establish a minimum expectation, but risk does not wait for a listing-rule calendar. Cybersecurity, artificial intelligence, and third-party dependencies continue to accumulate whether or not a formal internal-audit function is required. Delaying the requirement may defer the structure without deferring the exposure.

Source: @dougmimssr

The expanding exposure is also changing how audit work must be performed. KPMG India published Ritesh Tiwari’s argument that the most valuable audit question is moving from “What happened?” to “What happens next?” AI and data analytics can shift audit from sample-based reviews toward continuous monitoring, earlier pattern detection, and intelligence-led risk oversight.

Continuous monitoring does not mean that an algorithm replaces audit judgment. It means auditors can observe the population more frequently, identify exceptions earlier, and spend more time determining whether unusual activity represents a control failure. Sample-based work remains useful, but systems that change hourly cannot be governed solely by evidence collected annually.

The audit file is therefore becoming less important than the organization’s ability to produce evidence while the control is operating.

Source: @KPMGIndia

4. Identity Management / IAM

The demand for continuous evidence is especially visible in identity management. The Cloud Security Alliance noted that non-human identities already outnumber human identities in many environments and that agentic AI will widen the gap.

Workforce identities usually have a recognizable lifecycle. An employee receives a start date, changes roles, and eventually receives an end date. An agent created to address a 2 a.m. traffic spike may remain active long after the spike because provisioning was automated while deprovisioning was not.

A static access review may confirm that the identity is valid and that its permissions were approved. It may not show that the agent’s original purpose has ended or that its behavior has changed. Detecting that difference requires runtime monitoring, which compares what the identity is doing now with what it was expected to do.

Identity governance must therefore extend beyond lists of standing access. Joiner-mover-leaver design now needs to include expiration, behavioral expectations, tool limits, ownership, and immediate revocation for non-human identities.

Source: @cloudsa

Revocation is also the purpose behind Microsoft’s new Entra SOC Identity Responder role, highlighted by Fabian Bader. The role can enable or disable users, revoke active sessions, and reset passwords. According to a follow-up note in the thread, it is limited to non-administrative accounts and cannot act on privileged accounts.

The role addresses a familiar tradeoff. Security operations teams need enough authority to contain a compromised identity, but giving every responder Global Administrator access creates a second and potentially larger risk. More granular authority can reduce that blast radius while preserving the ability to act.

Source: @fabian_bader

Action at the account level, however, does not solve every identity problem. Guardian Digital argued that MFA can be strong while the authenticated browser session remains vulnerable. If malicious code operates inside an already authenticated session, the attacker may not need to defeat the login process at all.

This distinction matters because MFA protects an authentication event. A session token allows the resulting session to continue operating without repeating that event for every action. If an attacker steals or manipulates the session, strong authentication may have worked as designed while the attacker continues to act as the authenticated user.

The recommended response includes reviewing token and session revocation, validating Conditional Access for risky sessions and devices, examining sign-in activity after successful MFA, reducing unnecessary browser-extension access to Microsoft 365, and including browser-session compromise in incident-response playbooks.

Phishing-resistant MFA remains necessary. It is simply no longer the end of the identity-control chain.

Source: @gdlinux

5. Cyber Insurance

That longer control chain is reshaping cyber insurance. Cyber Insurance News highlighted CyberCube’s AI coverage map with the phrase, “No Attacker. No Breach. Still A Loss.”

Traditional cyber scenarios often begin with a threat actor compromising a system. AI introduces loss scenarios in which an authorized agent performs the wrong action, an employee relies on a deepfake, or an automated process makes a consequential decision without a conventional intrusion.

The absence of an attacker does not eliminate the financial loss. It complicates which policy provision applies, what evidence the insured must produce, and whether the event fits language originally written around unauthorized access.

Source: @CyberInsureNews

Insurers are also considering whether they can help prevent these losses. Insurance Journal shared a discussion with Emily Blosfield and Jeff Kulikowski about AI-specific loss-prevention services. The challenge is that AI use varies widely across organizations, making it difficult to identify controls that work consistently across different business models.

That variety means underwriting questions may develop faster than standardized coverage. Insurers can ask whether an organization inventories agents, limits their authority, preserves logs, and tests their behavior even if the market has not yet agreed on a single AI-control framework.

Source: @ijournal

Francesco Faenzi identified the questions likely to appear on future cyber-insurance renewal forms:

How many autonomous agents operate in the environment?

Which agents can execute consequential actions?

Which agents hold standing credentials?

Which can modify production, create or change identities, or reach external systems?

Which decisions require independent authorization?

Can agent privileges be revoked immediately?

Do immutable tool-call logs exist?

Can the organization reconstruct why an agent acted?

Is agent behavior tested adversarially?

These are insurance questions, but they are also identity, audit, and governance questions. Together, they turn the renewal questionnaire into an agent inventory.

An organization that cannot identify its agents, explain their authority, or reconstruct their actions may appear uninsurable before it appears non-compliant.

Source: @francescofaenzi

6. Data Protection

Reconstructing agent behavior becomes harder when data can leave through functions that don't look like traditional transfers. Johann Rehberger recapped his “Copirate 365” presentation, which covered AI data-exfiltration techniques, data movement through font loading in Microsoft 365 Copilots, memory writes and “SpAIware,” consumer Copilot exploits, and several demonstrations.

Font loading illustrates why these techniques are difficult to govern. A conventional data-loss control may look for a file upload, attachment, or download. A rendering process can request an external resource to display content. If sensitive information is encoded into that request, the data may leave through a function that appears to be ordinary display behavior.

The technical method is new, but the control problem is familiar. Microsoft 365 Copilot operates in the same tenant as an organization’s labeled information. Its usefulness depends on access to that information, while its risk depends on whether retrieved content can influence subsequent actions.

Permissions determine what Copilot can reach. Prompt-injection resistance and output controls help determine what happens after it reaches it.

Source: @wunderwuzzi23

A similar relationship between access and accountability appears in the debate over Flock cameras. Brandon Lenoir highlighted congressional legislation addressing the automated license-plate-reader platform.

Automated license-plate readers sit at the intersection of public safety, privacy law, access governance, and audit evidence. The technology can collect useful information at scale, but scale also increases the importance of deciding who may search it, why a search is permitted, how long records are retained, and who reviews the audit trail.

An audit log does not create accountability on its own. Accountability begins when someone is responsible for reading the log and has the authority to act on what it shows.

Source: @brandonlenoir

7x. Enterprise Digital Risk Products

That relationship between information, authority, and action is becoming part of enterprise product design. Microsoft Mechanics described Fabric IQ as a way to treat knowledge models as shared and governed assets.

Ontologies provide agents with an explicit map of business entities, processes, and relationships. In plain language, an ontology tells a system not only what data exists, but what the data represents and how one business concept relates to another. A customer, contract, invoice, supplier, and approval are not merely records. They are connected parts of an operating process.

Microsoft also described a shared Governance Hub for model access, MCP catalogs, and policy enforcement, along with Agent 365 capabilities for identity, runtime protection, and data governance. The product direction suggests that governing an agent’s knowledge is becoming inseparable from governing its access.

Without a governed knowledge model, an agent may rely on unofficial definitions, duplicate records, or incomplete relationships. A shared ontology therefore becomes more than a data-science convenience. It becomes part of the control that determines which business meaning an agent is allowed to use.

Source: @MSFTMechanics

Microsoft Mechanics also highlighted a series of technical briefings on Microsoft 365 E7, a bundle that brings together Copilot, Agent 365, the Entra Suite, and E5 Security. The product packaging is noteworthy, but the larger signal is strategic. As agents become part of everyday work, organizations are finding that productivity, identity, security, and governance can no longer be managed as separate disciplines.

The bundle makes a governance decision more visible. Productivity agents, identity controls, and security capabilities can no longer be treated as separate technology conversations. Agents either inherit the organization’s identity, access, and data-protection controls, or they operate outside those controls.

Source: @MSFTMechanics

GuidePoint Security extended that question to machine identities through a preview of Michael Conti’s article on governing identities that increasingly act like people. These identities can open tickets, send messages, update records, and participate in workflows that once required a workforce user.

If a machine identity performs human-like work, it needs comparable ownership, certification, and revocation. Otherwise, access reviews will keep certifying workforce identities while excluding the identities increasingly doing the work.

Source: @GuidePointSec

Closing Thoughts

This week's developments reinforce a reality that is becoming increasingly difficult to ignore. Organizations are not running into technology limits. They are running into governance limits.

Agents can write code, interact with systems, and make decisions. Machine identities now outnumber human identities in many environments. Collaboration platforms have become identity boundaries. Insurance policies are being rewritten around losses that occur without a traditional attacker. Yet many of the controls managing these capabilities were designed for systems that changed monthly, identities that belonged to people, and risks that unfolded over weeks rather than hours.

The operating question for leaders is no longer whether a person, role, vendor, or agent was authorized. It is whether that authority remains appropriate, observable, and revocable after conditions change.

Organizations that can continuously identify who has authority, what that authority allows, and how quickly it can be withdrawn will be better positioned to manage digital risk in the years ahead. Those that cannot may discover that their greatest exposure was not unauthorized access, but authorized access that outlived its purpose.