● Topic
AI Security
Securing LLMs, agentic systems, and enterprise AI — threats, controls, red teaming, and assurance.
11 articles · page 1 of 2
← All articlesWhat 614 Non-Human Identities Taught Me — and the False Positive That Almost Cried Wolf
I pointed nhi-scan at a real Entra tenant with 614 non-human identities. The 80:1 ratio became a worklist — and the top finding was a false positive: 53 "long-lived secrets" that were really 1. What a real NHI scan reveals, and why context beats raw counts.
Making an NHI Scanner Production-Ready: What a 600-Identity Run Taught the Tool
Running my NHI tool against a real 600+ identity Entra tenant exposed three things unit tests missed: it didn't run on Windows, the enriched scan took 40 minutes, and it mistook managed identities for stored secrets. The fixes — including a 20x speedup — and why dogfooding matters.
What an AI Agent Must Never Be Allowed to Do
Buried in a Microsoft Graph reference is a list of permissions that cannot be granted to an AI agent identity at all. Read backwards, it's the first enforced authority model for agents — six prohibitions worth applying to every agent platform you run, not just Entra.
MCP Triage: Turning Scanner Noise Into a Six-Item To-Do List
MCP security scanners are smoke alarms that go off every time you make toast — one audit found 21 of 27 alerts were false. mcp-triage is the layer that sits on top of any scanner and sorts the noise into the handful that matter, then governs the fleet against the OWASP MCP Top 10.
Drift Detection for Agent Identities: When Reach Grows and the Tier Doesn't Move
An AI agent's reach is the one thing that can grow without anyone touching the identity — give it a new tool or connector and its blast radius expands while privilege, credential age, and owner all look unchanged. Here's why point-in-time posture scans miss it, and how to close the gap.
A Control Framework for Non-Human & Agentic Identity
A practitioner control framework for governing non-human and agentic identities: eight principles, a four-tier risk model, thirty-five controls across eight domains, an agentic threat model, and a maturity model — mapped to OWASP NHI Top 10, NIST AI RMF, CSF 2.0, and 800-53.
The Non-Human Identity Reckoning — and Why Agents Make It Urgent
Non-human identities are the enterprise's largest and least-governed identity population, and AI agents just added autonomy to the problem. Here is why the next identity crisis is already here — and the discipline that answers it.
Understanding Azure AI Foundry Agent Identities, Blueprints, and Entra ID Object Relationships
A practical identity architecture guide for security, governance, and troubleshooting
AI Red Teaming: A Risk-Based Methodology for When, Why, and How
AI red teaming has emerged as a foundational security control for organizations deploying artificial intelligence — analogous to penetration testing for traditional applications, but distinct in scope, technique, and risk profile. Unlike standard security assessments, AI red teaming…
Securing Enterprise AI: An Identity-First Approach
As enterprises move from AI pilots to agentic systems that act on their behalf, identity becomes the control plane. Here is how I think about securing AI agents with the same rigor we apply to human and workload identities.