Itamar Apelblat was called back to reserve duty with Unit 8200 and spent hours waiting on access approvals. Then he remembered a service account his old team had set up seven years earlier. The password was a funny one, which is why he still knew it. He typed it in and became an admin on one of the most secure networks in the world.

Nobody had changed that password. They hadn't forgotten about it. They were scared to touch it, because no one knew what would break.

Now put that same fear in front of AI agents. When Token Security's research team checked its enterprise customers, more than 16 percent already had Muse running locally against corporate email and other resources. Muse launched three weeks before we recorded and is already the most popular productivity app in the App Store. Itamar expects agents to outnumber humans in the enterprise a hundred to one.

His argument is that you can't secure agents by predicting every way they'll go wrong. An agent chases its goal like it's possessed and takes any access path that gets it there. What you can control is how much autonomy it has and what it's allowed to touch. Both come down to identity.

In this episode I sit down with Itamar, co-founder and CEO of Token Security, and we get specific:

→ The three things companies find the first time they look: agents wired straight into production on raw API keys, abandoned experiment agents still holding privileges, and agents still running after their owner left the company
→ What intent-based access management actually means, and why an agent built to send a weekly report should never be able to delete from your database
→ Why IGA and PAM fall apart here: they treat Okta or Active Directory as the source of truth, while agents live on laptops, in SaaS, and in the cloud
→ What happens when a coding agent tries to connect to a production Snowflake environment, and how to decide where a human still has to approve
→ Who should own agent security, and why Itamar puts most of it with the IAM team

I also put the hard question to him. We've had twenty years to get least privilege right for humans and mostly failed, so why would agents go any better? Then, at the end, he gives his advice on where security teams should start. It isn't the usual "get visibility first," and it's the part I'd most want a security leader to hear.

⏱️ CHAPTERS

0:00 Introduction
1:49 Unit 8200 and "Which Product Do You Hate the Most?"
3:58 The Seven-Year-Old Password That Still Worked
6:32 Autonomy and Access: The Two Dimensions of Agent Risk
8:19 Why Agents Act Like They're Possessed
10:14 16% Already Run Muse: What Companies Find
12:46 Intent-Based Access Management, Explained
15:15 Twenty Years of Failed Least Privilege
17:15 Why Your IGA Won't Scale to Agents
19:04 Where the Human Stays in the Loop
21:12 Who Should Own Agent Security
23:33 The Security Teams That Get This Right
26:35 Closing Thoughts

SOURCES AND FURTHER READING

Token Security: https://www.token.security/
Itamar Apelblat on LinkedIn: https://www.linkedin.com/in/itamar-apelblat/

📬 SUBSCRIBE TO RESILIENT CYBER
https://www.resilientcyber.io

If this was useful, subscribe. I cover AI security, agentic AI, AppSec, software supply chain, vulnerability management, and cyber policy for practitioners every week.

#AISecurity #AgenticAI #IdentitySecurity #NonHumanIdentities #IAM #AIAgents #LeastPrivilege #Cybersecurity