Three incidents, one clock
A large consultancy confirmed that an intruder took roughly 35 gigabytes from a private Azure DevOps repository in early July, and that the stolen material included source code, Azure personal access tokens, RSA encryption keys and SSH keys. The firm called the matter isolated and remediated. A threat actor claimed the theft and offered the data for sale. Whether any client environment could be reached with the stolen tokens has not been confirmed.
Separately, an Atlanta-based auto and renters insurer disclosed that attackers had copied records on 6.9 million customers: names, driver’s license numbers, Social Security numbers, policy details and claims information. According to the disclosure, the intrusion began with an attack on a single employee in March and was detected a day later. Attribution remains unconfirmed.
The third item is the one that changes the arithmetic. Researchers reported observing a ransomware operation using an AI agent to automate its attack chain, from initial compromise through to deployment. The reporting’s own conclusion is that automation at that level compresses the defender’s response window from days to hours, and that the people who hold credentials remain the most reliable way in.
A token or a key is a standing permission waiting for someone to use it. An employee’s login is a door one well-aimed approach can open. And whatever walks through may increasingly be software that does not pause or tire.
Standing access is the real exposure
Most enterprise access models were built around human intruders moving at human pace. A stolen credential was dangerous, but there was usually time for the intruder to look around, find the valuable data, stage it and move it. Detection within a day would once have counted as a good result.
At machine speed, a day is a long time. An agent working through a compromised account can enumerate everything that account can reach, find the largest tables and start reading far faster than a person could. Every permission the account holds but does not need is ground it can cover before anyone looks.
That moves the weight of defense from detection toward design. Two old principles do most of the work. Least privilege limits what a stolen credential can touch. Time-bound, just-in-time access limits how long it can touch it. What is new is that the gap they close is now measured in minutes.
Contractors, staff and agents: one rule
The instinct is to apply this discipline to outsiders first. Consultancies and contractors often hold tokens into client repositories and cloud storage, and those tokens have a habit of outliving the engagement that justified them. But the insurer’s breach reportedly began with its own employee, and the same logic applies inside the walls.
It also applies to a category many organizations have not yet put on the list: their own AI agents. An agent that reads from the warehouse, queries the CRM or writes to a ticketing queue holds credentials to do it. It is an identity like any other, and if it is compromised it is a very fast one. In a data estate, the practical controls look like this:
- One scoped service account per agent. Not a shared integration account, and never a person’s credentials. Each agent gets its own identity, with read access to the specific schemas and tables its task requires and nothing more.
- Expiring access for third parties by default. Contractor and consultancy access is granted for the engagement, with an end date set when it is created, and renewed deliberately rather than left running. Tokens issued for a project end with the project.
- Just-in-time elevation for staff. Administrative and bulk-export rights are requested for a task and withdrawn when it ends, not held permanently in case.
Watch the reads, not just the doors
Access design shrinks what a stolen credential can reach. Monitoring has to catch what is done with what remains. For a data estate, the signal that matters most is volume: a service account that normally reads a few thousand rows suddenly reading millions, a contractor identity pulling whole tables it has never touched, an agent exporting from a system of record in the middle of the night.
The records in the insurer’s disclosure (license numbers, Social Security numbers, claims details) are exactly what systems of record hold. Alerting on bulk reads from those systems, per identity and against that identity’s own baseline, is one of the few controls that still works when the intruder is holding legitimate credentials. It can also act at the attacker’s speed if the first response is automated: suspend the identity, then investigate.
In our work, the organizations best placed for this shift are the ones that already treat every agent, contractor and administrator as an identity with a scope and an end date. Against attackers that run on agents, that discipline is the margin.
