In this episode, I sit down with Itamar Apelblat, co-founder and CEO of Resilient Cyber partner, Token Security, to talk about identity as the control point for AI agents.
Itamar started his career 18 years ago in Unit 8200, where he met his co-founder and CTO Ido on their very first day, and spent more than a decade on the defensive side building security products for an organization heavily targeted by nation-state campaigns. He later built his own startup in the fintech space before teaming back up with Ido.
Token’s origin story is one most practitioners will recognize. Called back to reserve duty and stuck waiting hours on access approvals, Itamar remembered a service account his team had created about seven years earlier, tried the password he still remembered, and found himself an admin in one of the most secure networks in the world.
Nobody had changed it because nobody knew what would happen if they did, and that fear of taking action is exactly what Itamar sees playing out again with non-human identities and now AI agents.
We dig into his two dimensions of agent risk, autonomy and access, why agents will use any access path available to reach their goal, and what intent-based access management looks like when you scope permissions to an agent’s purpose and verify that purpose with its owner.
I also pushed him on an uncomfortable truth. We’ve had twenty plus years to get least privilege right for humans and another fifteen for cloud identities, and our track record isn’t great, so why would agents, which Itamar expects to outnumber us a hundred to one, go any better?
His answer is automation, with permissions restricted continuously and actions blocked or allowed inline, because manual approvals won’t scale and people will find workarounds like they always do.
We close on where security teams should start. Visibility matters, but the teams Itamar sees succeeding are the ones deploying agents themselves and seeing the pain firsthand, while the others get stuck over-engineering for hypotheticals.
I couldn’t agree more, since security has been a laggard with every technology wave, and you can’t secure something you don’t understand.
Prefer to listen?
We discuss:
Itamar’s path from the defensive side of Unit 8200 to a fintech startup, and the “which product do you hate the most?” question that pointed him and Ido toward identity
The forgotten service account from reserve duty that became Token’s origin story, and why teams are afraid to touch access nobody understands
Why Itamar sees identity as one of the core pillars of agent security, if not the most important, since what ultimately matters is what an agent actually does in the target applications
The two dimensions of agent risk, the level of autonomy you give an agent and the level of access it holds
Why agents pursue their goals “almost like they’re possessed,” and scoping permissions to an agent’s purpose from the moment it authenticates
What organizations find when they go looking, from ungoverned agents connecting straight into production with secrets and API keys to inactive agents still holding privileges and agents whose owners have left
A Token research finding that more than 16% of its enterprise customers already had a newly launched productivity agent running locally against mail and other resources
Intent-based access management, from defining an agent’s purpose and verifying it with the owner to analyzing the intent behind each individual action
Our track record with least privilege for humans and cloud identities, and why automated, continuous enforcement is the only way it scales to agents
Why IGA and PAM struggle when the IdP is the source of truth but agents live on local machines, in SaaS, and in the cloud
Where a human stays in the loop, including blocking a coding agent from a production Snowflake environment until someone approves the access
Who should own agent security, and why Itamar puts lifecycle management with the IAM team while AppSec, data security, and others share the responsibility
Why security teams that deploy agents themselves end up with a stronger strategy than those debating hypotheticals
Timestamps
0:00 Introduction
1:49 Unit 8200 and “Which Product Do You Hate the Most?”
3:58 The Seven-Year-Old Password That Still Worked
6:32 Autonomy and Access: The Two Dimensions of Agent Risk
8:19 Why Agents Act Like They’re Possessed
10:14 16% Already Run Muse: What Companies Find
12:46 Intent-Based Access Management, Explained
15:15 Twenty Years of Failed Least Privilege
17:15 Why Your IGA Won’t Scale to Agents
19:04 Where the Human Stays in the Loop
21:12 Who Should Own Agent Security
23:33 The Security Teams That Get This Right
26:35 Closing Thoughts
