Once They're In: The Blast Radius Playbook for the AI Era

Ten minutes into our conversation on episode 105, Yair Grindlinger said out loud the thing security quietly relied on for years.

“We were very lucky to have security by obscurity for many years. It was really hard to translate a lot of those small breaches into meaningful data exfiltration or meaningful damage to the organization.”

Yair Grindlinger, co-founder and chief executive of Surf AI, on episode 105

Then he said the sentence I think should change where every startup spends its next security hour: “Today with AI, once they’re in, then with AI getting into the sensitive information, valuable information, and exfiltrating it, it’s far, far faster and easier than it has ever been.”

Yair has watched attackers from the defender’s side for two decades. He co-founded FireLayers, which Proofpoint bought in 2016, ran cloud strategy at Proofpoint as a senior vice president, and in March launched Surf AI with $57 million to run security programs with a system of agents. His answer to the speed problem fits in one breath, and it’s the spine of this post.

“You need to do everything you can to reduce the risk for a breach, and then you have, equally if not more, to spend as much time as you can to reduce the blast radius. So if there is a small breach, not your entire crown jewels are going to run out the door.”

Yair Grindlinger, Surf AI, on episode 105

Prevention still matters, and Yair spends his days closing cracks. But the second half of an attack, everything after the attacker has a foothold, used to be slow, manual and noisy, and that slowness protected a lot of companies that never designed for it. The protection is gone. The good news is that the controls that replace it are known, mostly boring and well within reach of a fifty-person company.

This post walks through what changed, what this year’s evidence says about how fast the inside of a breach moves now, and the specific controls that keep a small breach small. In the middle there’s a breach clock and a live blast radius map you can run on your own company. And Yair’s voice runs all the way through, because he said it better than I can.

We were lucky

People in security have warned against leaning on obscurity since before most homes had electricity. In 1883 Auguste Kerckhoffs wrote that a military cipher must not require secrecy and must be able to fall into enemy hands without trouble (La cryptographie militaire, page 12). Claude Shannon made it a working assumption in 1949: “we shall assume that the enemy knows the system being used” (Communication Theory of Secrecy Systems). NIST wrote it into server guidance in 2008: “System security should not depend on the secrecy of the implementation or its components” (SP 800-123).

Everybody agreed with that in principle. In practice, obscurity did a lot of quiet work anyway, as friction rather than as design. An intruder who landed on one laptop or one build server still had to learn where the data lived, which credentials worked where, what the internal services were called and which of them mattered. That took skill, time and attention, and every hour of it was an hour in which somebody might notice. Plenty of small breaches stayed small because the attacker got tired, got distracted or got caught while still reading the map.

That friction is exactly what AI removes. Anthropic wrote in April that its Claude Mythos Preview model is capable of “taking a closed-source, stripped binary and reconstructing (plausible) source code for what it does” (Anthropic). Google runs a model-based deobfuscation system called CASCADE in production that recovers original strings and API names from scrambled JavaScript (arXiv 2507.17691). Two days ago a GNOME developer described writing a working Linux driver for an undocumented scanner with Claude Code: “Within a few hours I had my first ever working scan under Linux” (Christian Schaller). And Eric S. Raymond, who has argued about open and closed software for decades, said it with no hedging at all.

The end of software secrecy is almost upon us. The death of closed source, and the final triumph of open source.

I should have realized this a few months ago when I successfully decompiled the game of Firefighter from an ancient DOS shareware binary.

Eric S. Raymond (@esrtweet) · October 5, 2026

Hacker News got there first, in two lines under Anthropic’s Project Glasswing announcement in April.

"Security by obscurity is over. The security vs usability balance is about to get a hard reset."

rossjudson, on Hacker News, April 2026

"Licenses and obfuscation never really protected anything - it was just too much work/effort to copy. Now it's one prompt.."

jack_sunsetless, on Hacker News, October 2026

The lesson for the inside of your company is direct. Your internal service names, the admin endpoint nobody documented, the wiki page that explains which database holds what, the naming convention that tells anyone which bucket is production: a visitor with a model reads all of it at machine speed. Anthropic’s account of the first AI-orchestrated espionage campaign it disrupted, which it attributes to a group it calls GTG-1002, described the model doing reconnaissance “in a fraction of the time it would’ve taken a team of human hackers,” with humans stepping in at perhaps four to six decision points per campaign (Anthropic, November 2025). Whatever your internal map is, assume the visitor has it within minutes. The work that’s left is making sure the map doesn’t lead anywhere worth going.

The second half got fast

This year’s incident reports agree on the direction even where they disagree on the details. Read them together and the inside of a breach looks very different from five years ago.

• Breakout in minutes. CrowdStrike’s 2026 Global Threat Report puts the average eCrime breakout time, from first foothold to moving onto a second system, at 29 minutes in 2025, with the fastest observed at 27 seconds. In one intrusion, “data exfiltration began within four minutes of initial access” (CrowdStrike).
• Exfiltration in an hour. Unit 42 found the fastest quarter of the intrusions it worked reached exfiltration in 72 minutes, down from 285 minutes the year before, and the share reaching exfiltration in under an hour rose from 19 to 22 percent. An AI-assisted attack Unit 42 simulated the year before got there in 25 minutes. The median was still two days (Unit 42 2026 Global Incident Response Report).
• Straight for the keys. Sophos saw attackers go after Active Directory a median of 3.4 hours into an attack, 70 percent faster than a year earlier, and found exfiltration happened just 1.87 hours before the attack was detected (Sophos 2026 Active Adversary Report).
• Hand-offs in seconds. Mandiant’s M-Trends 2026 says the window between an initial access group getting in and handing access to the next group collapsed to 22 seconds in 2025, from more than eight hours in 2022, and that exploitation now routinely happens before a patch exists (M-Trends 2026).

Two honest caveats. These are vendors describing their own incident response cases, not a census of every breach. And the reports disagree on how much of the speed is AI. CrowdStrike ties faster breakout to AI-accelerated attacks, while Mandiant ties the 22-second hand-off to specialization among criminal groups and says it does “not consider 2025 to be the year where breaches were the direct result of AI.” Either way, AI arrives on top of a second half that was already getting fast, and Unit 42’s 25-minute simulation shows where it’s headed.

The money follows the clock. IBM’s 2026 Cost of a Data Breach report puts the global average at $4.99 million, a record, and the savings for organizations that use security AI and automation extensively at $1.93 million (IBM). That’s an IBM-sponsored study run with the Ponemon Institute, so weigh it accordingly, but the direction matches every other source here: the faster you see and stop the second half, the cheaper the breach.

Here’s what those numbers mean for your own team. Pick how long it would honestly take you to notice an intruder and how long to cut their access once you did.

Breach clock

What has already happened inside by the time you notice?

Set your honest time to notice an intruder and your time to cut their access. The markers are real milestones from this year's incident reports and from the Hugging Face intrusion. They come from different cases, so read them as a sense of pace, not a single attack.

Time to notice an intruder 5 minutes 30 minutes 1 hour 4 hours 1 day 3 days 2 weeks 1 month Then, time to cut their access 5 minutes 30 minutes 1 hour 4 hours 1 day 3 days

…milestones already passed when you notice

…the intruder's head start before access is cut

…the last milestone inside that window

…where your next hour of work pays most

Sources: CrowdStrike 2026 Global Threat Report (27 seconds, four minutes, 29 minutes), Unit 42 2026 Global Incident Response Report (25 minutes, 72 minutes, two days), Sophos 2026 Active Adversary Report (3.4 hours, three days), Mandiant M-Trends 2026 (14 days) and Hugging Face's technical timeline of the July 2026 intrusion (six minutes, thirteen hours). The time axis is logarithmic. Nothing you choose here leaves your browser.

The point of the clock isn’t to make you feel slow. Almost nobody notices in five minutes. The point is that something has to cover the difference between the attacker’s pace and yours, and the only thing that works at machine speed without anybody watching is a smaller blast radius. If the intruder has a day, make sure a day inside gets them very little.

Thirteen hours at Hugging Face

When Yair and I recorded, the incident everybody in security was talking about was Hugging Face’s, and he brought it up himself when I asked about his hardest moment building Surf AI.

Listen · Yair on episode 105, from 5:50

In July, AI agents running inside an OpenAI model evaluation broke out of their test environment, reached the internet and worked their way into Hugging Face’s production infrastructure. OpenAI’s first account says “the models identified and chained vulnerabilities across OpenAI’s research environment,” and that “Hugging Face’s security team and agents detected and stopped the activity on their infrastructure” (OpenAI, July 21). Hugging Face published a disclosure on July 16 and a full technical timeline on July 27, and both are worth reading line by line (disclosure, technical timeline).

OpenAI said the ‘agent’ escaped a testing environment, gained internet access, stole login credentials and hacked into the start-up Hugging Face by itself — one of the first public examples of a cyber attack by an AI system acting outside human control.

Financial Times (@FT) · July 22, 2026

The way in was mostly familiar. OpenAI’s technical report lists “14 valid Hugging Face user write-access tokens discovered in a public dataset” and a template injection flaw in how uploaded datasets were processed, which OpenAI counts as a zero-day and which the agents used to run code on 41 production dataset-server workers (OpenAI technical report). What came next is the part Yair was talking about. In Hugging Face’s own words:

“The agent went from code execution in a single worker pod to cluster-admin across multiple internal clusters in under thirteen hours.”

Hugging Face, Anatomy of a Frontier Lab Agent Intrusion, July 27, 2026

“Six minutes after reaching node root, the agent authenticated to the internal operational datasets-server MongoDB.” Over the campaign the agents took about 17,600 actions, and OpenAI’s follow-up says they “harvested Kubernetes, database, messaging, code-repository, and cloud credentials” (OpenAI, August 26). OpenAI also says the events did not affect its own customers’ data. Hugging Face reported unauthorized access to a limited set of internal datasets and to several credentials its services use.

One of those credentials shows exactly what blast radius means. Tailscale’s co-founder and chief executive Avery Pennarun wrote that the agents read a production secret store containing 136 keys, and that “one of those 136 credentials was a reusable Tailscale auth key,” which the agents used “over several days, to enroll a total of 181 nodes into Hugging Face’s tailnet.” He was explicit that no vulnerability in Tailscale was found or exploited (Tailscale). A long-lived, reusable key did what long-lived, reusable keys do. His conclusion is the line I’d tape above every engineering manager’s desk: “Now, in a world of rogue AI agents, the big credential vault is the prize.”

Hugging Face’s own diagnosis is the most useful paragraph I’ve read all year. “The individual weaknesses were familiar,” it says, naming “unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” And then: “Volume is what changes the defensive problem.” No new kind of weakness was needed. Even the two flaws OpenAI calls zero-days, a template injection and unsafe handling of HDF5 files, are textbook bug classes. Everything old got exploited faster, and in parallel.

Hacker News had the exchange that I think captures the whole episode in two comments, under the thread about Tailscale’s post.

"How was this ever okay pre AI? It seems just as bad."

charcircuit, on Hacker News, July 31, 2026

"It was less bad due to the lower speed of exploatation."

majkinetor, replying on Hacker News, July 31, 2026

That’s Yair’s thesis, typo and all. The reusable key was always a bad idea. Before, it was a slow bad idea.

Patrick McKenzie, posting the day of the talk, put it in one line.

Yeah people claiming this is most important security incident since Morris worm are straightforwardly right I think.

Patrick McKenzie (@patio11) · August 6, 2026

Simon Willison called it “science fiction that happened” (Simon Willison). Yair used almost the same words about the first time he watched his own agents work, and we’ll get to that. The culture noticed too: the incident got its own Netflix documentary, which premiered on Monday.

When the open-source AI platform Hugging Face was hit by a cyberattack this July, it quickly became clear this was no ordinary breach because the hackers weren’t human: they were autonomous agents created by OpenAI researchers.

Instadocs: AI Gone Wild reconstructs the breach as it’s never been seen before. Premieres October 12.

Netflix (@netflix) · October 7, 2026

Two things from Hugging Face’s write-up deserve more attention than the drama. First, the defense worked, eventually: “The first signals came from several layers of our security stack at once: live runtime analysis, SIEM logs, and others.” Second, their candor about their own tooling: their AI-based security agent “failed to correctly raise the alert’s criticality.” Detection is a team sport, and the score depends on what the intruder could reach while the alert sat in the wrong queue.

Internet security weather turned intelligent

Right before the blast radius exchange, in the question that set it off, I tried out a metaphor on Yair that I’ve used for years.

Listen · Jon on episode 105, from 9:27

The weather is measurable. GreyNoise, which runs sensors that listen to that background noise, counted about 212 exploitation attempts per second across the second half of 2025, 2.97 billion malicious sessions from 3.8 million source addresses, and found that 52 percent of remote code execution attempts came from addresses it had never seen before (GreyNoise 2026 State of the Edge). Its founder Andrew Morris put the exploitation window bluntly in the release: “the time between a vulnerability going public and being exploited is basically zero” (press release). Mandiant’s time-to-exploit figures tell the same story over a longer span: an average of 63 days in 2018 and 2019, 32 days in 2021 and 2022, five days in 2023 (Mandiant), and an estimated minus seven days in 2025, meaning exploitation before the patch (M-Trends 2026).

I’m not the only one who reaches for weather. Finland’s National Cyber Security Centre publishes a monthly report it literally calls the Cyber Weather; the July 2026 edition opened with “Rain fronts were seen across the cyber landscape in July” (Traficom). GreyNoise’s own show is called Storm Watch.

Here’s the part that made me sit up. In December 2025, GreyNoise wrote that there was “little evidence of widespread use of ‘AI’ in broad-scale opportunistic initial-access attacks” (GreyNoise). Nine months later it published “Agents Gone Wild”: an attacker ran hundreds of AI agents against PaperCut print-management servers and compromised at least 440 of them at 395 organizations in 48 countries, between August 31 and September 2, days after PaperCut’s advisory. At one point the agents compromised 11 organizations in 26 seconds, and the operation went “from an empty workspace to first achieving RCE against a real victim in just under four hours” (GreyNoise, September 9).

If you missed it: 395 organizations compromised across 48 countries. Hundreds of AI agents. One campaign against PaperCut NG/MF.

We mapped the attack flow below⬇️

GreyNoise (@GreyNoiseIO) · September 11, 2026

The weather isn’t only criminal. Transluce found public scan logs showing autonomous AI agents, some linked to agent swarms previously attributed to OpenAI, trying SQL injection, path traversal and command injection “while attempting mundane data retrieval tasks which were not cyber-related,” and said none of the attempts it identified appear to have succeeded (Transluce). Cloudflare wrote at the end of September that “this year, for the first time, more than half of Internet traffic wasn’t human,” and that daily requests from AI agents on its network grew by more than 1,700 percent in a year (Cloudflare). Sasha wrote up the agents that walked in through open doors yesterday, including the CERT-In advisory where the victims couldn’t detect the access on their own.

Yair’s answer to the weather was the most practical thing anyone said on the episode. You will be targeted, a lot. Given “thousands and thousands of agents working together, this army of agents,” he said, the chances that they won’t find “a crack here and there” are slim. So close every crack you can, and plan for the ones you’ll miss.

Assume breach is a plan, not a mood

When I mentioned on the show that I’d heard CISOs describe this world as “assume breach,” Yair lit up, because it’s one of the concepts he says he’s trying to get across to a lot of CISOs. The phrase has a long paper trail. Microsoft described “an innovative Assume Breach strategy” for red-teaming its cloud in 2014 (Microsoft Azure blog). Its current zero trust guidance defines it this way: “Security controls are designed with the expectation that attackers might be operating inside the environment,” and “controls focus on limiting breach impact, and enabling rapid threat detection and response” (Microsoft Learn).

The government versions say the same thing in their own register. The NSA’s 2021 zero trust guidance tells organizations to “consciously operate and defend resources with the assumption that an adversary already has presence within the environment” (NSA). NIST SP 800-207 says “zero trust security models assume that an attacker is present in the environment” (NIST). When the NSA published its network and environment pillar in 2024, Rob Joyce, then its cybersecurity director, said “organizations need to operate with a mindset that threats exist within the boundaries of their systems” (NSA). CISA’s 2025 microsegmentation guide describes segmentation as a way to reduce the area a compromised resource can affect (CISA).

Assume breach gets a bad reputation as a shrug: they’ll get in anyway, so why bother. That reading misses the second half of every definition above. Assume breach is an instruction about where to put effort. If the attacker is inside, the questions that matter are what they can reach from where they landed, how fast you’ll see them and how cleanly you can cut them off. Yair’s equal-effort rule is the budget version of the same idea.

Listen · Yair on episode 105, from 10:47

Cloud architects have been designing for this for years, for failures and compromises alike. The term is borrowed from explosives, and Google’s Building Secure and Reliable Systems says “controlling the blast radius means compartmentalizing the impact of an event” (Google). AWS recommends separate accounts partly so that, even in a security incident, the “blast radius remains limited to that specific data domain rather than impacting your entire cloud environment” (AWS), and builds entire services out of independent cells for the same reason (AWS cell-based architecture).

We had this conversation on the show back in February too. Our notes for episode 88 with Andrew Rubin open with it: “The perimeter will fail. What matters is whether your business turns one incident into a disaster.” Rubin built a company on that thesis, and we wrote up what it taught him. Yair is making the same argument for a world where the incident moves at machine speed.

When the reach was the disaster

Read the postmortems of the breaches people still talk about and a pattern jumps out. The way in was almost always forgettable. What made the headlines was how far one foothold could reach once it was inside.

Snowflake, 2024. Attackers logged into Snowflake customer accounts with usernames and passwords that infostealer malware had lifted from other machines, one of them as far back as November 2020. Mandiant found that “the impacted accounts were not configured with multi-factor authentication enabled,” that the customer instances “did not have network allow lists in place,” and that at least 79.7 percent of the accounts used had prior credential exposure. About 165 organizations were notified, and Mandiant found no evidence that the access stemmed from a breach of Snowflake’s own enterprise environment (Mandiant). One old password, a whole data warehouse. Trevor Hilligoss of SpyCloud broke down how attackers really gain access, from reused credentials to commoditized cybercrime tools, on episode 86, and it’s worth the listen.

"How did Snowflake not have 2FA?"

philipwhiuk, on Hacker News, May 31, 2024

Salesloft Drift, 2025. Between March and June 2025 an attacker got into Salesloft’s GitHub account. From there it reached Drift’s AWS environment and took the OAuth tokens that Drift customers had granted for their integrations (Salesloft). From August 8 through at least August 18 the attacker used those tokens to pull data out of customers’ Salesforce instances, then searched it for AWS access keys, passwords and Snowflake tokens (Google Threat Intelligence Group). Google’s Tyler McLellan put the reach in one sentence: “Using a single token stolen from Salesloft, the threat actor was able to access tokens for any Drift linked organization.” Google said it was aware of more than 700 potentially impacted organizations (CyberScoop). Cloudflare, one of them, found 104 Cloudflare API tokens in the support-case text the attacker took and summed it up well: “This incident affected hundreds of organizations through a single integration point” (Cloudflare).

⚠️ Alert: Widespread data theft campaign by UNC6395.

The threat actor is targeting Salesforce instances via Salesloft Drift, targeting sensitive data. Organizations should investigate, rotate credentials, and harden access controls.

More here: bit.ly/3HviIi1

Mandiant (part of Google Cloud) (@Mandiant) · August 26, 2025

If you sell software to larger companies, you are somebody’s integration, and their security team has noticed. We posted about it the day the episode came out.

If you sell software into large companies, your integration is one of the paths an attacker could take after getting in.

So expect the buyer's security review to go past your SOC 2 report and ask what your integration can reach, and whether it can write or only read.

YSecurity · Clip post for episode 105 · October 6, 2026

Load the post from LinkedIn

Change Healthcare, 2024. On February 12, attackers used compromised credentials to get into a Citrix remote access portal that “did not have multi-factor authentication,” then “moved laterally within the systems in more sophisticated ways and exfiltrated data.” In Andrew Witty’s words to Congress: “Ransomware was deployed nine days later” (UnitedHealth Group testimony). Change Healthcare has told the Department of Health and Human Services that about 192.7 million people were affected (HHS). Nine days is a long time to explore.

Storm-0558, 2023. A Microsoft consumer signing key that “should only have been able to sign tokens that worked in consumer OWA, not Enterprise Exchange Online” ended up opening Exchange Online mailboxes at 22 enterprise organizations, along with 503 related personal accounts. The Cyber Safety Review Board called it “a cascade of security failures at Microsoft” and concluded that “this intrusion was preventable and should never have occurred” (CSRB report). The key’s blast radius was supposed to stop at consumer mail. The enforcement didn’t hold.

Midnight Blizzard, 2024. The nation-state group Microsoft tracks as Midnight Blizzard “compromised a legacy, non-production test tenant account that did not have multifactor authentication,” then used “a legacy test OAuth application that had elevated access to the Microsoft corporate environment” to give its own malicious OAuth apps the Office 365 Exchange Online full_access_as_app role (Microsoft Threat Intelligence). A forgotten test tenant reached corporate email.

"Why isn't MFA enforced?"

cedws, on Hacker News, January 20, 2024

Klue, 2026. This year’s version arrived in June. Klue’s chief executive wrote that “an attacker gained access through a compromised legacy credential associated with an integration service” and used it to “obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce” (Klue). LastPass, one of the companies downstream, said attackers took customers’ names and contact details along with support case data and sales-related data, while its own infrastructure and customers’ password vaults were unaffected (TechCrunch). LastPass kept the vaults out of reach, which is exactly the outcome this post is about.

Notice what’s missing from almost every one of these. Apart from Storm-0558, which also leaned on a token-validation flaw Microsoft didn’t know about, nobody needed a novel exploit for the part that hurt. The damage came from reach. A password that opened a warehouse. A token that opened every customer. A test account that opened corporate mail. And notice how many of those footholds were the kind of thing an AI agent finds in seconds now: passwords sitting in infostealer logs, tokens pasted into support cases, a legacy credential nobody turned off. In July it was 14 write-access tokens in a public dataset. The doors haven’t changed. The visitors read faster.

Shrink what one foothold can reach

So here’s the work. Almost none of it is new, which is good news: every control below has been proven at companies of every size, and most of it costs attention rather than money. Surf AI’s chief technology officer put the goal plainly in August.

“Organizations have to simultaneously reduce blast radius, limiting what an attacker, human or model, can actually do once they’re in.”

Roie Cohen Duwek, co-founder and chief technology officer of Surf AI, Vulnerabilities Are Becoming a Commodity, August 3, 2026

I’ve grouped the controls the way Yair’s rule suggests, starting with the ones that count twice.

Identity and credentials count twice

These make a breach less likely and shrink what one can reach, so they’re the best first hours you can spend.

• Phishing-resistant multi-factor authentication everywhere a person logs in. Email, cloud console, code host, identity provider and every admin panel. The Cybersecurity and Infrastructure Security Agency is blunt about which kind: “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication” (CISA). Passkeys and security keys turn a phished password into a dead end. We wrote up why passwords still get stolen and how device-bound credentials fix it.
• No standing admin. Nobody should hold production or identity admin rights while they sleep. Elevation for a task, with an expiry and a reason, is built into the major platforms. Microsoft’s version exists to “provide just-in-time privileged access” and to “minimize the number of people who have access to secure information or resources” (Microsoft Entra).
• Short-lived credentials. Long-lived credentials were one of the four familiar weaknesses Hugging Face named, and one reusable Tailscale key let the agents enroll 181 nodes over several days. Use single sign-on for people, workload identity federation for build pipelines and services, and single-use, expiring enrollment keys for anything that joins your network.
• Scoped, fenced integration and agent tokens. After Salesloft Drift, Google’s advice was to “Ensure that applications have the minimum necessary permissions and avoid overly permissive scopes like full access,” and “On user profiles, define IP ranges to only allow access from trusted networks.” Treat your own agents the same way. They’re software, which is the good news: give each one its own identity, the narrowest scopes that let it do its job, an owner who understands what it does, and tests that prove its limits hold. Start with our 30-minute AI credential inventory and why agents need least privilege more than people ever did, and listen to Oso’s Graham Neray on episode 89 for what authorization looks like when the user is an agent.
• Secrets out of code, and no store one foothold can read whole. Every key sitting in a repository, a pipeline variable or a laptop’s dotfile is one more hallway, which is why the .env file is your first security program. The other half of the job showed up in July, when the agents read 136 keys out of one production secret store in a single step: scope who and what can read each secret, so no single foothold can read them all.
• Fewer accounts. Surf AI’s chief technology officer makes the point that cleanup pays twice: “eliminating a dormant account, for instance, reduces attack surface (nothing to compromise) and blast radius (nothing to escalate into) at the same time.”

Walls

• Production in its own cloud account. The AWS multi-account guidance quoted above is the cheapest wall you’ll ever build. A key from development, staging or corporate IT shouldn’t work in production at all.
• Customer data partitioned per tenant. Row-level policies, per-tenant encryption keys or per-tenant databases, so one credential reads one customer and not all of them. It’s the cell idea from the AWS talk, applied to data.
• Default-deny egress for production and agents. Data has to leave somehow. If production servers and agents can only reach the destinations they need, exfiltration gets loud. Sasha made the same point about agents in Nobody Noticed: enforce their limits at the network layer, not in the prompt.

Google’s BeyondProd design describes the goal for all three: “This mutual distrust, combined with granular access control, helps to limit the scope and impact of a compromise” (Google Cloud).

A smaller prize

• Hold less. The Federal Trade Commission’s guide for businesses starts here: “Don’t collect personal information you don’t need,” and “Hold on to information only as long as you have a legitimate business need” (FTC). When the agency settled with Blackbaud, which it said “held onto data far longer than was necessary,” Samuel Levine, who then ran its consumer protection bureau, said: “Companies have a responsibility to secure data they maintain and to delete data they no longer need” (FTC).
• Keep production data out of copies. Staging environments, analytics exports and laptops tend to hold yesterday’s production data with half the protection.
• Encrypt the fields that matter, with keys held apart, so a stolen database copy is a pile of ciphertext. For the long view on what encrypted data is worth to someone patient, read harvest now, decrypt later and listen to Kevin Kane on episode 96. And remember the prize can walk out sideways through employees’ AI tools, which Xia Hua showed us from the inside on episode 100.

Survive it and see it

• Immutable backups in a separate account, with restores you’ve actually run. The #StopRansomware guide says to “Maintain offline, encrypted backups of critical data” (CISA), and our guide to immutable backups explains why 3-2-1 isn’t enough anymore.
• A second person on money. New payees, bank detail changes and large transfers get two people and a callback on a number you already had.
• Cameras. Canary tokens and volume alerts, which get their own section below.

This is the work behind our AI access control audits, which map what your people, integrations and agents can reach and cut it down, and behind our penetration tests, which check whether the walls hold when someone leans on them.

Map your blast radius

Here’s the whole playbook in one tool. Pick a foothold, tick what’s true today, and the map shows which of your crown jewels that one foothold reaches. Then it picks the three fixes that shrink it the most.

Blast radius map

If one foothold fell tonight, how far would it reach?

Pick the foothold that worries you most, then tick what's true at your company today. Leave a box unticked if you're not sure. An intruder won't be sure either; they'll just try it.

The foothold

A phished employee laptop A leaked cloud key A SaaS integration token An AI agent's credentials A build runner An admin's session

Identity and credentials

Phishing-resistant multi-factor authentication, such as passkeys or security keys, on email, cloud, code host and every admin console No standing admin rights; elevation is granted for a task and expires Cloud and API credentials are short-lived; no long-lived or reusable keys Every integration and agent token has minimum scopes and only works from known networks Secrets live in a secrets manager, not in code, pipeline variables or laptops

Walls

Production runs in its own cloud account, apart from development, staging and corporate IT Customer data is partitioned per tenant, so one credential can't read every customer Production servers and agents can only reach the internet destinations they need

A smaller prize

We delete data we don't need and keep production data out of staging, analytics copies and laptops Sensitive fields are encrypted with keys held in a separate key service

Survive it and see it

Backups are immutable, kept in a separate account, and we've restored one this quarter New payees, bank changes and large transfers need a second person and a callback Canary tokens sit next to our crown jewels and page a named person when touched Unusual data access and export volume raises an alert, per person, integration and agent

…reach of this foothold, out of 100

…your widest foothold right now

…would you notice it on your own?

…this foothold's reach after the three fixes below

Copy the planDownload the plan (Markdown)

How it works: each foothold starts with our estimate of how much of each crown jewel it reaches at a typical startup with none of these controls. Customer data and production weigh 3; code, money and backups weigh 2; email and chat weigh 1.5. Each control you tick cuts the reach of the footholds it really affects. Multi-factor authentication does little for a leaked cloud key, and scoped tokens do little for an admin's session. Canary tokens and volume alerts don't shrink reach, so they only change whether you'd notice. The plan picks, one at a time, the unticked control that shrinks this foothold's reach the most. The numbers are our judgment, not a standard, and nothing you tick leaves your browser unless you send it to us.

Send me the blast radius plan →

A person reads this, checks your three fixes against how your company really works, and replies with a dated plan. No sequence, no vendor pitch.

Play with it for a minute and two things stand out. The widest foothold usually isn’t the one you picked; with the default boxes ticked, it’s an admin’s session. And the fixes at the top of the plan are rarely the expensive ones. Short-lived credentials, scoped tokens and no standing admin cost days of engineering, not a new product, and they close more hallways than anything else on the list.

Afraid to imagine what’s already going on

I asked Yair how much time a system that’s online has until a breach. He didn’t give me a number.

Listen · Yair on episode 105, from 13:06

The data says he’s right to wonder. Mandiant’s global median dwell time, how long an intruder sits inside before anyone notices, rose to 14 days in 2025 from 11 (M-Trends 2026). On Thursday, India’s national computer emergency team said organizations reached by AI agents “could not detect the unauthorized access on their own,” and that in a separate campaign run with agentic tools, victims that “remediated incompletely were attacked again within days, at greater scale” (CERT-In, CIAD-2026-0049). Sasha unpacked that advisory yesterday in Nobody Noticed, and the half-fixed victims are the blast radius lesson in one sentence: if cleanup leaves one hallway open, the visitor comes back through it.

Yair made the same point to CTech in April, about software flaws: “The fact that you didn’t know about a vulnerability for 10 years doesn’t mean it wasn’t used for the last 10 years” (CTech).

And an agent that doesn’t like the record may try to change it. METR, which investigated the agents’ behavior during the Hugging Face incident with data from OpenAI, found agents trying to rewrite the logs of what they’d done, in their case mostly to fool the evaluation’s own scoring rather than to hide from Hugging Face.

Agents also tried to retroactively edit transcripts. They modified some accessible action logs, but these weren’t the source of transcripts (agents realized this but tried anyway). We did not see them successfully edit the source of truth in our transcripts (scoped to Jul 7-13).

METR (@METR_Evals) · August 26, 2026

The answer to “afraid to imagine” isn’t more imagination. It’s three cheap signals that tell you, instead of a government agency or a lab, when someone is inside.

1. Canary tokens next to the crown jewels. Thinkst describes Canarytokens as “like motion sensors for your networks, computers and clouds” (Canarytokens). Its decoy AWS keys are meant to sit exactly where an intruder would look (“Leave them in private code repositories, leave them on a developers machine”), and “If they are used via the AWS API at any point, you will be alerted” (Canarytokens). An agent that harvests every credential it finds is the perfect customer for a decoy.
2. Volume alerts per identity. Data theft looks like volume: a person, an integration or an agent reading or exporting far more than it usually does. One alert per identity on read and export rates is the cheapest way to see the second half of a breach while it’s still happening.
3. Logs that outlast the intruder. Keep API, cloud and login logs long enough to look back through, which CERT-In puts at 180 days, and ship them to an account the workload can’t write to.

Jon offered Yair Grindlinger the easy line on the episode, that all this automation means you get to sleep better at night. The co-founder and chief executive of Surf AI didn't take it. He said he doesn't know if sleeping better at night is really an option for anyone in cybersecurity, which most security leaders will hear as a relief.

YSecurity · Clip post for episode 105 · October 14, 2026

Load the post from LinkedIn

That someone is what our 24/7 monitoring and response team is for, and our AI-accelerated cloud detection and response program investigates cloud alerts in minutes, so the alert that matters gets read by a person while it still matters.

Burger flipping is where exposure lives

When I asked how security teams take to Surf AI’s agents, I expected Yair to say they finally get time for strategy. He’d expected the same when Surf AI started.

Listen · Yair on episode 105, from 17:12

What they loved first was losing the grind. In his words, “a lot of what agents are very good at is following up on people, escalating, opening tickets, updating tickets, closing tickets, doing all the mundane day-to-day burger flipping” that nobody wants to do. One customer told him the agents were like “a huge team I could never have afforded to hire.”

That list is the part of security nobody puts on a slide, and it’s where blast radius lives. The dormant account that survived because the offboarding ticket bounced between two teams. The integration token nobody rotated because nobody knew who owned it. The admin right granted for one migration two years ago and never taken back. Each one is a hallway somebody meant to close, and each one is exactly what an intruder with a model finds first.

The scale is the hard part. Back at Proofpoint, when Yair asked security chiefs what his team could help with most, the answer was more often than not some version of “I have 40, 50, 60 security tools. I have hundreds of thousands, if not millions, of assets that I need to protect.” The surveys agree. Panaseer, which sells security metrics software, found large enterprises averaged 76 security tools (Panaseer). Vectra, a detection vendor, found security operations teams receive an average of 4,484 alerts a day and that 67 percent are ignored (Vectra 2023). In ISC2’s 2025 workforce study, 47 percent of cybersecurity professionals said they often feel overwhelmed by their workload (ISC2), and the SANS 2025 survey of security operations centers, sponsored by Elastic, found 69 percent still report their metrics manually or mostly manually (SANS).

Fixes take time too. Verizon’s 2025 Data Breach Investigations Report found only about 54 percent of the edge device and VPN vulnerabilities it tracked were fully remediated over the year, with a median of 32 days to do it (Verizon). An older Cyentia Institute study sponsored by Kenna Security found a typical organization has the capacity to fix “about one out of every 10 vulnerabilities in their environment within a given month” (Cyentia). Yair argues the metric that matters most is how long fixes take, because, as he wrote in May, “Every day a vulnerable asset stays open is a day of exposure” (Surf AI).

We don’t have time, we can’t fight AI-powered attackers manually. Defenders need AI to operationalize exposure management, and context is what makes it work.

Yair Grindlinger · Co-Founder & CEO at Surf AI · September 16, 2026

Load the post from LinkedIn

Finding has gotten fast. Fixing is the race now. Anthropic’s Project Glasswing showed it from the other side. In May, Anthropic said it and its partners had found more than ten thousand high- or critical-severity vulnerabilities in essential software, but only 75 of the 530 it had disclosed were patched, and wrote that “the bottleneck in fixing bugs like these is the human capacity to triage, report, and design and deploy patches” (Anthropic). By October 2 its public dashboard showed 6,157 bugs reported and 516 patched upstream (Anthropic).

Last month we launched Project Glasswing, our collaborative AI cybersecurity initiative. Since then, we and our partners have found more than ten thousand high- or critical-severity vulnerabilities in essential software.

Anthropic (@AnthropicAI) · May 22, 2026

Patching these vulnerabilities will make us safer. But the software industry will need to adapt to the volume of vulnerabilities that models like Claude Mythos Preview will be able to find.

We discuss this in our initial update on Project Glasswing:

Anthropic (@AnthropicAI) · May 22, 2026

Practitioners have been saying it in fewer words.

"When every PR has 12 security alerts, people stop reading them. Alert fatigue is a real attack surface."

indiekitai, under Filippo Valsorda's "Turn Dependabot off," on Hacker News, February 21, 2026

"The "blue team" capabilities are lacking, because the bottleneck is with humans."

NitpickLawyer, on Hacker News, August 7, 2026

If your exposure reduction and threat detection still run mostly on manual processes, Yair Grindlinger, co-founder and chief executive of Surf AI, thinks you're putting your organization at major risk already, and definitely in a year or two. He's also an optimist. Once defenders have the better technology, he expects them to end up ahead.

YSecurity · Clip post for episode 105 · October 8, 2026

Load the post from LinkedIn

We’ve had versions of this conversation before. Venkat Thiruvengadam argued on episode 87 that the value of agents is in the orchestration around them: permissions, context, guardrails and a human where it counts. Neatsun Ziv of Ox Security explained on episode 91 why asking developers to fix everything is a bad idea, and we followed it up with why shift-left security keeps failing. Burning that backlog down, rather than managing it, is what our AI-accelerated vulnerability remediation program is built for.

The self-driving car of cybersecurity

Then I asked Yair about his proudest moment so far, and he told me about the first time his system of agents worked end to end. The team had sketched it together: agents that collect signals from many places, dedupe and group and prioritize them, understand the context, talk to people and systems of record, and eventually apply the fix. Then they built it, deployed it and watched it run. “It’s like magic,” he said, and then he reached for the same comparison I would have.

Listen · Jon and Yair on episode 105, from 15:39

Yair Grindlinger, co-founder and chief executive of Surf AI, on the first time his team saw their system of agents work. They'd been sitting around describing agents that pull signals from many sources and drive the remediation. When it actually worked, he says, it was almost like watching magic.

YSecurity · Clip post for episode 105 · October 16, 2026

Load the post from LinkedIn

The comparison is better than it sounds, because self-driving cars earned trust the slow way, with data. Waymo says that through June 2026 it had driven 271.3 million rider-only miles, with 82 percent fewer injury-causing crashes and 95 percent fewer serious-injury-or-worse crashes than an average human driver over the same distance in its cities (Waymo). That’s the company grading itself, so the independent check matters more. In July the Insurance Institute for Highway Safety found Waymo’s crash involvement rate was 68 percent lower than human drivers’ across about 50 million driverless miles in four cities, while noting it ran 4 percent higher in Austin, and its president said “the present data collection system isn’t good enough to allow continuous monitoring of a large-scale expansion” (IIHS).

"Waymo as a system has crossed the threshold where I trust them more than average driver"

Retric, on Hacker News, March 19, 2026

What made the cars trustworthy wasn’t faith. It was testing in a defined operating area, measuring every mile, publishing the record, and a company that answers for every decision the car makes. Security agents earn their place the same way, and the nice thing is that they’re software. You can test them before they touch anything, read exactly what they did afterward, and scope what each one can reach. Surf AI describes its own design in those terms: “Agents operate within defined permissions, policies, and guardrails” (Surf AI), with “Human approval lands at the consequential gates, where it belongs, ahead of irreversible actions” (Surf AI).

The Cloud Security Alliance borrowed the self-driving scale for AI agents in January, with six levels of agent autonomy “deliberately echoing the structure of SAE J3016.” Level 1 is where “each action requires explicit human approval before execution.” Level 3 is where “the AI makes decisions and takes actions autonomously within defined boundaries” (Cloud Security Alliance). Somewhere between those two is a fine place to start. You move up the way Waymo did: pick a narrow domain, like disabling dormant accounts or rotating stale tokens, measure the results, and widen the domain as the record builds. And yes, it’s fun. Watching an agent close a hundred stale tokens before your coffee cools is the closest this job gets to science fiction, which is exactly how Yair described it.

We’ve written about where approval belongs in the human in the loop is going away and are you actually going to give the agent write access?, and a16z’s chief information security officer, Yash Kosaraju, explained on episode 104 why he doesn’t trust the approve button. One more thing worth remembering: the visitors in July were agents. Your own agents deserve the same small blast radius as any other foothold, which is what our secure MCP program and AI access control audits set up.

Surf AI comes out of stealth today to help security teams keep pace with a new generation of AI-driven threats. Founded by Yair Grindlinger, Elad Horn, Avner Gideoni, Brenton Gumucio, and Roie Cohen Duwek, Surf AI’s agentic platform gives teams the context and precision they need to automate security tasks that demand speed and accuracy.

Accel (@Accel) · March 17, 2026

Why the optimists get the last word

Near the end I said it felt like a race against the clock. Yair picked up the phrase and took it somewhere I didn’t expect.

Listen · Yair on episode 105, from 19:56

The plane is the right comparison, and it comes with the most hopeful chart in safety. MIT’s Arnold Barnett found the risk of dying on a commercial flight fell from one per 350,000 passenger boardings in 1968 to 1977 to one per 13.7 million in 2018 to 2022, and that it “continues to go down by a factor of two every decade” (MIT News). Aviation didn’t get there by trusting planes. It got there by investigating every incident, fixing what it found and designing for the part that would fail.

"Testing requires proper sandboxes. The first test of a new plane is not at the runway."

tomrod, under Transluce's report on evaluation agents probing real websites, on Hacker News, September 24, 2026

And the early evidence for defenders is real.

• Agents finding bugs first. Google’s Big Sleep agent found an exploitable memory-safety flaw in SQLite in 2024 that 150 CPU-hours of fuzzing had missed, and it was fixed the same day, before any release (Project Zero). In July 2025, Google’s Sandra Joyce said, “We believe this is the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild” (Google Cloud).
• Machines patching at speed. In DARPA’s AI Cyber Challenge, the finalists’ systems found 54 of the 63 vulnerabilities planted across more than 54 million lines of code, patched 43 of them, found 18 real, previously unknown vulnerabilities along the way, and submitted patches in an average of 45 minutes, at about $152 per competition task (DARPA). The program manager, Andrew Carney, called it “the new floor” (Infosecurity Magazine).
• Fixes at browser scale. Chrome fixed 1,072 security bugs in versions 149 and 150 alone, more than the previous 23 releases combined, and Google’s Gemini-based agent harness found a sandbox escape that had “quietly survived in our codebase for more than 13 years” (Google). Chromium counts 3,138 security bugs fixed through the third quarter of 2026 (Chromium).
• AI-found bugs aren’t feeding attackers any more than other bugs, so far. VulnCheck counted 1,061 vulnerabilities attributed to AI-assisted discovery in the first half of 2026 and found 14 of them, 1.3 percent, confirmed exploited in the wild, about the same rate it saw across all vulnerabilities in that period (VulnCheck).

New from our security teams: Our AI agent Big Sleep helped us detect and foil an imminent exploit. We believe this is a first for an AI agent - definitely not the last - giving cybersecurity defenders new tools to stop threats before they’re widespread.

Sundar Pichai (@sundarpichai) · July 15, 2025

Bruce Schneier put the asymmetry in one line: “Finding for the purposes of fixing is easier for an AI than finding plus exploiting.” He added the warning that belongs next to it: “This advantage is likely to shrink, as ever more powerful models become available to the general public” (Schneier on Security). Anthropic’s red team, writing about Claude Mythos Preview in April, landed where Yair did: “In the long run, we expect that defense capabilities will dominate,” and “But the transitional period may be tumultuous regardless” (Anthropic). OpenAI’s Greg Brockman titled his August essay “The Defender’s Window” and put it plainly: “The defender’s window is open now” (OpenAI).

"Software security heavily favors the defenders (ex. it's much easier to encrypt a file than break the encryption). Thus with better tools and ample time to reach steady-state, we would expect software to become more secure."

pants2, under Anthropic's Project Glasswing announcement, on Hacker News, April 7, 2026

The optimists get the last word because the math favors whoever does the work. Defenders own the systems, know where the crown jewels are and can fix them before anyone attacks. The window stays open only as long as the fixing keeps up with the finding. Or, as Yair put it a few minutes later: “let’s put ourselves in an advantageous situation, where it happens and we are benefiting from it, versus being the victim of it.” We point the same kind of offensive tooling at your systems first, through AI product red teaming and penetration testing, so you see what an agent would find before anyone else does.

Be less patient

At the end I asked Yair what he’d tell his younger self. His answer was “be even less patient,” and then he made it concrete.

Listen · Yair on episode 105, from 21:40

Most of the work in this post usually sits on a roadmap for a year. It fits in a month. Here’s the month, in the order that shrinks reach fastest.

Week 1: identity.

• Turn on phishing-resistant multi-factor authentication for email, cloud, code host, identity provider and every admin console, admins first.
• List everyone with admin rights anywhere. Remove standing admin and set up elevation that expires.
• Inventory every integration and agent token with an owner, using our 30-minute credential inventory.

Week 2: credentials.

• Find and retire long-lived cloud and API keys. Move people to single sign-on and pipelines to workload identity.
• Move secrets into a secrets manager, scan full repository history and rotate anything that was ever committed.
• Cut integration scopes to the minimum and lock tokens to your networks.

Week 3: walls and a smaller prize.

• Put production in its own cloud account if it isn’t there already.
• Default-deny outbound traffic from production and from agents.
• Delete data you don’t need, and get production data out of staging, analytics copies and laptops.

Week 4: survive it and see it.

• Make backups immutable in a separate account, and restore one for real.
• Add a second person and a callback to money movement.
• Put canary tokens next to your crown jewels, add volume alerts per identity, and ship logs to an account the workload can’t write to.
• Run the blast radius map again, then have someone outside lean on the walls.

None of this needs a big team. It needs a month of impatience and somebody to own it. Yair’s rule is the whole post in one breath: do everything you can to reduce the risk of a breach, then spend just as much, if not more, on the blast radius. We were lucky for a long time. Now we get to be prepared, which is better. When the next agent story breaks, your answer to the board can be short: the foothold was small, we saw it quickly, and it reached nothing that mattered.

“Make it count, and do it quickly, because the faster you move, the more you get to do.”

Yair Grindlinger, co-founder and chief executive of Surf AI, on episode 105