Opinion
AI is making decades of security advice harder to ignore and easier to apply
"Least privilege and zero trust have been goals for years," writes Jonathan Langer, co-founder and CEO of Act Security. "AI is what took away the option of putting them off, and what finally makes them practical to apply without breaking production."
Cybersecurity has no shortage of good advice. Use least privilege. Segment networks. Assume breach. Remove unnecessary access. These ideas have been around for years. Implementing them across a large production environment is still difficult, especially when a security change can slow the business or break something that matters.
Broad permissions and old exceptions often survive because removing them can break production. They also accumulate across teams and over time: a permission may have been granted during an incident, a launch or a migration because the business needed to move, while the architecture around it kept changing.
The person who approved it knew why it was necessary at the time. Five years later, the permission is still there, the original context is gone, dependencies have shifted, and nobody wants to remove it without knowing what still relies on it. Every engineering organization eventually inherits someone else's "yes."
Security spent much of the last decade getting very good at visibility. A product can surface an identity holding far more access than it needs, a resource reachable by principals that should not reach it, or an attack path created by the combination of identity and network configuration. Reporting those conditions is safe; changing access in production is not.
Before you can take access away safely, you need what I think of as architectural context: what the policy is configured to allow, what is actually being used, what someone intended when they granted it, what else now depends on it, and what breaks the moment you change it.
For years, answering those questions for a single permission could take a senior engineer days of tracing logs, policies and dependencies. Multiply that by tens of thousands of permissions across a large cloud estate and the honest answer was that nobody could do it. So the finding became a ticket, the ticket joined a remediation queue, and the queue grew faster than anyone could work it down.
At a recent Team8 CISO Village, after several days of conversations with roughly 120 CISOs, I came home saying, half-jokingly, that zero trust was cool again. AI can lower the cost of understanding complex environments and turning policy into action.
Modern systems can reconstruct relationships across identities, networks and resources, compare configured access with observed behavior, and help teams determine whether a permission can be removed safely. AI also makes policies easier to generate, which moves the bottleneck to verification. A policy generated quickly is useful only if teams can prove what it will allow and what it will block before it reaches production. In practice, that starts to look like unit testing permissions: checking that they allow exactly what was intended and nothing more.
Historically, the secure answer was often obvious but expensive to implement. Least privilege across a large cloud estate meant understanding thousands of identities, policies, resources and network relationships, then making changes one by one while carrying the risk of disrupting production. The cheaper path was often to leave access broad and manage the resulting exposure with monitoring, alerts and periodic cleanup.
Cloud environments make that compromise worse because they keep changing: identities appear and disappear, services move, dependencies shift and a policy that was correct yesterday can become wrong tomorrow. As more of the analysis, simulation and policy generation is automated, structural changes that once required heavy manual work become practical. One policy change can remove an entire class of attack paths instead of closing findings one by one. Prevention can move from periodic cleanup to continuous, adaptive enforcement.
At the same time, AI is giving attackers the exact same advantage. Attack paths that once required patient exploration and specialist knowledge can now be enumerated with scripts and prompts, vulnerabilities and permissions chained together far faster than any human could manage, and discovered exploits weaponized more quickly.
We cannot patch our way out of a world where machines can continuously search for every path we forgot to close and move rapidly from discovery to exploitation. The same technology accelerating the attacker increases the value of finally implementing the defensive principles security teams have repeated for years.
Some of the hardest cloud-access questions sound almost trivial: What does this policy really allow? Who can actually reach this resource? What happens if I change this permission? In real environments, the answers depend on layers of identity, network configuration, inherited policies and exceptions. Security leaders may define the goal; infrastructure and platform teams make the access changes in production. Least privilege only becomes practical when the tooling works for the people operating the cloud.
These were already central questions for us at Act, and they were also the kind of practitioner problems addressed by the open-source Cloud Copilot toolset we recently acquired, now part of Amphi. Tools that can answer them accurately, test policies locally and model the consequences of a change can put long-standing security principles into daily operation.
Giving AI more authority to act raises the bar for trust. An agent that can alter production needs bounded changes, review and rollback. Human judgment still defines what the organization wants to allow and remains accountable for meaningful changes. Automation can make those decisions easier to execute consistently while keeping responsibility clear.
Some of the biggest advances in cybersecurity over the next decade may look surprisingly familiar: least privilege that is maintained continuously, zero trust without heroic manual work, and infrastructure that removes access it no longer needs. Cloud infrastructure should simply work securely.
Jonathan Langer is co-founder and CEO of Act Security.
