Who Controls AI Agents When Software Starts Acting Alone With Oasis Security

Neil C. Hughes (0:00)

AI agents are only as strong as the data that they're given. When provided with an outdated data set, your agents could end up doing more harm than good. But not with Denodo. With an AI data layer built within your platform, your agents are provided with real time data changes. So with Denodo, your agents can finally make the right business decisions. Simply visit denodo.com to learn more.

What happens when software can reason like a person but act at machine speed and immediately use every permission that it receives all at the same time? Now today on AI at Work, I'm joined by the VP of Product Strategy at Oasis Security. And together, we're going to examine why traditional identity controls will struggle with autonomous agents and he will explain why AI agents are goal seeking, unpredictable actors that combine human-like decision making with the speed of software. So I want to dig a little bit deeper on dynamic authorization, agent ownership, kill switches, and the growing problem of non-human identities across cloud and enterprise systems. It's a pretty big year for the company too. Cyera recently announced a $1 billion deal to acquire Oasis Security. And I want to talk about that. Well, it signals about the demand for AI agent governance and so much more. So if your business wants AI autonomy without handing every agent the digital master keys to your organization, I think this conversation offers a timely starting point. But enough from me. Let me introduce you to my guest now.

So thank you for joining me on the show today. Can you tell everyone listening a little about who you are and what you do?

Adam Ochayon (2:07)

Absolutely. So thanks for having me, Neil. My name is Adam Ochayon. I'm VP of product strategy at Oasis Security.

We're a non-human identity management and agent access company.

A bit about myself. I was born in the States, grew up most of my life in Israel and moved back to the States almost a decade ago.

And I like to say I'm in the intersection of our field and our go-to-market and our product and our tech. So really what I do day-to-day is make sure that I have a good pulse on the market on one hand and on our field, and also understand what we're working on developing and building, making sure that there's a very tight fit, a good feedback loop from what the market needs and from what our product can deliver on. Yeah.

Neil C. Hughes (2:54)

Also, it's a pleasure to have you join me today. It's a lot I want to talk about because every tech conference I go to this year, predictably, is all about agentic AI and AI agents, and there's a lot of noise, a lot of hype. But one of the things that attracted me to you and what you're doing at Oasis Security is that you've argued that AI agents behave very differently from the software enterprises that enterprises have spent decades securing. So for everybody listening here, what is it that changes when software can reason, choose tools across access multiple systems, and take actions independently? Why does all that force us to rethink identity?

Adam Ochayon (3:40)

Yes. Excellent question. So I think really the interesting thing here is AI agents, they kind of loan different attributes from the two sides that we're familiar with, that have historically been pretty separate and now we're colliding, right? So there is humans and how human behave, right? Of course, humans have their ability to reason, right? That's what makes us what we are, allows us to make decisions, to figure out the right path to do something. But also, on the other hand, generally speaking, humans are slow to act, right? On the one hand, and also, generally speaking, a human will do things within specific confines.

And if not, we can hold humans accountable, which is another really important part. Then on the other side of the field, so to speak, is what we've always known around software, around automation, around scripts, around workloads, where, again, on the one hand, they move incredibly quickly, incredibly fast.

On the other hand, usually pretty consistent, pretty deterministic, right? In the end of the day, programs are built to work in a specific way. And they always work in that way. Of course, sometimes there are bugs, sometimes there are issues. But generally speaking, the logic is imbued in the software.

And so now these two words, worlds collide, because we have non-deterministic reasoning actors that can change what they do, what they act based on different inputs, based on different context. But they also work at machine speed, right? So a lot of how we've been governing human access, for example, doesn't really fit anymore, because if we give a human too much access, then that's like a theoretical problem. Like, okay, maybe at some point this human will use this additional access, but we'll know to find it because it will be slow enough, and we'll know who's accountable for it. You give an agent too much access, it almost by definition is going to use it immediately, because that's how the system operates, right? Agents are goal seeking, they aim to please, they're greedy, right? They search those boundaries. And so that problem moves from hypothetical to real very quickly. So again, a lot of the concepts that we were familiar with on the human side of how we manage access to a human, putting them within roles, defining it pretty statically, things not changing too often. A lot of that really shatters when you're talking about agents, which I think is what's making identity for AI, for agents, an incredibly tough and interesting topic today.