OFFROAD ads

Im going to be the best man at a wedding, and I had nothing to wear. Work had been nonstop, by the time I left the office most stores were already closed. So I sent Instinct a voice message explaining what I needed and which stores I liked. It opened a personalized dashboard with styles that matched my taste, options available in my size, and, most importantly, free delivery returns. Three minutes later, the suit was in my cart, ready for me to buy. He did almost everything for me. OpenAI’s dots point in the same direction: agents that take responsibility for ongoing work. It made me think about cyber, where we still accept the opposite. A product finds a risk, generates an alert, and leaves the team to investigate it, understand the context, make the decision, and complete the fix. The software found the problem but the people inherited the work. That is what we are trying to change at OFFROAD Instinct did not hand me a list of stores. A security assistant should not hand a team another list of findings. For a routine access review, that means gathering the evidence, removing approved access, verifying that permissions actually changed, updating the ticket, and closing it. When judgment is needed, it should bring in the right person with the investigation already completed and one clear decision to make. The security team should not inherit another alert, It should receive a verified outcome, or a decision that genuinely needs a human. I definitely think that this is where the future is headed. I wrote more about this shift here: https://lnkd.in/e9vwUR6S

Identity never follows the map. Inside every organization, identities and permissions spread across systems, applications, and environments. People change roles, new tools are added, access accumulates, and what once looked organized quickly becomes messy terrain. Traditional identity tools try to fit that complexity into tables, graphs, and dashboards. But identity rarely stays on the paved road. That’s why we called our company OFFROAD. We’re building a way for identity and security teams to navigate the terrain as it really exists, even when the path is fragmented, unstructured, and constantly changing. Thanks to the CyberBytes team for the conversation and the opportunity to share our story. #IdentitySecurity #Cybersecurity #IAM

The more autonomy we give AI agents, the more important the identity fundamentals become. NIST just published a good piece on why agentic AI needs a strong identity foundation. One point stood out to me is that most of the identity problems we already struggle with get significantly worse when identities can act at machine speed. Least privilege is a clear example, making sure that humans and service accounts have only the access they need has always been difficult, and the risk becomes much bigger when AI agents can autonomously explore systems, combine tools, and take action. And it's important to note that knowing what an agent can do is not the same as knowing whether it should be doing it, in a specific context, at a specific moment. That's a big part of why we're building OFFROAD across human, machine, and AI identities - connecting governance, identity risk, and runtime activity so teams can move from visibility to resolution. Good read from NIST: https://lnkd.in/eJ_A7spq

An unused permission gets removed from a service account. Two days later, a production deployment fails because the release pipeline still depends on it. The remediation was not necessarily wrong, the team simply discovered an undocumented dependency that the original investigation could not see. This is the hard part of autonomous identity remediation. Removing access can take seconds. Doing it safely means understanding the impact, preserving the prior state, verifying the result, and knowing how to recover if new context appears. Autonomy does not earn trust simply because it can execute a change. It earns trust when teams can act without giving up control. I wrote about why recovery has to begin before remediation, what “reversible” actually means in identity systems, and why a successful API response is not enough. Read the full article: https://lnkd.in/evV7H9QU

Ask a developer why tools like Claude Code, Codex, and Cursor changed their life. They won’t say, “They give me a better view of the issues in my code.” They’ll say, “They actually get the work done.” So why are identity and security leaders still being handed dashboards instead of agents that can do the same? The breakthrough wasn’t a prettier view of bugs. It was giving developers agents that could understand the codebase, make changes, run tests, and turn problems into working results. Identity security needs the same leap. Security products can surface thousands of issues. But if the team still has to investigate each one, gather the context, chase the owner, make the change, and verify the outcome, all they’ve created is a better to-do list. OFFROAD’s agents don’t stop at finding identity risks. They actually resolve them - investigating the context, taking action within guardrails, and involving the right people when judgment is needed. Every action is controlled, auditable, and reversible. For CISOs and identity teams, the opportunity is clear: resolve more identity risk without scaling manual effort at the same rate. Dashboards had a good run, welcome to the era of completed work. 😎 Security leaders: are you measured by how many risks you find, or how many you actually resolve?

Too many access reviews are better at proving a review happened than reducing actual risk. A security leader recently walked me through a familiar process: his team sends managers a spreadsheet and asks them to confirm who still needs what. He has very little confidence that anyone can review it properly. The managers aren’t careless, they’re being asked to make production decisions without knowing whether the access is used, why it exists, or what will stop working if they remove it. Nobody wants to be the person who breaks payroll on a Tuesday, so approving everything becomes the rational choice. The problem isn’t the review, it’s asking someone to make a decision without the context that decision requires. Did your last access review remove meaningful risk - or mainly prove that a review took place? I wrote about it more here: https://lnkd.in/dJsKSxQq