Reco

Saturday in #Miami with Ed Sim Our first meeting ended with Ed saying: “Let’s build the f***ing graph.” So we did. Now our #AI agents love it.

We're moving the bat cave. 🦇 We have a ton of new enterprise customers so we need more space to support them. The enterprises counting on us to close their SaaS Security Gap deserve a team firing on all cylinders and this new space gives them just that. Here's a sneak peak at the team and new office!

We upgraded the lab. 🔬 More security breaches means more time experimenting on upcoming ways to stay ahead of them. Enterprise security teams are dealing with a SaaS and AI attack surface that keeps expanding and they need a team that keeps pace with it. Check out the new office in the video!

The 4 gaps you need to know before AI access turns into insider risk. After working across hundreds of enterprise environments, the same four structural problems surface consistently. None of them get flagged by governance processes because those processes account for human identities and stop there. Here are the 4 gaps: 1. AI service accounts have no assigned owner so permissions accumulate with no one reviewing them. 2. Shadow AI tools connect to production environments outside IT oversight creating access paths that were never sanctioned and never monitored. 3. Non-human identities are excluded from access reviews so permissions from day one stay unchanged a year later. 4. When AI touches regulated data, audit logs cannot trace what was accessed or where it went. These problems exist independently of how mature your security program is. The governance model accounts for the identities it was built around, and AI sits outside all of them.

Check out the new digs! We outgrew the last office faster than expected. From this new location we'll be able to match the pace of the enterprise customers counting on us. Interested in working from this beautiful fantabulous place? Make sure to follow the Reco page for job updates!

Copilot, Agentforce, and ChatGPT are saving teams 10 hours a week, helping to close deals, and writing reports. However, the permissions they collected along the way were not part of the productivity conversation. The moment an agent connects to an admin console, it moves through your environment at a speed no security team can manually track. Every tool your org has approved has a permission footprint that was never formally reviewed, and that footprint grows quietly every time a new integration gets added. Having a complete picture of what each agent can access and what actions it is capable of taking is the only way to stay ahead of it.

Before you open a req for an AI security lead, you need to hear this. The hiring decision gets framed as a budget question when the more important question is what that hire would be responsible for. Without visibility into which AI tools exist in your environment, a dedicated AI security hire will spend their first six months doing exactly what tooling should have been doing before they arrived. That means manual OAuth reviews and informal Slack threads asking teams what AI they are running, which is a discovery problem that a headcount decision does not fix. Nearly 71% of employees are already using AI tools without IT approval, which means the hire inherits months of accumulated exposure they had no part in creating and no platform to assess at scale. The sequencing has to be right before the headcount decision makes sense. Discovery comes first, and everything else follows from that.

You have the wrong idea about LLM risk. When security teams evaluate LLM risk, they are asking whether the model can be made to produce harmful text. I’ll be frank here: this is the wrong question to be asking. Harmful text is a distraction from the actual exposure. An agent with broad permissions and no behavioral oversight can work through your environment and nobody's safety benchmark will flag it because the outputs look completely clean. Can your agent be directed to cause that kind of damage? Now this is a much better question to be asking.

We spoke with Forbes about where shadow AI is actually landing inside financial institutions. Ungoverned AI tools outnumber monitored ones 4-to-1, and they're not hiding in marketing or HR. They're in treasury, payments, and correspondent banking, where the data is most sensitive and the regulatory exposure is highest. We don't see a complete inventory anywhere we look. The liability clock starts ticking well before anyone notices the tool. Full piece here: https://lnkd.in/emMZ4VXt