The New ABCs of Cybersecurity: Identity, Visibility, and Containment

When Keren Elazari agreed to join me on The Segment podcast, the first thing she did was go rummaging through her closet. She was hunting for a t-shirt that carries a line she’s delivered from stages all over the world: hackers don’t break in, we log in.

During our discussion, she backed the line with data.  

Year after year, she said, the Verizon Data Breach Investigations Report (DBIR) told the same story: stolen credentials and recycled passwords still the front door. While vulnerability exploitation has now overtaken credential abuse as the top initial access vector, credential abuse still turns up in 39% of breaches when looking at the attack chain as a whole. That makes it the most pervasive technique in the data. (Attackers often pair the two.) They pry open an unpatched system, then reach straight for credentials.

Patching, meanwhile, is going backward. Only 26% of known exploited vulnerabilities were remediated last year, down from 38% the year before. And the median time to patch stretched from 32 days to 43.

That’s the gap between the conversation we’re having about AI in cybersecurity and what attackers are actually doing to our environments. AI hasn’t invented a new class of intrusion so much as it’s compressed the timeline for exploiting weaknesses we already knew about.  

Keren’s argument is that the industry has to get security ABCs right before it can get much value out of security AI. Her version of those fundamentals: identity, visibility, and containment. Each one closes a gap that AI is currently widening.

Attackers don’t break in. They log in.

Ask Keren how she gets into an organization on a red team engagement, and she’ll tell you what she won’t do: she won’t burn time and budget building a custom exploit from scratch.

Reconnaissance eats most of the schedule, and what she’s hunting for is access. A legitimate employee’s credentials are the ideal find because that access moves quietly.  

Only after the low-effort paths are exhausted does she consider attacking a public-facing system, because that’s the loud option and the one most likely to get caught.

Real criminal groups follow the same breach economics. Keren walked through the ShinyHunters campaigns, part of the loose ecosystem the FBI refers to as “The Com.” Their playbook started with calling an organization’s help desk while impersonating an employee with privileged access, then convincing the desk to reset the employee’s credentials.  

More recently they’ve flipped the script, impersonating the help desk itself, triggering single sign-on prompts and password resets, and harvesting the credentials that come back. When these groups did reach for AI, Keren said, they mostly used it for deepfake voice generation to sharpen their social engineering.

The point that should stick with security leaders is that criminals are relentlessly creative with what they already have. They’re sitting on enormous databases of usernames and passwords. Multi-factor authentication still isn’t fully rolled out at a lot of organizations, and plenty of the deployments that do exist lean on authentication methods Keren considers well past their expiration date.  

Why AI speeds up attackers more than defenders

Keren described AI as a time machine for attackers. Reconnaissance, tooling, and campaign planning that used to take weeks or months can now be done in days or hours.  

Defenders should be getting a comparable boost, and so far they aren’t.

The reason comes down to what an AI model can check its own work against. When a large language model (LLM) hunts for a vulnerability, it has a clear test for success. It can try to exploit the flaw and see whether the attempt works. That pass-fail signal is what makes the skill trainable, and it sharpens with every iteration.  

Patching offers no such signal. A fix has to survive production, in whatever variant of an environment it lands in, without breaking the application it’s meant to protect. No quick automated check can confirm all of that.  

Models keep getting better at finding flaws. Writing and safely shipping the repair remains slow, careful, human-supervised work.

That’s the first hard truth from the conversation. Discovery accelerates, remediation doesn’t, and the gap between them widens on its own. As Keren put it, you can’t “sprinkle some LLM powder on it” and call that a strategy.

AI didn’t create two decades of technical debt built from passwords, unpatched systems, identity sprawl, and flat networks. It just moved up the due date.

The most advanced attacks she’s seen bear this out. She pointed to the nation-state campaign Anthropic documented in late 2025 as GTG 1002, in which the attacker used AI agents to orchestrate an intrusion end to end. That orchestration was a real advance. Still, Keren suspects the initial access itself looked entirely ordinary: likely stolen credentials or a forgotten gap in the environment that solid fundamentals would’ve closed.

Why a network security assessment should start from the outside

Keren’s second hard truth is that attackers often understand a target environment better than the people defending it.

She doesn’t think that’s a competence problem. Security teams defend a live business, not a laboratory. A live business runs payroll, onboards vendors, spins up cloud workloads, and connects APIs. Every one of those necessary activities creates an attack surface.

Shadow IT and shadow AI follow the same logic. People adopt what helps them do their jobs. Attackers exploit it on the safe assumption that the gaps are there, an assumption Keren says almost always pays off.

She raised a related pattern in security tooling. Most teams now run somewhere between 50 and 60 security products, and they assume all that coverage adds up. But map those capabilities against a real attack path, whether that’s the Lockheed Martin kill chain or MITRE ATT&CK, and the gaps become obvious.  

Keren said she can usually find someone inside a highly mature organization who will admit that a particular system, or a cloud environment, or a department’s new AI project, sits outside all of it.

Her practical challenge to security teams: run an internal network security assessment. Tools like Shodan and Censys have been available for years, but she still meets teams that have never used them to look at their own environment the way an attacker would.  

Any serious network security assessment should include that outside-in view, because you can’t defend what you can’t see.

Proactive paranoia: the 3 essential security fundamentals

When Keren trained for the cyber profession, the fundamentals were the CIA triad: confidentiality, integrity, and availability. Those still hold. But they describe what you’re protecting rather than how attackers actually reach it.

Instead, she proposes an updated set:

• ‍Identity. For most of the past decade, identity was the largest single initial access vector in reported breaches, and the way most organizations manage it is still stick in 20th-century thinking. By Keren’s estimate, fixing it removes at least 20% of initial attack vectors.‍
• Visibility. If attackers can inventory assets you’ve forgotten about, you’re starting the fight at a disadvantage. Visibility is what turns an unknown environment into a defensible one. ‍
• Containment. This is the one Keren cares about most as a hacker, precisely because she doesn’t want to be contained. An attack stops short when lateral movement is hard, when networks are segmented, and when getting into one system doesn’t hand over the next ten. Microsegmentation builds that containment directly, putting policy between workloads so a compromised system has nowhere obvious to go next.

Keren calls the mindset behind all three “proactive paranoia,” and she distinguishes it carefully from fear. Fear paralyzes, while proactive paranoia prepares. As she puts it, you don’t wait for the rain to build your tent.

So why don’t more security teams do this work? Keren believes it’s partly human nature, since sorting out identity sprawl feels like cleaning out an attic. And it’s partly prioritization, because it’s hard to position identity, visibility, and containment as the next big strategic initiative.  

The fundamentals are what make AI worth adopting

Every AI capability a security team wants to deploy runs on the same foundation: knowing who’s on your network, what’s in your environment, and where an intrusion can travel.  

An AI agent that triages alerts is only as useful as the asset inventory behind it. Automated response is only safe in a network where the blast radius of an attack is already bounded.

That’s the part of Keren’s argument worth taking to a budget conversation. Identity, visibility, and containment are the preconditions for an AI strategy that holds up. Skip them and you’re layering automation onto an environment nobody can fully see, which compounds the visibility problem you started with.

The attacker’s timeline keeps shrinking. The question for defenders is whether the ground underneath their tooling is solid enough for any of it to help.

Listen to the full episode of The Segment: A Zero Trust Leadership Podcast on Apple Podcasts,  Spotify, or our website.