Jeffrey Vinson puts the agent problem in a sentence that needs no security vocabulary at all.
Do you know what happens at 10:01?
“Something starts at 10:00 a.m. An agent starts talking. Do you know what happens at 10:01? Unless you're looking at runtime, you have no understanding of what's happening.”
Approval happens once. Behaviour happens continuously. An agent you reviewed, scoped and signed off is still an agent taking actions on behalf of a human or a service for as long as it runs, and the gap between those two facts is where the trouble lives.
SaaS, identity or AI? He refuses to rank them.
Vinson is a former healthcare CISO, so he has sat on the side of this where the answer has to be practical. Asked which of the three is the bigger risk today, he declined the premise.
“I'm going to say all. It's like juggling a ball, which one falls first? All three are high risk.”
That refusal is the point. These are not three problems to rank and work through in order. An identity is how an agent acts, SaaS is where it acts, and AI is what decides. Treating them as separate queues is how an organisation ends up with three partial views and no picture.
Without runtime, you are blind.
His word for not having that picture is blunt.
“If you don't understand what's actually running in your environment, the activity it's doing, it's almost as if you're blind.”
He is careful to say this applies even to the applications you trust, which is nearly all of them. Nobody deploys software they distrust. Trust gets granted at approval and then assumed indefinitely, and an attacker working through a trusted integration looks exactly like that integration doing its job.
Watching what happens, across cloud, SaaS, identity, third-party services and AI, and acting on it while it is still happening, is a different discipline from deciding what to allow, and it is what Agentic Runtime Security for the Modern Infrastructure is for.
Jeffrey Vinson sat down with us twice. In the earlier conversation he looks at what the rush to the cloud left behind: How to Go Beyond Posture-Based Prevention with Mitiga.
