Insights / Talks / Polk County Security Summit 2026
Polk County Security Summit · October 9, 2026 · Lakeland, FL
The Insider Risk You Buy Monthly
“Aware of it. Paying for it. Not watching it.”
Fezz · Founder, Threat Vector Management
Updated October 10, 2026: renamed our AI security service to AI Adoption & Agent Security.
Updated October 9, 2026: added two stories from the week of the talk and where to look every day.
Bottom line
- AI is an insider risk, with extreme intelligence, no guilt, and no recourse. Point the insider program you already run at it.
- Deterrence doesn’t work on AI. Background checks and consequences don’t apply, so prevention and detection carry the whole load.
- To your identity system, the AI is usually the user. Same login, same permissions, same logs. Give every agent its own identity.
Take it with you
Three rings tell you where to look. Four questions tell you what to check. Four moves tell you what to do. Eight key risk indicators (KRIs) tell you whether it’s working: three to track and five to hold at zero.
| Where | Use: someone else built it and your people feed it. Run: you run it, on your laptops or in your cloud, including agents your teams build. Ship: your brand answers the public with it. |
|---|---|
| Check | Access: what data can it reach? Exposure: whose words will it act on? Action: what can it change, send or promise? Telemetry: would you know if it went wrong? |
| Do | Find it: every AI that can act, with an owner. Badge it: its own identity, never a person’s login. Box it: one job, fewest tools, and no single agent gets Access, Exposure and Action together. Watch it: the deed, not the diary. Pin each agent’s version (model, prompt, tools) and alert on any drift, above all in Ship, where a vendor update can change what your brand says overnight. |
| Measure | AI prompt approval rate: how often people click yes when an AI tool asks permission to do something. Time to approve, against the time it takes to read the prompt. Actions under a human identity: target zero. Hold five more at zero: agents with all three legs, standing or shared agent logins, unvetted plugins, and remembered devices and text-message MFA on high-value accounts. All eight, with a source for each. |
Access, Exposure and Action are Simon Willison’s “lethal trifecta” in our words. Telemetry is the fourth leg we add. Three legs make it dangerous. The fourth keeps you steady, because it’s how you find out when prevention misses.
One question per move, for your team on Monday
| Move | Ask | When |
|---|---|---|
| Find | Can we list every AI that can act, in each ring, with an owner? | Now |
| Badge | How many agents run on a person’s login? Are agents on the off-boarding checklist? | 30 to 90 days |
| Box | Does any single agent read outside content, touch sensitive data and act? Split it. | 30 to 90 days |
| Watch | Do we watch what agents do, or only what they say? What’s our AI prompt approval rate? | Next quarter |
Set your MDR up to win, on Monday
Your MDR can only see what you send it, and can only act where you’ve wired it in. Ask for these, then confirm each one with your provider: what it can do depends on the integrations you have.
| Monitor | Send it your endpoint (EDR) telemetry: that’s where coding agents, desktop AI apps and MCP servers run. Send your identity provider logs (Entra ID or Okta) and your Microsoft 365 audit log. Send proxy or firewall logs, so it can see which AI apps your traffic reaches, and your cloud control plane (AWS, Azure or Google Cloud), where the agents you build run. |
|---|---|
| Detect | Give every agent its own account, then ask your MDR to baseline it like a user. Tell them which accounts are agents, who owns each one, and where each is allowed to send. Make sure no agent account sits in a group you excluded from monitoring. |
| Respond | Pre-approve, in writing: suspend the agent’s account, clear its sessions, force a password reset, isolate the machine it runs on, quarantine files, and block where it sends (IP, domain or URL). Decide which actions run automatically and which need a person, and who approves at 2 a.m. |
| Still yours | Revoking an agent’s API keys, OAuth consents and app registrations. Deciding which AI is allowed. Blocking an AI tool from running, which is your endpoint policy. Reading prompts and catching prompt injection usually aren’t part of an MDR service, so ask before you assume. |
New the week of the talk
Two stories broke in the days before the summit. Each one lands on a move from the talk.
| Box it | Windows can now box an agent. On October 7, 2026, Microsoft made Microsoft Execution Containers (MXC) generally available on Windows 11. The agent runs inside a container with a written policy: which files it can read or write, which networks it can reach, what it can launch, and whether it can touch the desktop. Windows enforces that policy, so the agent can’t grant itself more access in the middle of a task. A session container also runs the agent under its own Windows account, which is the Badge move at the operating-system level. The catch: the agent’s maker has to build it in. GitHub Copilot, OpenAI Codex, OpenClaw and LM Studio support it now, and Anthropic’s Claude Code is announced. Microsoft lists Intune policy, Entra separation of agent and human activity, and Agent 365 controls for local agents as coming soon, without dates. On Monday: ask each AI tool vendor whether it runs inside MXC or a sandbox like it, and what policy it ships with. Read Microsoft’s “Microsoft Execution Containers: Policy-driven containment for AI agents” (Windows Developer Blog) and the open-source MXC software development kit on GitHub, which also covers macOS and Linux. |
|---|---|
| Watch it | An attacker’s AI sessions became the evidence. On October 7, 2026, CrowdStrike reported a campaign against South Korean financial institutions that ran from late September into early October. The attacker drove ARTEX, an open-source agentic penetration-testing tool, mostly on DeepSeek models, and used Claude Code on the side. CrowdStrike recovered Claude Code session histories, Claude memory files and a CLAUDE.md instruction file from the attacker’s own open directories. In those sessions the attacker asked Claude to write a security researcher résumé, and asked where Korean breach data is usually sold. CrowdStrike’s assessment is that AI lets one financially motivated actor run several intrusions in a short time. The lesson cuts both ways: an agent’s session files are evidence, on an attacker’s server and on your own laptops. On Monday: find out where each coding agent on your endpoints keeps its history, and keep those files in scope for incident response. Read CrowdStrike’s “Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance”, as covered on the SANS Stormcast for Friday, October 9, 2026. The same episode covers Jim Clausing’s “Reconstructing AI Agent Activity: Two New Scripts for Forensic Review” (SANS Internet Storm Center), which rebuilds what the OpenCode and Hermes agents did from the files they leave behind. |
What to look for today, every day
AI advice changes every quarter. A daily habit of reading what’s being exploited, and hunting for it, doesn’t.
- SANS Internet Storm Center: free, written by working incident handlers. The daily diary and the short Stormcast podcast answer three questions every day: what’s happening right now, what to look for today, and what to do about it. If your team reads one free source a day, make it this one.
- Our free Threat Brief: posted periodically. Every item says what to do now and who can safely skip it, with the indicators to look for and hunts you can run yourself, in bash, PowerShell, Sigma, Splunk, KQL, Elastic, osquery and Suricata.
- Vector Brief: the same work, matched to the technology you actually run, so it isn’t noise. It arrives at least weekly, and as often as needed when something real lands, with hunt packs your MDR, MSP or SOC can run. Ask about Vector Brief.
The slides
All 28 slides as presented on October 9, 2026, without speaker notes:
Insider threat programs: Carnegie Mellon’s CERT guidance and training
The talk’s first framework points your existing insider threat program at AI. If you’re building that program, or tuning one, start with the CERT National Insider Threat Center at Carnegie Mellon University’s Software Engineering Institute (SEI).
- SEI, Insider Threat: the center’s research, tools, courses and certificates in one place.
- SEI, Common Sense Guide to Mitigating Insider Threats, Seventh Edition (2022): 22 best practices, each mapped to the people, process and technology that carry it out.
- SEI blog, The 13 Key Elements of an Insider Threat Program: the checklist for what a program needs before it can work.
- Training: Insider Threat Awareness Training (about one hour, self-paced, for the whole workforce), Building an Insider Threat Program, Insider Threat Program Manager: Implementation and Operation and Insider Threat Analyst.
- Credential: CERT Insider Threat Program Manager Certificate.
Elsewhere at the Polk County Security Summit 2026
This talk closed a day of sessions that built on each other. The summit site has the full agenda; it was presented by Daybook Consulting, Sittadel and Hook Security, hosted by the Polk County CIO ThinkTank at Catapult Lakeland. Speaker names link to their LinkedIn profiles; company names to their websites.
- Building a Common Language: Traditional Threats, AI Threats & Agency — Joshua Sitta, Sittadel (LinkedIn).
- Who Read This Code? — Matt Wagner, Red Leg Dev (LinkedIn). Slides.
- Governing AI: Moving Before the Rules Are Finished — Zachary Eikenberry, Hook Security (LinkedIn). Speaker page.
- AI in Action: Initial Lessons from SOC Operations — Garrett Poorbaugh, Sittadel (LinkedIn).
- AI Workforce Today: Efficiency, Effectiveness & Human Behavior — Garrett Poorbaugh and Alex Delfino, Sittadel (LinkedIn).
- Welcome and the Polk County CIO ThinkTank — Chip Nuttall, Daybook Consulting, and Joshua Sitta, Sittadel (LinkedIn).
Slides are linked where the speaker has posted them publicly; we’ll add the others as they appear.
Cited in the talk
- Simon Willison, “The lethal trifecta for AI agents: private data, untrusted content, and external communication” (June 2025). The source of the Box rule.
- Beurer-Kellner et al., “Design Patterns for Securing LLM Agents against Prompt Injections” (2025). The research behind one-way, data-only hand-offs between agents.
- DevOps.com, “Anthropic Makes Claude Code’s Auto Mode the Default, Betting Automation Beats Manual Review” (August 10, 2026). Reports Anthropic’s 97% permission-prompt approval rate.
- Bravo-Lillo et al., “Harder to Ignore? Revisiting Pop-Up Fatigue and Approaches to Prevent It” (SOUPS 2014). Median time to dismiss a familiar dialog fell from 10 seconds to 1.2.
- Marc Brysbaert, “How many words do we read per minute? A review and meta-analysis of reading rate” (Journal of Memory and Language, 2019). About 238 words a minute for silent reading.
- CISA, NSA and Five Eyes partners, “Careful Adoption of Agentic AI Services” (May 2026). Its own identity for every agent, and short-lived credentials over standing secrets.
- Koi Security’s fake postmark-mcp finding, as reported by The Hacker News (September 2025), with Postmark’s statement. Why plugins come from the real publisher, pinned to a version.
- Kaspersky, “New OpenClaw AI agent found unsafe for use” (February 2026). Malicious skills in an agent’s plugin store.
- FBI Atlanta’s warning on stolen Remember-Me cookies (November 2024), as reported by Malwarebytes. Why remembered devices on high-value accounts count against you.
- CISA et al., Mobile Communications Best Practice Guidance (December 2024): “Do not use SMS as a second factor for authentication.”
Frameworks and guides worth your time
- MITRE ATLAS: adversary tactics and techniques against AI systems, in the ATT&CK style your SOC already knows.
- Cloud Security Alliance, AI Controls Matrix (AICM), with its implementation and auditing guidelines: a vendor-neutral control set for AI, mapped to the frameworks you already report against.
- Cloud Security Alliance, MAESTRO: threat modeling built for agentic AI.
- Cloud Security Alliance, Agentic AI Red Teaming Guide: how to test agents before an attacker does.
- OWASP GenAI Security Project, Top 10 for Agentic Applications (2026) and Top 10 for LLM Applications.
- NIST, AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1).
- Microsoft, Entra Agent ID: one example of giving agents their own identities, if you run Microsoft 365.
From Threat Vector Management
- PIVCCERL™ incident response lifecycle: eight stages, including the Validation and Communication steps older lifecycles skip, with statutory clocks.
- TIDev™: threat modeling at every pull request: threat-informed development for AI-assisted code.
- Why AI agents shouldn’t have standing access: the Badge and Box moves in practice.
- Why IP allowlisting fails against SaaS token theft: why identity, not network location, is the control that holds.
- AI Adoption & Agent Security and White-Glove MDR (via partnership).