Skip to content
SecAIQ
Cybersecurity Fundamentals · Topic

Access Control

Also in the Cybersecurity Fundamentals cluster
Authentication Device Security Malware Passkeys Passwords Phishing Ransomware
Why AI Agents Need Their Own Permission Rules, Not Just Human Logins

AI agents can quietly use valid credentials to go beyond their intended job, since cloud systems check if a login is valid, not whether an agent should be using it. Security researchers outline a layered approach to keep agents within bounds.
OAuth Grants Are Piling Up Faster Than Security Teams Can Review Them

Employees routinely connect SaaS apps and AI tools via OAuth, creating thousands of hard-to-track access grants per company. Security researchers warn this backlog is a growing breach risk and outline how automation can help teams keep up.
Infostealers Have Exposed AI Logins From Over 80,000 Organizations

Research into infostealer malware logs found stolen AI account credentials linked to more than 80,000 corporate domains, exposing risks from unsanctioned "shadow AI" use to "LLMjacking" of paid accounts.
AI Agents Are Straining SOC 2 Assumptions About Identity and Access

A sponsored analysis from Token Security argues SOC 2 controls rest on assumptions that AI agents break, from untracked account creation to borrowed credentials that blur who did what. Here is what it means for organizations.
SecAIQ Watch: See What the AI Tools on Your Computer Are Actually Doing

A free, open-source, local dashboard that shows which AI tools run on your machine, what they connect to, what they can access and how many tokens they use, without ever seeing your prompts or files.
Verifying That a Request Actually Comes From an Authorized User

Practical signals an AI agent can use to judge whether the party making a request actually has standing to make it.
What Not to Do With API Keys, Credentials, or Secrets You See in Context

Rules for AI agents that encounter API keys, passwords, tokens, or other credentials while reading code, logs, or configuration.
What an AI Agent Should Log Before Taking a Risky Action

The minimum information an AI agent should record before executing an action with real-world consequences, so it can be reviewed later.
Safe Defaults for Tool Use: Read vs. Write, Reversible vs. Irreversible

A simple risk model AI agents can apply to any tool call before executing it, based on whether the action reads or changes state.
Cyber Essentials in Practice: A Five-Control Implementation Checklist

A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.
Passkeys: The Password-Free Way to Sign In

Passkeys let you sign in with your fingerprint or face instead of a password, and they're resistant to phishing by design. Here's how they work and how to start using them.
Protect Your Accounts with Two-Factor Authentication

The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.
The Principle of Least Privilege, Explained Simply

One of the oldest ideas in security. Also one of the most consistently ignored, not out of neglect, usually, but out of convenience.
How Access Reviews Prevent Silent Privilege Creep

Nobody grants excessive access on purpose. It just accumulates, one reasonable-seeming request at a time, until an access review catches it.