×
Actionable Signals with Cy5 · Episode 01Joint webinar · Episode 01
Your AI agent won't get a new identity. It'll use one you already made.
01 · The problem
It runs in a Lambda, a pod, a CI/CD job or a workload, using an identity that already exists.
Which means your agent risk is bounded by something that already exists in your cloud estate, and that almost nobody has measured. Across AWS, Azure and GCP, the gap between what a non-human identity was granted and what it has actually used is the largest unexamined number in most organisations.
That gap is what your agent inherits.
We call it the Inherited Perimeter. This session is about measuring yours.02 · The framework
Five links. An AI agent inherits all of them — and the one in the middle is the one nobody has measured.
The Inherited Perimeter is the set of cloud entitlements an AI agent or automated workload acquires by assuming an identity that already exists — an execution role, service account, pipeline trust or access key. It is measured by the Permission Delta: the share of granted permissions that identity has not invoked in ninety days.
03 · Takeaways
Every one of these is yours to run on Thursday morning.
What the granted-versus-used gap measures at across real multi-cloud estates — with the methodology shown, not just the headline. Measured, not surveyed.
Enumerate, attribute, compare, reach, reclaim. Answerable in order, against your own estate. Most organisations discover they stall at question two.
The specific commands to run against AWS, Azure and GCP to answer question one yourself — every non-human identity in your estate, listed. No product required.
What you constrain at the access boundary while the reclaim backlog burns down — from an architect who deploys this across ZTNA and SASE estates for a living.
04 · Audience
Cloud security architects, IAM and identity engineers, platform and DevSecOps leads, SecOps leaders, and the CISOs who will be asked about this before they are ready.
Organisations running production workloads on one or more public clouds.
Anyone looking for an introduction to AI security. We assume you know what an IAM role is, what a service account does, and why a wildcard in a policy document matters.
We will not be defining CNAPP.
Not a product demo. Five minutes on how we measured the number, because a method you cannot see is a claim you cannot check. Fifty-five minutes not about our platform.
This is also not a product demonstration. There is a five-minute segment where we show how we measured the number, because a method you cannot see is a claim you cannot check. The other fifty-five minutes are not about our platform.
05 · The hour
with Lalit Kumar, former Head of Security, AWS IndiaWe will keep the hard stop. Your schedule won't get hampered.
06 · Speakers
Founder & CEO, Cy5 · former Group CISO, MakeMyTrip in
Vikram was a CISO before he built a cloud security platform, which means he has been on both sides of the conversation about what a security tool actually tells you versus what it claims to. He founded Cy5 in 2021 to close the gap between when a cloud estate changes and when anyone finds out. He'll be presenting the measurement and what it means.
Former Head of Security, AWS India in
20+ years in enterprise security, from blade servers to AI agents. Built AWS India's Security Practice, shaped policy with RBI, SEBI, CERT-In and MeitY. Mentored cybersecurity startups and worked with 100+ CxOs. Now focused on redefining security baselines for a world where everyone builds. Working at the intersection of cloud security, AI governance, and regulatory compliance.
07 · Register
Measured across real estates. Not surveyed. Not projected.
Fri 16 Oct · 15:00 IST · your question answered live
Reserve a seat →08 · Questions
The Inherited Perimeter is the set of cloud entitlements an AI agent or automated workload acquires by assuming an identity that already exists — an execution role, service account, pipeline trust or access key. It is measured by the Permission Delta: the share of granted permissions that identity has not invoked in ninety days.
The proportion of permissions granted to a non-human identity that it has not invoked during a defined observation window, typically ninety days. A delta of 0.94 means the identity used six percent of what it was given. It is the core metric of the Inherited Perimeter framework.
In production, an AI agent almost never receives a purpose-built identity. It authenticates as its runtime: an AWS Lambda execution role, a Kubernetes pod service account, a CI/CD job's OIDC trust relationship, or a static access key in an environment variable. It inherits every permission that identity already holds.
The three providers model entitlements differently enough that the question does not translate. AWS IAM policies, Microsoft Entra role assignments and Google Cloud IAM bindings use different primitives for grant, scope and inheritance. Asking "what can this identity reach?" returns three answers that are each correct within their own console and cannot be summed.
Start by enumerating per provider: IAM roles, users and access keys in AWS; service principals and managed identities in Entra; service accounts in Google Cloud. Then add workload identities from Kubernetes and any CI/CD trust relationships. Attribution — who owns each one — is usually harder than enumeration.
No. CIEM is the tooling category that measures cloud entitlements. The Inherited Perimeter is a framework for interpreting that measurement once AI agents begin assuming existing identities, together with a five-question assessment for locating an estate's current visibility. It can be applied with any CIEM tool, or with native cloud APIs alone.
They address different stages. The CSA framework designs governance for purpose-built agent identities — lifecycle, just-in-time access, constrained delegation. The Inherited Perimeter measures what agents inherit in estates that have not reached that state yet, which is most of them. The two are complementary: assessment first, governance design second.
Yes, and arguably more so. The non-human identities an agent will inherit already exist — service accounts, pipeline roles, access keys, cross-account trusts. Measuring the gap between what they were granted and what they use is more useful before agents are deployed against them than after.
Still have a question? Add it when you register and we’ll answer it live.
Friday 16 October, 15:00 IST · free · 60 minutes. Measured across real estates. Not surveyed. Not projected.
Reserve my seat — get the five questions →
Hosted by Cy5 & Auxiliary Digitech
Actionable Signals with Cy5 · Episode 01
Event-driven protection. Zero blind spots. Infinite scale.