MONDAYMOVE
One concrete action.
Every Monday.
COMING UP
identity
Rotate one stale secret you've been avoiding.
Every program has the secret nobody wants to touch — embedded in a script, hard-coded in a config, holding up something nobody fully understands. The longer it sits, the bigger the blast radius if it leaks. The exercise of rotating it is how you find the dependencies.
identity
Map one agent's authority.
The model is rarely the risk. The risk is the connections — what data flows in, what tools it can call, what authority it operates under. If you can't answer these three questions for one agent, you definitely can't answer them at scale.
ALL MOVES
Every move, in order.
access
Architect the YES on one blocked AI use case.
Blocking AI is a decision to go blind. Build the yes instead.
forward moves
Pick one chokepoint and make it the policy plane.
The control plane is consolidating, and the gateway is where your policy starts to actually live.
forward moves
Write your next 90-day commitment in one sentence.
The fundamentals didn't change. The blast radius did.
identity
Audit one privileged group and remove one person.
Privileged access creep isn't a tool problem. It's a Monday habit.
detection
Stand up a logging path for one agent
Your AI agent is making decisions in your environment right now. You have no record of most of them.
governance
The Part Nobody Sells You
Security teams are trained to find gaps. No one trains them to see what's already working
inventory
Create a CBOM (Cryptographic Bill of Materials)
Know your public endpoints, TLS version and cypher suites before Friday