“Attackers no longer break in. They log in. That is the entry point for every attack.” 

Who They Brought In 

Jason Lawrence is the Cybersecurity Director at Yancey Bros. Co., the nation’s oldest Caterpillar dealer, a 112-year-old Georgia institution serving the construction, roadbuilding, mining, and agricultural communities. He is also the co-founder of Security Reimagined, a community-focused advisory operation built to help small businesses and mom-and-pop shops become more cyber resilient with as little friction as possible. Jason started in cybersecurity in the mid-90s before the term cybersecurity widely existed, served in the Israeli Defense Forces, and has spent roughly 30 years building and leading security operations across some of the most recognizable names in the industry, including Ernst and Young, SunTrust Bank, LinkedIn, Silicon Valley Bank, and AT&T Managed Detection and Response where he led threat hunting. He is one of the more technically deep guests the show has had, and he brings that depth without once losing the thread back to practical application. 

What Got Loud 

• Attackers no longer break in. They log in. Identity is the entry point for every attack and most organizations cannot tell you what all of their identities even are 
• Agentic AI inside your environment is not just a productivity tool. It is an operational identity. If it is compromised, your entire operation can be compromised with it 
• The most dangerous phrase in cybersecurity is “we’ve always done it that way.” Jason has the IDS audit story to back that up 
• Security should be the Department of Yes. Not the Department of No. Here is what that actually looks like in practice 
• The Equifax breach came down to two things: an unpatched vulnerability and an exposed admin account on a website that nobody was managing 

The Rundown 

Jason’s framing for how security should engage with a business is the most useful reset in the series for anyone who has ever been told security is a hindrance. His position is direct: if security is slowing the business down, security is not doing its job. His alternative is what he calls the Department of Yes. Not a blanket yes to everything, but a yes paired with a how. Yes, you can do that, and here is how to do it securely. That reframe changes the entire dynamic of the relationship between security and the rest of the organization, and it starts with understanding the business before making a single recommendation. 

The identity conversation is where the episode reaches its highest technical altitude and stays most accessible at the same time. Jason’s definition of identity is broader than most security conversations allow. It is not just usernames and passwords. It is everything in a digitized environment: service accounts, API keys, AI agents, data itself. His central question to every organization is the same: do you have a complete inventory of all of your identities? The answer is almost always no. They point at Active Directory and call it done. Jason’s follow-up is the one that lands hardest: do you have an identity in Active Directory for each agentic AI running in your environment? For every API key? For every service principle? The answer is always no. And that gap is exactly where attackers go. 

The Equifax breach is the case study Jason uses to make the identity argument concrete. Two entry points. One was the Apache Struts vulnerability, a known unpatched flaw. The other was an exposed admin account on a web portal that nobody had inventoried, nobody had managed, and nobody had questioned. It was just there. Logged in and accessible. Jason’s point is not that the breach was inevitable. It is that both entry points were identities, one human and one not, that fell outside the scope of what the organization thought it needed to protect. That scope problem is still the most common gap he finds 30 years into doing this work. 

The agentic AI section is where the episode shifts from identity management into something more urgent. Jason describes a named autonomous attack from earlier this year that adjusted its behavior in real time based on the outcomes of its own actions. The defense implications are significant. But the internal risk he is more focused on is the one organizations are introducing themselves. Every AI agent deployed internally needs permissions to operate. Most organizations are overprovisioning those permissions without thinking through what happens if the agent is compromised. A sufficiently privileged AI agent is no longer just a non-human identity. It is an operational identity. Its compromise is not a credential problem. It is a business continuity problem.  

Real Talk 

If you cannot answer the question of what identities exist in your environment, who created them, why they were created, and when they were last used, you are not managing your attack surface. You are hoping nobody notices the gaps. Start the inventory. 

If your Microsoft 365 environment hasn’t been reviewed lately, let’s fix that before someone else does it for you. Visit www.SOCSoter.com