“Implement access logging, least-privileged principles, and monitoring for unusual queries against HR systems.”

“We need to focus on that person's access… it goes to least privilege… just-in-time access… so the agent doesn’t overextend its reach”

“Most of the off-the-shelf systems are not customizable ... you have to write a query ... you want a system for your business ... you need to consider a system you can customize”

“There are these things called chain of thought… it’s a way of monitoring the systems… if you’re monitoring, they would have stopped it.”

“An agent identity needs to be treated as a first-class identity… it needs to have least privilege… just-in-time access… a complete record of everything privileged.”