Don’t Make It Easy: Password Security, Privilege, and Resilience in the Age of AI

What happens after a password is stolen?

Imagine your password is stolen tonight.

You didn't choose a weak one, and you didn't reuse it. You did everything right. What you got was a message that seemed to come from someone you knew. The writing was flawless. It knew where you worked, what your role was, maybe even what you'd been working on last week. So you clicked, and somewhere in the background someone captured your credentials.

What happens next?

That question is at the heart of this October. Cybersecurity Awareness Month in the US and European Cybersecurity Month across the EU exist for a serious reason. 

Almost every major breach I've seen in more than three decades in this field involved a human moment somewhere: a click, a reused password, an approved prompt, a misplaced trust. Password security still matters, but the bigger question is what happens after a password is compromised.

The real test is whether one stolen credential is enough to cause serious damage, and how quickly you can recover if it is.

This year's campaign theme is Don't make it easy for them. 

CISA's Secure Our World guidance gives everyone four practical steps: recognize and report phishing, use strong passwords, turn on multifactor authentication, and keep software updated. 

Alongside those steps, CISA asks organizations, especially critical infrastructure operators, to practice the 3Rs: Reduce, Replace, and Recover. 

I'll walk through both, with an eye on what has changed most since last October: AI.

Attackers don't break in. They log in.

AI hasn't fundamentally changed what attackers want. It has changed how quickly and convincingly they can get there. Reconnaissance that once took an attacker a week — researching employees, mapping technologies, writing and translating convincing lures — can now take minutes. The same is increasingly true for analyzing newly disclosed vulnerabilities and developing ways to exploit them.

Most of those attacks still end in the same place: identity. The attacker's goal is to become someone, or something, the organization already trusts. Once they hold a valid credential, the application sees a correct username, a correct password, and a legitimate-looking session. If that credential belongs to an administrator, they may now hold the keys to much of the business.

That's why password security isn't really about passwords. It's about what the password unlocks.

For Individuals: Four Ways to Protect Yourself Online

1. Recognize and report phishing

For years we taught people to spot typos, bad grammar and generic greetings. AI has erased many of those traditional warning signs. A phishing message can now sound completely professional, mimic a colleague's tone, and arrive in convincing Estonian, Portuguese, or Japanese. Voice and video deepfakes extend the same trick to calls and meetings.

So the advice has to change from "spot the typo" to "verify the request." If a message creates urgency, asks for credentials, changes payment details, or pushes you outside normal process, slow down and confirm it through a channel you already trust. Then report it. A reported phish protects the next person it targets.

2. Use long, unique passwords and a password manager

We've spent decades asking human memory to solve a problem it was never built for, so people improvise. They reuse passwords, add a number at the end, or turn Summer2025! into Summer2026!. That isn't simply carelessness. It's a design failure.

CISA recommends passwords that are long, random, and unique, at least 16 characters, with a password manager to generate and store them. Once technology does the remembering, every account gets its own credential. A breach at a company you've never thought about stays their breach instead of becoming yours. One breach stays one breach.

3. Turn on multifactor authentication

Now assume the attacker has your password anyway. With MFA, the password alone isn't enough. Turn it on wherever it's offered and choose the strongest option available.

Not all MFAs are equal. Codes and push notifications improve security, but phishing-resistant methods such as passkeys and hardware security keys remove many of the tricks attackers use to steal or relay authentication factors. And attackers have adapted to MFA. They bombard users with prompts until someone approves, use adversary-in-the-middle techniques that can steal sessions, and socially engineer help desks and account recovery processes.

So teach people what a prompt actually means. Approving one says, "Yes, this is me." If you didn't start the login, deny it and report it. An unexpected MFA request isn't just an annoyance. It may be your first warning that someone already has your password.

4. Update your software

This is the least glamorous step and one of the most effective. Attackers who can't steal a credential look for a vulnerability instead, and AI is shrinking the time defenders have between disclosure and exploitation. Turn on automatic updates for operating systems, browsers, apps, and devices, and install important updates promptly. Every patch closes a door.

These four steps make individuals far harder targets. Inside an enterprise, the problem gets much bigger, because credentials, privileges, and systems are everywhere.

For Organizations: Reduce, Replace and Recover

CISA wrote the 3Rs with critical infrastructure in mind, but the logic applies to any organization running a complex environment: Reduce what attackers can reach. Replace what can no longer be defended. Recover quickly when something gets through.

I'd add one lens that ties them together: when attackers log in rather than break in, your identities are your attack surface.

AI Agents Are Expanding the Identity Attack Surface

AI is adding a new category of identity to enterprise environments, and it’s growing fast. We're moving from AI that answers questions to agents that act. Agents query databases, call APIs, change cloud infrastructure, deploy code, trigger other workflows, and communicate with other agents. Every action we let an agent take is authority we've granted, and that authority is an attack surface.

So the first question is: who is the agent? Every AI agent that can take action should have its own identity, with an accountable owner, explicitly scoped permissions, and credentials that can be revoked immediately.

Not every agent should be governed the same way. A short-lived task agent may need an ephemeral, just-in-time identity that exists only for the task and disappears when the task ends. A persistent agent that runs continuously needs full lifecycle management like any other machine identity: provisioning, credential rotation, access review, monitoring, and decommissioning.

An agent won't pull a phone out of its pocket to approve a push notification, but the principle behind MFA still holds: never trust a single credential indefinitely. Scope permissions tightly, apply least privilege, require additional authorization for high-risk actions, and keep privilege temporary.

AI also forces us to separate two ideas we've often blurred. Authentication proves who an identity is. Authorization decides what it may do. With AI agents, there's a third question: does the authority match the task? An agent that reads a database doesn't need to be able to delete it. An agent that analyzes a configuration doesn't automatically need the authority to change it. The ability to perform a task shouldn't grant the authority to execute every action that follows from it, and as agents become more autonomous, that distinction becomes the one that matters most.

That makes the 3Rs increasingly important for identity security, too.

Reduce: Shrink the Identity Attack Surface

Patching and removing exposed vulnerabilities are the foundation of reducing attack surface. But ask almost any established organization a simple question, "How many privileged credentials do you have?", and you'll rarely get a simple answer.

There are administrator and contractor accounts, service and application accounts, database credentials, API keys, cloud roles, and certificates. There are secrets embedded in scripts and credentials created for projects that ended years ago. Some are shared, some have no owner, and some haven't been rotated since the day they were created. You can't protect a credential you don't know exists.

Reducing the identity attack surface means three things. Discover privileged accounts and secrets wherever they live. Remove what nobody needs. And eliminate unnecessary standing privilege through just-in-time access and Zero Standing Privilege principles. If someone needs elevated access for twenty minutes, why do they have it twenty-four hours a day?

Replace: Retire What Can No Longer Be Defended

Unsupported software, firmware, and hardware eventually become security liabilities, because vulnerabilities remain with no supported path to remediation. Legacy systems also bring legacy identity problems: hardcoded passwords, default credentials, and shared administrator accounts that can't easily be changed or monitored.

I'd extend Replace to the practices we've outgrown:

• Replace shared privileged accounts with individual, accountable identities, and don't recreate the problem by giving several AI agents one powerful shared credential.
• Replace passwords in spreadsheets, scripts, and documents with a vault that protects and rotates them automatically.
• Replace permanent administrator rights with just-in-time access wherever possible.
• Replace weaker authentication with phishing-resistant methods, starting with your most privileged users.

The strongest privileged password is the one nobody needs to know. The question then shifts from "Did this identity authenticate?" to the questions that really matter. Who is asking, for what and why? For how long? What are they doing with it? Can you revoke it right now? That model has to cover people, machines and, increasingly, AI agents.

Recover: Assume Something Will Get Through

Even good controls eventually fail. A password is compromised, a vulnerability is exploited, a supplier is breached, or an agent does something nobody expected. When that happens, two questions matter: how quickly will you know, and how quickly can you recover?

Monitor with identity in mind. Picture thousands of failed logins followed by one success, a privileged account signing in from somewhere unusual, or an AI agent touching a system it has never accessed before. Would anyone notice? When an attacker uses a valid credential, the login can look normal. So record authentication and administrative activity, monitor privileged sessions, and make non-human identities as visible as people. If an agent changes a configuration at 2:13 a.m., you should be able to say what changed, which identity did it, and why.

Back up what matters, and test it. Isolate backups from production and from everyday administrative credentials, and restore from them regularly. A backup that has never been restored is just an assumption, and the middle of a ransomware incident is the wrong time to discover that nobody knows the backup administrator password.

Plan for identity recovery too. What happens if your identity provider or privileged access infrastructure is compromised? Can administrators still reach critical systems safely? Maintain protected break-glass procedures, know how to revoke active sessions at scale, and practice rotating privileged credentials, API keys, and machine secrets quickly. If identity is part of the attack surface, it has to be part of the recovery plan.

Encrypt sensitive data at rest and in transit. Authentication controls who gets through the door. Encryption protects the data when it's stored or moving between systems. Neither replaces the need to control what an authenticated identity can actually do.

Practice your response. Run tabletop exercises on a compromised administrator account, a stolen MFA session, an identity provider outage, ransomware, and an AI agent taking unauthorized actions. Who disables the account? Who revokes sessions and rotates credentials? Who briefs leadership and customers? Who decides when systems are safe to bring back?

Then push further. What if email disappears, or administrators can't authenticate? What if every privileged credential has to be rotated at once, or an AI agent has taken actions across dozens of systems before anyone realizes something is wrong? Can the business keep running? That answer is the difference between cybersecurity and cyber resilience.

Report incidents to CISA or your national cybersecurity authority. One organization's incident can be another's early warning.

How Identity Security Changes the Outcome

Now go back to the opening scenario: your password is stolen tonight.

In one version of the story, the stolen password is all the attacker needs. It opens your email, and because you reused it, three other accounts as well. If you're an administrator, it opens the organization. A forgotten service account and an unpatched server give the attacker somewhere to go next. By morning, the first sign of trouble is a ransom note, and nobody is sure the backups work.

In the other version, the story ends almost as soon as it begins. The password unlocks nothing else. An MFA prompt you didn't expect arrives, and you deny it and report it. Had the attacker gotten further, they'd have found patched systems, no unnecessary standing admin rights, credentials that had already rotated, and AI agents holding only the access their tasks required. The unusual login lit up in the logs. 

The team knew who to call because they'd practiced this exact scenario, and the backups had been tested last month. Even if the identity infrastructure itself had been hit, the team already knew how to regain trusted administrative access.

Same attack. Same stolen password. Two very different outcomes.

The difference isn't one perfect control. It's layers: four practical steps for everyone, and Reduce, Replace, and Recover for every organization.

That's the challenge we're focused on at Segura™: protecting privileged credentials, reducing standing privilege, and making it clear who, or what, is accessing critical systems, what authority they have, and why they have it.

We should all assume that someday someone will get a password. The real measure of security is how little a stolen password can unlock.

This Cybersecurity Awareness Month, don't make it easy for them.

Don't just make your passwords stronger. Make them insufficient.