Sharing some exciting news! In case you missed it last week, C1.ai has signed a definitive agreement to be acquired by Workday.
This week's issue also covers our new integration with AWS IAM Account Access Manager, a new post on why AI agents need a trust model of their own, the two stories from this week in AI that security teams should be watching, and where to find us before the year ends.
C1.ai to Join Workday
On October 13, Workday announced that it has signed a definitive agreement to acquire C1.ai. Workday serves more than 11,500 organizations, including more than 65% of the Fortune 500.
In an announcement blog, our CEO and co-founder Alex Bovee wrote that every company now runs on a combined workforce of people and AI agents, and that identity governance belongs at the core of how that workforce is managed.
Microsoft told enterprises to treat AI agents as insider threats. On October 19, Microsoft introduced Guardian Agents, a feature of its Project Perception security system that monitors the agents a company runs, along with controls that narrow what an agent can reach as its assessed risk climbs. Microsoft Defender can now also detect up to 60 types of agents that employees bring to work on their own, including Claude Code and Codex. Microsoft Security executive vice president Hayete Gallot called the risk the "agentic insider," and the company's guidance is that security controls should sit outside the model rather than depend on trusting it. (TechCrunch, SiliconANGLE, Dataconomy)
One hacker used AI agents to break into more than 100 company websites for roughly $5,000. Cybersecurity researcher Snorre Fagerland watched a Chinese-speaking hacker set a mix of DeepSeek and Anthropic's Claude Code loose on targets that included Deere & Co. and SharkNinja, guided by instructions of fewer than 100 Chinese characters. Fagerland estimated the campaign cost about $5,000 in tokens, or about $50 per successful intrusion, and said it shows that commercially available agents can now carry out a complex intrusion from start to finish without human intervention. It is a stark reminder of why access for agents needs to be scoped, monitored, and revocable. (Star-Advertiser, The Hacker News, The Next Web)
C1.ai Integrates with AWS IAM Account Access Manager
AWS launched IAM Account Access Manager, a single place to assign IAM roles to Identity Center users and groups. C1.ai now integrates with it, so you can provision, review, and govern AWS access from one platform.
Just-in-time access: Time-bound AWS access, approved by a person or policy and revoked automatically when it expires.
Access reviews: AWS role assignments show up in the review campaigns you already run.
Detection: C1.ai flags AWS roles that are unowned, orphaned, or risky.
On The Non-Human & AI Identity Podcast, Alex Bovee said they're both, and that's what makes them so hard to secure.
Software is deterministic and trustable. Humans aren't deterministic, but they're trustable because they have a moral compass and a reputation to protect. Agents are neither deterministic nor trustable. Asked whether agents are going into production without security guardrails, Alex said: "100%."
His fix is a "digital background check." Scope each agent's mission and intent, then authorize every action against that scope at runtime. Nothing depends on trusting the agent.
Every team deploying AI agents eventually runs into the same question of how much autonomy an agent should have. Our co-founder and CEO Alex Bovee will dig into it on the "Giving agents more autonomy without losing control" panel at 12 PM ET, alongside AI leaders from The Mutual Group and LG Electronics. Catch the session, then find the C1.ai team at booth 10.
AWS re:Invent | November 30 – December 4 | Las Vegas
AWS re:Invent brings more than 60,000 attendees to Las Vegas for five days and more than 2,200 sessions on cloud and AI, which makes it a natural place to talk about governing AWS access for both people and agents now that C1.ai integrates with AWS IAM Account Access Manager.
Gartner Identity & Access Management Summit | December 7–9 | Caesars Forum, Las Vegas
More than 1,700 IAM leaders will gather at Caesars Forum for this year's summit, where governing AI agents, machine identities, and identity governance are among the featured topics.
.png?upscale=true&width=1116&upscale=true&name=Agentic%20Dispatch%20(C1.ai%20logo).png)
