Senior Field and Partner Marketing Manager

Identity security: BeyondTrust CTO Marc Maiffret, live at RSAC 2026. Mon, March 30, 2026 at 2:56 PM PDT Watch the Fireside Below, or Click HERE: Tech Edge hosted a fireside chat on March 25 at RSA Conference 2026 in San Francisco with Marc Maiffret, Chief Technology Officer at BeyondTrust. The in-person interview was joined by Editor-in-Chief John Jannarone and they discussed the importance of identity security, how the company integrated AI and machine learning into the BeyondTrust Pathfinder Platform, the upcoming most significant technological breakthrough in cybersecurity, among other topics. About Marc Maiffret As Chief Technology Officer, Marc Maiffret is responsible for leading BeyondTrust's product strategy and leading the global engineering organizations to address market needs in intelligent identity and access security. Maiffret is a well-known entrepreneur and executive with over 20 years of experience in security leadership at organizations such as eEye Digital Security, FireEye, SpaceX, and BeyondTrust. Maiffret founded his first company shortly after being raided by the FBI at the age of 17. As a security researcher, Marc was an early pioneer in Microsoft vulnerability research, including co-discovering and naming Code Red, the first Microsoft computer worm. Marc has presented at numerous security conferences and has testified before Congress on matters of national security. As an entrepreneur, Marc helped design and build some of the first products for Vulnerability Management, Web Application Firewalling, Endpoint Security, and NetworkBased Malware Detection. Marc has written for numerous publications and is regularly sought after by media organizations to break down complex security topics. About BeyondTrust BeyondTrust is the global identity security leader protecting Paths to Privilege . Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders. BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.

RSAC 2026 proved the industry agrees on the problem - now comes the hard part. Published March 25, 2026 Agentic AI dominated RSAC 2026, but security leaders warn governance is lagging. Here's why discovery isn't enough - and where control must evolve. I spent RSAC 2026 doing what I do every year: walking the floor, talking to vendors, and - more importantly - listening to the security leaders who stopped by the Kiteworks booth. What struck me this year wasn't the volume of announcements. It was the consensus. Vendor after vendor, conversation after conversation, the same word kept surfacing: agents. * Cisco announced MCP policy enforcement and agent discovery. * CrowdStrike launched AI agent discovery across endpoints, SaaS, and cloud. * Palo Alto Networks introduced Prisma AIRS 3.0 to secure the full agentic AI lifecycle. * BeyondTrust rolled out endpoint privilege enforcement for AI coworkers. * The Cloud Security Alliance established an entirely new foundation - CSAI - with a stated mission of securing the agentic control plane. * Even Nvidia weighed in, explaining that its OpenShell runtime enforces constraints at the infrastructure level rather than at the model layer. The industry has arrived at a shared diagnosis. The question that kept coming up in our booth conversations was sharper: Where does governance actually belong? The floor confirmed what our research already showed. When we published the Kiteworks 2026 Data Security, Compliance & Risk Forecast Report last December, the headline finding felt almost too stark: 100% of organizations surveyed have agentic AI on their roadmap. Zero exceptions. Walking the RSAC floor, that number no longer surprises anyone. What surprised the people I spoke with were the numbers underneath it: * Sixty-three percent of organizations cannot enforce purpose limitations on their AI agents. * Sixty percent cannot terminate an agent that's misbehaving. * Fifty-five percent cannot isolate AI systems from their broader networks. These aren't obscure technical gaps - they're the basic containment controls that prevent an autonomous system from exceeding its authorized scope. And yet, 33% of organizations are already planning autonomous workflow agents that act without human approval, with another 24% building decision-making agents that will access sensitive data independently. That's the gap I kept hearing practitioners describe in different words at the booth: we can observe our agents, but we can't stop them. Our Forecast quantifies it as a 15-20 point gap between governance controls (monitoring, human-in-the-loop) and containment controls (purpose-binding, kill switches, network isolation). The industry has invested in watching. It hasn't invested in stopping. Discovery is necessary - it isn't sufficient. Several of the strongest RSAC announcements targeted the discovery problem. Astrix introduced four-method AI agent discovery. CrowdStrike extended shadow AI detection from endpoints to SaaS and cloud. Nudge Security announced AI agent discovery at the point of creation. Snyk launched Agent Security to surface shadow AI across development pipelines. BeyondTrust's Phantom Labs published research showing that most enterprises run shadow AI agents with privileged access invisible to security teams. This matters. You cannot govern what you cannot see. But discovery alone doesn't close the governance gap - it illuminates it. Our Forecast found that shadow AI ranks as a top-five security concern at 23%, yet few organizations have the discovery tools to even identify unauthorized usage. The vendors launching discovery capabilities at RSAC are addressing a real and urgent need. The question is what happens after discovery: once you find the agents, how do you enforce policy on the data they access? That's where the conversations at our booth got specific. CISOs weren't asking whether agents are a risk. They were asking how to govern what agents do with regulated data - across HIPAA, CMMC, PCI, SOX - without building a separate governance stack for every AI platform they adopt. Only 43% of organizations have a centralized AI data gateway today, according to our research. The remaining 57% are fragmented, partial, or flying blind. Several of the CISOs I spoke with described exactly that fragmentation: different controls for different AI tools, no unified audit trail, no way to produce evidence that satisfies an auditor. Audit trails: the infrastructure nobody talks about on stage. Here's something you won't find in the RSAC keynotes: 33% of organizations lack evidence-quality audit trails entirely, and 61% have fragmented logs scattered across disconnected systems. Our research consistently shows that audit trail quality is the single strongest predictor of AI governance maturity. Organizations without audit trails are half as likely to have AI training data recovery, 20 points behind on purpose binding, and 26 points behind on human-in-the-loop controls. The audit trail isn't a compliance artifact. It's the foundation on which the rest of the governance architecture is built. This is what I kept emphasizing at the booth: every AI agent interaction with regulated data needs to be authenticated, policy-governed, encrypted, and logged in a tamper-evident trail that feeds your SIEM - regardless of which model or agent framework is doing the asking. Regulators don't distinguish between a human analyst and an autonomous agent accessing protected health information or controlled unclassified information. The compliance obligation is identical. The evidence standard is identical. And 33% of organizations can't meet it today. The architectural bet: data layer, not model layer. The RSAC announcements revealed a strategic fork in the industry's approach to AI governance. Some vendors are securing at the model or runtime layer - through prompt filtering, agent sandboxing, and behavioral guardrails. Others, including Kiteworks, are enforcing governance at the data layer. Nvidia's description of OpenShell - applying security at the environment level rather than the model or application layer - signals that this architectural principle is gaining traction beyond our own positioning. Our bet is that data-layer governance will prove more durable. Model prompts can be bypassed. Agent runtimes will evolve. But data access controls - identity verification, ABAC policy enforcement, FIPS 140-3 encryption, and tamper-evident audit logging - operate independently of whatever model or framework is making the request. That's why Kiteworks Compliant AI enforces all four checkpoints at the data access layer via the open Model Context Protocol standard, ensuring governance remains consistent regardless of which AI platform an organization adopts today or migrates to tomorrow. The practitioners I spoke with at RSAC understand this intuitively. They're not looking for an AI security product for each AI tool. They're looking for a governed data layer that works across all of them. Third-party AI vendor data handling is the number-one security concern in our research at 30%, yet only 36% have visibility into how partners handle data in AI systems. When the AI platform changes - and it will - the governance must persist. That only works if governance lives at the data layer. What i'm taking home from san francisco. RSAC 2026 confirmed three things. First, the industry has reached consensus that agentic AI governance is an urgent, unsolved problem - the sheer density of agent-focused announcements from Cisco, CrowdStrike, Palo Alto, BeyondTrust, Wiz, and dozens of others makes that unmistakable. Second, discovery and runtime protection are outpacing the foundational infrastructure - audit trails, centralized gateways, and containment controls - that make governance enforceable and auditable. Third, the security leaders I talked with at the booth aren't waiting for the market to sort itself out. They're making architectural decisions now about how AI agents access regulated data, and those decisions will lock in governance models - or governance gaps - for years. The window is open. The question is whether your organization will govern the data before agents make decisions for you. Stay vigilant: the recent Crunchyroll breach shows how attackers exploited a third-party vendor to access millions of user records, reinforcing why supply chain security can't be overlooked. Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday Tim Freestone Tim Freestone, the chief strategy officer at Kiteworks, is a senior leader with more than 17 years of expertise in marketing leadership, brand strategy, and process and organizational optimization. Since joining Kiteworks in 2021, he has played a pivotal role in shaping the global landscape of content governance, compliance, and protection.

BeyondTrust has unveiled new capabilities in its Pathfinder Platform, claiming to offer the industry's first unified solution for securing AI agent identities across endpoints, cloud infrastructure and SaaS platforms. The platform addresses both AI coworkers operating alongside users and autonomous AI workloads executing at scale. The announcement comes as BeyondTrust Phantom Labs research reveals most enterprises run shadow AI agents with privileged access that security teams cannot monitor. The platform provides visibility into AI agent identities, privileges and secrets across platforms including OpenAI, AWS Bedrock, Salesforce Agentforce, ServiceNow and Google Vertex AI. BeyondTrust's CTO Marc Maiffret emphasised that organisations cannot secure agentic identities in isolation, noting these agents are interconnected with human identities, machine accounts and entitlements across environments. The company says machine and AI identities already outnumber human identities in many enterprises.