The Identity Blueprint

Send us Fan Mail

The rapid enterprise adoption of Large Language Model (LLM) agents has driven engineering teams toward the open Model Context Protocol (MCP) to standardize context sharing and tool invocation between generative artificial intelligence clients and backend systems. Operating over JSON-RPC 2.0 messaging, the protocol allows autonomous models to dynamically discover data resources and execute local or remote tools directly. However, because the specification provides no native cryptographic authentication or centralized access control plane at the base protocol layer, these connections routinely bypass enterprise API gateways and perimeter defenses. The resulting architectural gap creates an invisible attack surface: unmanaged shadow MCP servers operating across developer workstations and cloud infrastructure, directly exposed to indirect prompt injection and unauthorized execution.

In this episode of Season 3: Identity Threat & Defense, Principal Identity Architect Ernie Prescott deconstructs the architectural flaw of exposing raw Model Context Protocol endpoints to autonomous agents without centralized mediation. Prescott examines the operational breakdown that occurs when foundational protocol methods—such as capability discovery (tools/list) and tool invocation (tools/call)—are hijacked via untrusted prompt inputs to trigger arbitrary execution and exfiltrate enterprise data. He details the forensic blind spots that arise when agent tools communicate over uninspected encrypted tunnels, preventing security operations teams from auditing which capabilities are exposed, what parameters are passed, and whether requests originate from authorized actors.

Re-establishing Zero Trust boundaries across generative AI workflows requires migrating away from point-to-point connections to mediated architectures powered by Enterprise Agent Gateways and protocol-aware network filtering. Prescott presents the target enterprise blueprint: intercepting JSON-RPC transactions at dedicated security enforcement points, binding scoped OAuth 2.0 client assertions to tool endpoints, and performing deep packet payload validation to enforce runtime authorization and prevent prompt-driven data theft.

In this episode, we unpack:

• JSON-RPC 2.0 Execution Primitives and Injection Vectors: How foundational Model Context Protocol methods—including initialization handshakes, resource reads, and tool calls—expose arbitrary execution paths to language models. Prescott explains how indirect prompt injection exploits unvalidated tool parameters to exfiltrate private training data and intellectual property.
• Shadow MCP Server Discovery and Protocol-Level Inspection: Why traditional cloud access security brokers and web application firewalls fail to recognize agent traffic, and how deep packet inspection identifies MCP operations over encrypted Transport Layer Security tunnels. Prescott examines how network-level logging surfaces unmanaged remote servers and catalogs exposed tool capabilities across the enterprise.
• Enterprise Agent Gateways and OAuth 2.0 Enforcement: The architectural deployment of dedicated reverse proxies and protection filters that sit between AI clients and backend MCP servers. Prescott details how gateways validate caller identity, bind scoped OAuth 2.0 access tokens to specific tool endpoints, and block unauthenticated JSON-RPC requests before backend tools are reached.
• Dual-Context Telemetry and Dynamic Schema Filtering: Mitigating payload tampering by enforcing strict schema validation filters on all incoming JSON-RPC messages and blocking undocumented method calls. Prescott breaks down the implementation of dual-context audit logs that record cryptographic attribution for both the invoking agent client and the authorizing human user for every sensitive operation.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

While enterprise security programs invest millions into phishing-resistant passkeys and multi-factor authentication for employees, threat actors have pivoted to the true path of least resistance: unmanaged non-human identities. Machines do not fall for deceptive emails, but their static passwords, unrotated API tokens, and sweeping standing privileges offer adversaries silent, persistent, and unmonitored access across modern environments.

In this episode of The Non-Human Identity Blueprint, Principal Identity Architect Ernie Prescott conducts a technical breach autopsy on the five primary attack vectors adversaries use to compromise machine credentials and move laterally across on-premises, multi-cloud, and agentic estates. Moving beyond theoretical risk, we dissect the active telemetry, forensic artifacts, and protocol vulnerabilities that turn background automation into an attacker's primary highway.

In this episode, we unpack:

• The Kerberoasting Autopsy: How any authenticated domain account can request Service Principal Name tickets encrypted with legacy RC4 ciphers, extract them to high-powered cracking rigs, and recover plain-text service passwords completely offline without triggering security operations center alarms.
• Deployment Pipeline Token Theft: How compromised build runners and unmasked environment variables in Continuous Integration and Continuous Delivery systems expose long-lived cloud administrative credentials.
• Third-Party OAuth Exploitation: A post-mortem on campaigns like UNC6395, detailing how over-scoped API permissions and compromised vendor access tokens enable attackers to bypass tenant perimeters and exfiltrate sensitive cloud data.
• Autonomous AI Agent Hijacking: How autonomous agents operating with shared service accounts or standing privileges can be manipulated through indirect prompt injection to execute unauthorized tool commands and exfiltrate enterprise records.
• Unconstrained Delegation and Attribute Manipulation: The structural danger of legacy Kerberos ticket forwarding and directory attribute tampering that allows an adversary on a low-tier web server to achieve full domain dominance.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

Modern enterprise security perimeters face an unsustainable operational imbalance: non-human identities now outnumber human employees by more than one hundred to one, with automated pipelines, machine workloads, and autonomous artificial intelligence agents executing the overwhelming majority of cloud operations. Despite this shift, enterprise identity governance remains rigidly anchored to legacy Human Resources onboarding processes and static directory accounts. When engineering teams assign traditional service principals or repurpose interactive human user accounts to power autonomous software agents, they trigger critical security failures: standing administrative access, absent governance lifecycles, and blind spots across Zero Trust telemetry controls.

In this episode of Season 3: Identity Threat & Defense, Principal Identity Architect Ernie Prescott deconstructs the architectural flaw of forcing autonomous and interactive artificial intelligence agents into legacy identity constructs. Prescott analyzes the forensic and governance breakdown that occurs when organizations treat nondeterministic agents as standard batch jobs—granting permanent credentials without cryptographic attestation, granular delegation, or runtime context. Through technical analysis, he details how unmonitored agent interactions collapse traditional authorization boundaries and expose sensitive enterprise data planes to indirect exploitation and lateral movement.

Resolving this identity challenge requires transitioning to an agent-aware identity plane governed by dedicated blueprints, short-lived tokens, and cryptographically verified runtime contexts. Prescott outlines the target enterprise framework: decoupling technical configuration from business accountability, applying attribute-driven policy enforcement, and replacing static secrets with ephemeral OAuth 2.0 delegation.

In this episode, we unpack:

• Agent Identity Blueprints vs. Traditional Service Principals: Why static service principals and human user accounts fail to govern artificial intelligence workloads, degrading identity risk detections and leaving systems without auditable lifecycle controls. Prescott details the hierarchical blueprint architecture that provisions individual agent identities while centralizing credential and policy management.
• OAuth 2.0 Delegation and On-Behalf-Of Execution: The cryptographic mechanics of separating interactive agents operating via delegated On-Behalf-Of authentication flows from autonomous agents executing via the OAuth 2.0 client credentials grant. Prescott breaks down how scoped delegation prevents full account impersonation and preserves caller identity context across distributed microservices.
• The Three-Tier Administrative Accountability Model: Decoupling operational maintenance from compliance governance by assigning technical Owners, business Sponsors, and operational Managers to every agent construct. Prescott examines how automated Lifecycle Workflows eliminate orphaned agents by automatically cascading governance authority to an executive manager when a sponsor departs the organization.
• Attribute-Driven Conditional Access and Sidecar Isolation: Enforcing Custom Security Attributes to dynamically apply Zero Trust access boundaries across expanding agent deployments without manual policy sprawl. Prescott explains how containerized authentication sidecar SDKs offload token acquisition, validation, and secret isolation directly at the workload boundary.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

The modern enterprise runs on a massive, invisible workforce that outnumbers human employees by up to 100 to 1—yet not a single one has an HR record.

In the season premiere of The Non-Human Identity Blueprint, Principal Identity Architect Ernie Prescott breaks down why traditional workforce Identity Governance and Administration (IGA) platforms fail when confronted with service accounts, API keys, cloud workloads, and autonomous AI agents. When identity lifecycles rely exclusively on employee onboarding and offboarding triggers, machine credentials accumulate as unmanaged, permanent technical debt.

We dismantle the dangerous assumption that deploying a secrets vault solves machine identity security and establish the foundational architecture required to bring every automated identity under strict governance.

In this episode, we unpack:

• The 100:1 Ratio Shift: Why machine identities have exploded across hybrid environments and how static credentials quietly bypass perimeter firewalls and MFA.
• The HR Lifecycle Breakdown: Why Joiner-Mover-Leaver (JML) automation breaks when managing workloads that have no employee IDs, managers, or termination dates.
• The 6 Machine Identity Classes: A technical taxonomy categorizing local service accounts, database logins, cloud service principals, API tokens, RPA bots, and autonomous AI agents.
• The Core Architectural Thesis: Why vaulting 50,000 legacy service accounts without lifecycle governance merely automates secrets rotation for accounts that should not exist in the first place.
• The Interlocking Dual-Track Strategy: How to synchronize continuous governance authority (the "Brain") with platform-native credential modernization (the "Engine").

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

A serverless branch office isn't a leap of faith — every service running on that local server, printing, DHCP, DNS, provisioning, even the conference room, has a specific cloud-native replacement. This episode is the full replacement list, plus an honest, unflinching answer to the question nobody wants to answer: what actually breaks when the internet goes down.

In this episode, Ernie and Josée walk through the full replacement list, service by service. Universal Print eliminates the local print server entirely, replacing driver management and access control with Pull Print, so a job follows the user's identity to any registered printer, not a fixed desk down the hall. 🖨️ DHCP moves to the edge router's built-in server, centrally managed across every site from one console, and DNS splits cleanly: public traffic routed through a Secure Web Gateway that blocks known-malicious domains before a connection is even attempted, internal traffic resolved through Entra Private Access. 🌐

Workstation provisioning shifts from a 20-gigabyte golden image and a local imaging depot to Windows Autopilot — a factory-sealed laptop that self-provisions the moment it connects to any internet connection, backed by a small on-site spare pool for the rare catastrophic hardware failure. 💻 And the conference room, historically the most overlooked vulnerability in the building, gets joined directly to Entra ID and locked down with conditional access policies that make a stolen service account password functionally useless outside that specific physical room. 🚪

We close with the network architecture that ties it all together — direct internet breakout via dual-transport SD-WAN instead of expensive MPLS backhaul — and the same business clocks from the last episode that let this migration fund itself. 📶 Then we take the hardest objection head-on: what genuinely breaks during a total internet outage, and why that honest risk is still smaller than the one sitting in a poorly ventilated closet today. ⚠️

You'll leave knowing exactly what replaces every service running on a legacy branch server, and how to answer the outage objection honestly instead of dodging it.

If you're the one planning a branch office rollout or retirement, this episode is not optional. ✅

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

Most organizations think keeping Active Directory around is the cheaper, safer option. It's actually the more expensive one — they're paying for two identity systems at once, and only using one of them. 💸

In this episode, Ernie and Josée make the financial and risk case for retiring on-prem Active Directory. We unpack the "stranded capital" problem: organizations already licensed for Entra ID P1 or P2 are paying for conditional access, risk-based identity protection, and Privileged Identity Management, while simultaneously pouring money into patching, backups, and disaster recovery for dozens or hundreds of branch domain controllers that block those very features from working. 🔒

We look at why the risk case is just as stark — over 78% of ransomware intrusions involve a breached domain controller, with a median time-to-compromise of 3.4 hours, because Active Directory replicates malicious changes exactly as faithfully as it replicates legitimate ones. ⚠️

Then we walk through the actual playbook: the six-rule cloud-first policy that stops new AD dependencies from being created, and the three-phase attrition model that lets the existing environment migrate itself using business clocks you're already funding, rather than a disruptive, unbudgeted rip-and-replace. 📋

You'll leave knowing exactly how to build the financial case for retiring Active Directory, using real ransomware and outage figures a CFO or cyber insurance underwriter will actually respond to. 📊

If you're the one building the business case for this migration, this episode is not optional. ✅

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

You can migrate every user to the cloud and retire every workload, and Active Directory still won't go away — because two systems, your certificate authority and Exchange Hybrid, are quietly holding the domain controller hostage. 🔐

In this episode, Ernie and Josée trace exactly how a low-privilege foothold — a phished user, an exposed ethernet jack — escalates into full domain compromise using nothing but native Windows features: coercing a domain controller into an NTLM handshake, relaying it to the certificate authority's web enrollment endpoint, and walking away with a certificate that mints a valid Ticket Granting Ticket. No custom exploit required. 🕵️

We map the invisible web of trust holding that certificate authority in place — 802.1X Wi-Fi, VPN client authentication, smart card login, internal TLS — and why a hard shutdown doesn't produce a clean failure, it produces weeks of cascading outages that look nothing like a certificate problem. 🌐

We debunk the "cloud mirage" assumption that Entra ID or Microsoft Cloud PKE can simply replace it, walk through the third-party platforms that actually bridge the gap, and cover the physical hardware problem post-quantum certificate sizes create for legacy network buffers. ⚛️

Then we turn to Exchange Hybrid's zombie server trap — a fully patched, fully vulnerable on-prem server whose only remaining job is editing text fields in a database — and the exact sequence that finally lets you retire it. 📧

You'll leave knowing exactly why these two systems block full Active Directory removal, and the precise migration sequence that finally lets you shut the domain controller down for good.

If you're the one deciding when Active Directory can finally be retired, this episode is not optional. ✅

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

Why is DNS the silent killer you don't see coming? Because the applications that kill your migration never touched DNS in the first place — so there's nothing in the logs to warn you. The error message will say "database unreachable." Your team will spend four hours on the SQL cluster. The actual problem died the second you turned off a domain controller nobody knew was still load-bearing.

In this episode, Ernie and Josée start with the choice that shapes everything downstream: password hash sync versus pass-through authentication. One turns your password into an irreversible mathematical hash that lets your cloud apps keep running even if your entire data center goes dark. The other keeps validation strictly on-premises — a real compliance requirement in some industries, but one that creates a hard single point of failure. Then we go after the actual silent killer: legacy applications hard-coded to a domain controller's raw IP address, bypassing DNS entirely, so the moment that server finally goes offline, the failure looks like anything except what it actually is. We walk through why checking DNS logs gives you a false sense of safety, and the real discovery method — packet captures and raw network traffic analysis — that finds every hidden dependency before you ever pull the plug.

You'll leave knowing exactly which authentication model fits your organization, and how to find the hard-coded dependencies that could sink your entire decommissioning project.

If you're planning to power off your last domain controller, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

Ask to move one workload slider to Intune — just the Wi-Fi policy — and Microsoft silently drags your entire antivirus and BitLocker management along with it, whether you're ready or not. This episode is what actually breaks when you migrate off Group Policy, and why some of it isn't optional.

In this episode, Ernie and Josée trace why there's no cloud version of SYSVOL — the file share every Group Policy Object depends on — and why Microsoft never built one on purpose: the protocol itself can't survive being run across the public internet at global scale. We walk the actual mechanics of Intune's replacement architecture, the brutal translation gap that trips up admins moving legacy GPOs over (a hard 4-megabyte size limit, English-only text, and WMI filters that fail to translate at all), and the hidden dependencies buried inside co-management's workload sliders — including the one that silently forces three separate workloads to move together whether an admin intended that or not. We close with the exact endpoint logs administrators actually check to prove a transition worked, instead of trusting a cloud portal that can lag behind reality.

You'll leave knowing exactly what breaks first when you cut the cord to on-prem Active Directory, and the specific traps that catch even experienced admins off guard.

If you're the one planning a Group Policy migration, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Send us Fan Mail

Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead.

In this episode, Ernie and Josée trace why active defense is physically impossible in industrial environments — endpoint agents introduce latency that can throw a chemical process out of tolerance, and standard vulnerability scanners can crash a legacy controller's network interface outright. With detection off the table, the only real option is passive visibility and rigid isolation instead. We walk through the 40-tenant silo model: completely separate identity environments per facility, with zero trust relationships between them, connected back to headquarters only through outbound-only sync agents so a compromise in one facility can never become a master key into the rest. We close on the hardest tension in the entire model — how to keep zero standing privilege everywhere, while still guaranteeing an engineer can act immediately during a 2 a.m. physical emergency.

You'll leave knowing exactly why IT security instincts fail in industrial environments, and the architecture that actually holds up in their place.

If you're responsible for identity in an OT or critical infrastructure environment, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott