"The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk" -

#1757983: "The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk" -

Description:	Frontier AI has changed the economics of attack. Chaining low-severity permissions across third-party applications used to take enough manual work that it often wasn’t worth an attacker’s time. AI makes that work cheaper, putting more pressure on the long tail of integrations, service accounts, OAuth grants, and AI agents that connect business applications to sensitive data. Across more than 50 enterprise deployments covering 1.2 million users, Obsidian tracked agent counts growing from under 500 in late 2024 to nearly 95,000 by February 2026. Thirty-eight percent had medium, high, or critical risk factors at deployment, including gaps in ownership and excessive access. Many were without a documented owner, and most had roughly ten times the access needed to carry out their workflows. Keeping up with that growth requires an ongoing understanding of how agents and applications connect and what they can access. New grants, deployments, and inherited permissions continually change those relationships. A point-in-time view in a vendor dashboard can help, but security teams also need that data available in their own environment to investigate and act on it. Obsidian Security and Databricks will discuss how continuously maintaining and governing third-party and agent access relationships alongside security and business data can support that work. See how access is inherited through OAuth grants, service accounts, and integrations, and why individual logs may not show the full path. Understand how maintaining access relationships in your own environment helps you investigate risk alongside your security and business data. Get five questions to ask about agent access before expanding your use of AI. Speakers: Scott Altman, Head of Solutions Engineering, Obsidian Security Scott Altman is Head of Solutions Engineering at Obsidian Security, bringing deep experience in SaaS security, cloud adoption, and IT compliance. He's spent his career helping security teams turn complex technical challenges into workable strategy. Dave Herrald, Global Cybersecurity GTM Leader, Databricks Dave Herrald is the Global Head of Cybersecurity Go-To-Market at Databricks. He is responsible for driving the adoption of the Databricks Data + AI Platform for Cybersecurity. Dave started his security career in the 1990’s working in a variety of roles including security analyst, engineer, architect, product security engineer, penetration tester, and CISO. Dave then transitioned into security roles with Fortinet, Splunk, and Google Cloud Security. Dave has been a frequent speaker and an active member of the security community throughout his career. Dave holds a B.S. degree in Computer Science from Iowa State University and holds many security certifications including the GIAC GSE (#73). Dave lives with his family near Denver, CO and enjoys woodworking, cycling, and skiing. Modertor: Terry Sweeney, Moderator - Contributing Editor, Dark Reading Terry Sweeney is a Los Angeles-based writer and editor who's covered business technology for three decades. He's written about cyber security for more than 15 years and was one of the founding editors of Dark Reading. Terry has covered enterprise networking extensively, as well as its supporting technologies like storage, wireless, cloud-based apps and the emerging Internet of Things. He's been a contributing editor to The Washington Post, Crain’s New York Business, Red Herring, Information Week, Network World, SearchAWS.com, and Stadium Tech Report.
More info:	https://dr-resources.darkreading.com/free/w_defa11966/

Description:

Frontier AI has changed the economics of attack. Chaining low-severity permissions across third-party applications used to take enough manual work that it often wasn’t worth an attacker’s time. AI makes that work cheaper, putting more pressure on the long tail of integrations, service accounts, OAuth grants, and AI agents that connect business applications to sensitive data.

Across more than 50 enterprise deployments covering 1.2 million users, Obsidian tracked agent counts growing from under 500 in late 2024 to nearly 95,000 by February 2026. Thirty-eight percent had medium, high, or critical risk factors at deployment, including gaps in ownership and excessive access. Many were without a documented owner, and most had roughly ten times the access needed to carry out their workflows.

Keeping up with that growth requires an ongoing understanding of how agents and applications connect and what they can access. New grants, deployments, and inherited permissions continually change those relationships. A point-in-time view in a vendor dashboard can help, but security teams also need that data available in their own environment to investigate and act on it. Obsidian Security and Databricks will discuss how continuously maintaining and governing third-party and agent access relationships alongside security and business data can support that work.

See how access is inherited through OAuth grants, service accounts, and integrations, and why individual logs may not show the full path.
Understand how maintaining access relationships in your own environment helps you investigate risk alongside your security and business data.
Get five questions to ask about agent access before expanding your use of AI.

Speakers:
Scott Altman, Head of Solutions Engineering, Obsidian Security
Scott Altman is Head of Solutions Engineering at Obsidian Security, bringing deep experience in SaaS security, cloud adoption, and IT compliance. He's spent his career helping security teams turn complex technical challenges into workable strategy.

Dave Herrald, Global Cybersecurity GTM Leader, Databricks
Dave Herrald is the Global Head of Cybersecurity Go-To-Market at Databricks. He is responsible for driving the adoption of the Databricks Data + AI Platform for Cybersecurity. Dave started his security career in the 1990’s working in a variety of roles including security analyst, engineer, architect, product security engineer, penetration tester, and CISO. Dave then transitioned into security roles with Fortinet, Splunk, and Google Cloud Security. Dave has been a frequent speaker and an active member of the security community throughout his career. Dave holds a B.S. degree in Computer Science from Iowa State University and holds many security certifications including the GIAC GSE (#73). Dave lives with his family near Denver, CO and enjoys woodworking, cycling, and skiing.

Modertor:
Terry Sweeney, Moderator - Contributing Editor, Dark Reading
Terry Sweeney is a Los Angeles-based writer and editor who's covered business technology for three decades. He's written about cyber security for more than 15 years and was one of the founding editors of Dark Reading. Terry has covered enterprise networking extensively, as well as its supporting technologies like storage, wireless, cloud-based apps and the emerging Internet of Things. He's been a contributing editor to The Washington Post, Crain’s New York Business, Red Herring, Information Week, Network World, SearchAWS.com, and Stadium Tech Report.

More info:

https://dr-resources.darkreading.com/free/w_defa11966/

Date added	Oct. 17, 2026, 6:04 a.m.
Source	Dark Reading
Subjects	AI/ML - Artificial Intelligence / Machine Learning / GenAI / Artificial General Intelligence - AGI - Various Insider Threats / Third Party / Third-Party / 3rd Party Risks / Managed Service Provider (MSP) PodCasts / Webcast / Webinar / eSummit / Virtual Event etc.
Venue	Nov. 4, 2026, midnight - Nov. 4, 2026, midnight