Technology changes every day. Principles don’t.
August 2026 Episode…
The Locksmith (Why Identity Is the New Front Door)
There was a time when securing a business was relatively straightforward.
At the end of the day, someone walked through the building.
The windows were checked. The lights were turned off. The doors were locked.
And somewhere, someone had the keys.
Maybe it was the owner. Maybe the building manager. Or, maybe a trusted employee who had been there for twenty years.
The important thing was that everyone knew who had them. Or at least they thought they did.
Because the locksmith understood something long before cybersecurity existed…
The strength of the lock doesn’t matter very much if you don’t control the keys.
Today, businesses have some of the most sophisticated locks ever created.
Firewalls.
Endpoint protection.
Encryption.
Cloud security.
Zero Trust architectures.
Artificial intelligence.
Twenty-four-hour Security Operations Centers.
And yet, attackers increasingly don’t bother breaking down the door.
They simply log in.
Somehow, they got a key.
The Key Has Changed
The old brass key was simple.
It opened a door.
Today’s digital keys open considerably more.
A username and password might provide access to email.
That email account might provide access to password resets.
Those password resets might provide access to applications.
Those applications might provide access to customer information.
And somewhere along the way, that single identity may have quietly become the key to the entire business.
The modern key isn’t hanging from someone’s belt.
It’s an identity.
And identities have become extraordinarily valuable.
Cybercriminals understand this.
Why spend weeks attempting to penetrate sophisticated defenses when you can convince someone to hand you the keys?
That is the premise behind phishing.
Credential theft.
MFA fatigue attacks.
Session hijacking.
Social engineering.
Business email compromise.
The attacker’s favorite password is no longer the one they crack.
It’s the one you willingly give them.
The Locksmith Had a Rule
A good locksmith didn’t hand everyone a master key.
The receptionist didn’t need access to the boiler room.
The delivery driver didn’t need the key to the accounting office.
The cleaning company might need access to the building—but only at certain times.
And the employee leaving the company on Friday?
Someone collected the keys.
Simple… Logical… Obvious.
Yet somehow, when businesses became digital, we occasionally forgot how keys work.
Employees accumulate access over years.
They change departments.
They get promoted.
They join projects.
Temporary permissions become permanent.
Contractors finish assignments.
Vendors change.
Applications get replaced.
People leave.
But the digital keys remain.
One permission at a time.
One group membership at a time.
One application at a time.
Until eventually, nobody is entirely sure who can open what.
The locksmith would probably be horrified.
Everyone Has a Master Key
Imagine walking into a locksmith and saying:
“I need fifty copies of the master key.”
The locksmith would probably shake his head and ask, “Why?”
In technology, we call it administrator access.
And for years, the easiest solution to an access problem was often:
“Just make them an admin.”
Application won’t run?
Admin.
Can’t install something?
Admin.
Need access to a server?
Admin.
Troubleshooting an issue?
Admin.
Eventually, organizations end up with something no locksmith would ever recommend:
A surprising number of master keys.
The cybersecurity industry has a name for the solution.
Least privilege.
The locksmith had another name for it.
Common sense.
Give people the keys they need.
Nothing more.
Nothing less.
“But I Know Him”
Trust has always been complicated.
Someone knocks on the door.
You recognize them.
You let them in.
That’s how humans work.
But what happens when the person standing at the digital door only looks familiar?
A familiar email address.
A familiar name.
A familiar voice.
Maybe even a familiar face on a video call.
Artificial intelligence has made impersonation dramatically easier.
Deepfake audio.
Synthetic video.
AI-generated phishing.
Highly personalized social engineering.
The old question was:
“Do I recognize this person?”
The modern question is:
“Can I verify this person?”
That’s a very different question.
And it sits at the heart of modern cybersecurity.
Trust is no longer enough.
Trust must be verified.
The Spare Key Under the Mat
Every house had one.
Under the flowerpot.
Inside the fake rock.
Above the doorframe.
Everyone thought their hiding place was clever.
Until everyone started using the same hiding places.
Businesses have digital versions too.
Shared passwords.
Generic accounts.
Credentials stored in spreadsheets.
Service accounts nobody remembers creating.
Passwords embedded in scripts.
Accounts configured years ago that quietly became critical infrastructure.
These are the digital keys under the flowerpot.
They work.
They’re convenient.
And eventually, someone else discovers where they’re hidden.
Modern password managers, privileged access management, secrets vaults, and managed identities aren’t simply new security products.
They’re better places to keep the keys.
The Problem With Copying Keys
Physical keys had an interesting property.
Once you gave someone a copy, you lost control over it.
They could make another copy.
And another.
You might eventually change the lock.
Digital credentials have the same problem.
Passwords get reused.
Shared… Stored… Cached… Synchronized… Saved in browsers… Entered into compromised systems.
And increasingly, attackers don’t even need the password.
Session tokens and authentication cookies can sometimes allow an attacker to walk through the digital front door after the legitimate user has already unlocked it.
From the system’s perspective, the attacker isn’t breaking in, they’re already authenticated.
The door thinks they belong.
This is why modern security increasingly focuses not just on authentication—but continuous verification.
Getting through the front door once shouldn’t mean every door inside the building automatically opens.
Zero Trust Isn’t Really New
The technology industry loves new terminology.
One of today’s biggest concepts is Zero Trust.
The idea is simple:
Never trust.
Always verify.
Assume breach.
Limit access.
Continuously evaluate.
It sounds modern.
But imagine walking into a bank fifty years ago.
Getting through the front door didn’t give you access to the vault.
Being an employee didn’t necessarily give you access to every room.
Being a customer didn’t allow you behind the teller counter.
Different areas required different authorization.
The principle existed long before the term.
Zero Trust didn’t invent the idea.
It digitized it.
When Someone Leaves, Get the Keys Back
This may be the simplest lesson of all.
When an employee left a business, someone collected the keys.
At least, that was the idea.
Today, those keys might include:
Email.
VPN.
Cloud platforms.
SaaS applications.
Source code repositories.
Password managers.
Remote access tools.
Customer systems.
Administrative accounts.
API tokens.
Third-party portals.
The list can be enormous.
This is why identity governance matters.
Onboarding isn’t simply creating accounts.
Offboarding isn’t simply disabling an email address.
And changing someone’s role isn’t simply changing their job title.
Identity has a lifecycle.
Every key should have an owner.
Every owner should have a reason for possessing it.
And when that reason disappears, so should the access.
AI Needs Keys Too
There’s another new tenant moving into the building.
Artificial intelligence.
AI agents are increasingly connecting to corporate applications, accessing business data, executing tasks, writing code, analyzing documents, and interacting with systems.
Which raises an old question:
What keys should we give them?
If an AI agent can access everything its human operator can access, organizations may unintentionally create incredibly powerful new identities.
Machine identities already outnumber human identities in many technology environments.
AI will accelerate that trend.
The locksmith’s rule still applies.
Give it the keys it needs.
Not every key on the ring.
The Front Door Moved
For decades, cybersecurity focused heavily on protecting the network perimeter.
Build strong walls.
Install better firewalls.
Protect the data center.
Secure the network.
But businesses changed.
Employees work remotely.
Applications moved to the cloud.
Data lives everywhere.
Partners connect directly to systems.
Contractors work across continents.
AI agents interact with applications.
The traditional front door isn’t where it used to be.
In many organizations, the front door is now the login screen.
Identity has become the perimeter.
And that makes the person managing the keys one of the most important security roles in the organization.
The Old School Takeaway
The locksmith never promised that nobody would try to break into your building.
His job was to make sure the right people had the right keys, and everyone else stayed outside.
Modern cybersecurity isn’t so different.
Passwords will evolve.
Passkeys will grow.
Biometrics will improve.
Artificial intelligence will change how identities are verified.
Zero Trust architectures will mature.
The keys will continue to change.
But the principle won’t.
Know who has access.
Know why they have it.
Give them only what they need.
Verify that they are who they claim to be.
And when they no longer need the key…
Take it back.
Because after centuries of innovation in security, the locksmith’s oldest lesson may still be the most important:
The strongest lock in the world can’t protect you if you don’t know who has the keys.
