The Rule of Two
Agentic ransomware completed in ten hours while most organisations cannot say who owns their machine identities — the governance vacuum is now measurable.
24 September 2026 — A ransomware operation conducted substantially by agents completed in ten hours this week. Set that against how long your organisation takes to approve a change request.
The more useful framing to come out of this cycle is a simple constraint worth adopting regardless of vendor guidance: no single agent should be able to both access sensitive data and take consequential action, and no consequential action should proceed without either a second agent's review or a human's approval. Two of three, always. It is a rule borrowed from physical security — the safe needs two people — and it translates directly.
The reason it matters is the governance vacuum around non-human identities. Service accounts, API keys, agent credentials: this population now vastly outnumbers the human one in most organisations, and it is governed by almost nobody. A human identity gets onboarding, training, review and offboarding. An API key gets created in an afternoon by someone who has since left, and outlives them by years.
That asymmetry is the vulnerability. Not a clever exploit — a credential that was never revoked because nobody was responsible for revoking it.
The regulatory calendar adds pressure without changing the substance. December 2 continues to approach, and the Commission's formal information requests to more than thirty AI companies in early September established that the enforcement machinery is operational rather than theoretical.
What this means if you run an SME. Produce a list of every credential in your business that is not attached to a person. For each one, answer two questions: what can it reach, and who decided that? The list will be longer than you expect. The second question is where the real finding will be — because in most small organisations, the honest answer for a meaningful share of them is "nobody decided, it just happened."
Applying the rule of two does not require a security team. It requires a decision, recorded, about who approves what.
Mid-week review, in parallel with the Monday series.