Fools Chase AI, Professionals Inventory Assets: Why Security Fundamentals Still Matter

August 12, 2026

In today’s world, it seems every conversation revolves around artificial intelligence (AI) agents, autonomous security operations centers (SOCs), agentic security platforms, exposure management, cloud-native protection and the next generation of machine-speed offence and defense. These innovations matter. Attackers are already using AI to accelerate reconnaissance, improve phishing campaigns, automate vulnerability discovery and increase the speed of attacks, while defenders are adopting AI-powered detection, automated response and agentic security operations. In the recent OpenAI and Hugging Face breach, many pointed out that if basic controls were in place the attack may not have succeeded or would have been slowed. One commenter on X, Florian Roth (@cyb3rops) stated, “Weak isolation, excessive privileges, poor credential boundaries, insufficient segmentation and far too much blast radius. You don’t need an AI defender to fix those things” – reinforcing the point that AI alone will not solve our current security challenges. However, an important challenge remains beneath all of this innovation.

Many organizations are investing heavily in advanced security capabilities while still struggling with the same fundamental security challenges they faced a decade ago: 

• Asset inventories remain incomplete
• Identity governance is inconsistent
• Network segmentation is weak or nonexistent
• Vulnerability backlogs continue to grow
• Backup recovery processes are often untested or not segmented outside of the network 

Recent threat reporting continues to show attackers succeeding through credential theft, known vulnerabilities, prior compromises and poor operational hygiene rather than breakthrough AI-powered techniques. The industry is becoming increasingly focused on sophisticated defenses while sometimes overlooking the foundations that those defenses are built upon.

The Fundamental Question: Do You Know What You Have?

The first job of a security program is not threat hunting or AI-driven detection. It is understanding the environment. All security decisions depend on visibility. An organization cannot protect systems, applications, data, identities or cloud resources it cannot identify. Yet many enterprises still struggle to answer basic questions with confidence.

• How many servers exist? 
• Which SaaS applications are in use? 
• What cloud assets are internet-facing? 
• Which APIs are exposed? 
• Where does sensitive data actually reside?

These questions sound simple, but in large organizations they are surprisingly difficult to answer. Years of mergers, cloud adoption, digital transformation initiatives and SaaS proliferation have created environments that continuously change faster than traditional asset management processes can track.

During a data-flow mapping project at a large financial institution, we spent months identifying systems and dependencies before a major migration. Even then, there were gaps no one could fully identify.

The team eventually created a label in our architectural drawings – MMIU (Marty Made It Up) – for systems we knew existed but could not identify. 

This type of visibility should have been very easy to document, but for this client, and many of our clients, such gaps are so common that no one knows how things work anymore; they just know that they do. Without accurate visibility, every other security investment becomes less effective. In the example above, the client had to trust that the MMIU sections of the documentation would continue to work after the migration and they mostly did. 

Many significant breaches have not been discovered through advanced tools alone; they have been identified by individuals who understand the environment and recognize when activity is not normal. 

Security Is Won Through Consistency, Not Innovation

One of the most persistent myths in cybersecurity is that security failures are primarily caused by sophisticated attacks. In reality, many breaches begin with remarkably ordinary problems: 

• A forgotten server is left exposed to the internet
• A privileged account remains active after an employee leaves
• A known vulnerability is left unpatched
• A cloud storage bucket inherits incorrect permissions
• An administrator account lacks multifactor authentication

None of these scenarios are particularly hard to solve. None require nation-state capabilities. Most would not generate headlines on their own. Yet they continue to serve as entry points because attackers are opportunistic. They do not care whether a weakness is exciting, only whether it works. 

This is why secure configuration management remains one of the most valuable cybersecurity disciplines despite receiving very little attention. Hardened configurations, consistent baselines, application allowlists and denylists and continuous validation lack the excitement of AI-powered analytics, but they systematically remove opportunities for attackers. The organizations that perform these activities well often appear less innovative than their peers. They may not be early adopters of every emerging technology. Yet they frequently demonstrate stronger security outcomes because they execute the basics relentlessly.

Identity Has Become the Security Perimeter

If there is one area where cybersecurity's future and its fundamentals intersect, it is identity. Much of the industry is rightly focused on identity threat detection and response (ITDR), privileged access management and passwordless authentication. Attackers target credentials, sessions, federated access and identity providers because compromising an identity is often easier than compromising a network. What receives less attention is the operational discipline required to manage identities throughout their lifecycle. 

Most access-related risks are created long before an attack occurs. They emerge when users accumulate permissions over time, when departed employees retain access, when service accounts are forgotten or when business processes fail to remove privileges no longer required. As organizations adopt AI agents and automation at scale, these challenges become even more significant as the number of non-human identities soar. Managing these identities requires the same rigor traditionally applied to workforce accounts. The future of identity security may be powered by AI, but its success will still depend on governance, ownership and operational discipline. 

Continuing the Conversation

There's still plenty more to say. In the second part of this blog series, we will look at a few more security fundamentals that deserve a bigger spotlight, including why segmentation still matters, how deception can help security teams spot real threats faster, why recovery needs to be treated as a core capability and where your organization should focus next. 

Continue exploring the security fundamentals here.