Skip to main content
CPEBuddy
Know Your Adversary | SpecterOps with Special Guests Hope Walker and Elad Shamir (Ep. 17)

Know Your Adversary | SpecterOps with Special Guests Hope Walker and Elad Shamir (Ep. 17)

Source: YouTube · SpecterOps · published Oct 8, 2026 · 22:04

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Know Your Adversary explores Microsoft's sprawling agent identity ecosystem and BloodHound's new beta visualization of agent attack paths, with Hope Walker and El Shamir 0:12.

Key Takeaways:
• Agent identities span Copilot Studio, Foundry, and Entra ID, reaching Azure RM and SharePoint; the agent registry centralizes basics but isn't a full source of truth 0:40
• Agents have supporting components—blueprints, flows, MCP servers—with mixed credential use (agent vs. maker identity) 2:18
• Citizen developers build agents without security rigor, enabling cross-department resource reuse until a privileged maker's credentials work 5:02
• Controlling a blueprint controls all derived agents; owners have full coarse-grained control, sponsors minimal rights 9:31
• The preview changes constantly—even two tenants differed—and LLMs can't keep up with the pace, frustrating research 12:30
• Agents are a new service principal class that actively uses all their access, so over-permissioning is dangerous; untrusted MCP servers (clean source principle) compound the risk 15:19

Agents don't run in isolation—connect agent components to the broader Entra/Azure graph to see what controls them and what they control 21:07.

Sources:

  • 0:12 Guest and topic introduction
  • 0:40 Agent infrastructure across platforms
  • 2:18 Hackathon origins; blueprints and complexity
  • 5:02 Citizen developer and cross-department risks
  • 9:31 Blueprint ownership model
  • 12:30 Preview instability
  • 15:19 MCP servers and agent over-permissioning

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

[music] [music] Welcome back to the Know Your Adversary podcast. My name is Justin Kohler. >> I'm Jared Atinson. >> And today we're joined by Hope Walker and All Shamir. Uh we're here to talk about Microsoft agents IDs or whatever it's called today. Um to start us off, Hope, uh would you mind explaining first why that is funny? Why? What's it called today? I I guess give us a sense of what is agents in Microsoft WAN and then we'll talk about the uh how this incorporates into blood hound or what we are trying to do. >> So the infrastructure that Microsoft is setting up to support agents and agent activity in tenants is across several different platforms. So we have co-pilot studios, we have foundry, we have the entra ID tenant where the identities are residing. It's kind of sprinkled throug…