Maulik Shah on security visibility, non-human identities, and turning pushback into a scorecard

First Principles is a conversation series where I ask engineering and security leaders the questions that usually go unasked: how their teams actually behave, what they can't see, and what they've learned the hard way.

In this conversation, Maulik and I talked about what's missing when a security leader takes over, why full visibility is still out of reach, who owns a connection after the engineer who built it leaves, and how developer pushback on security scans became something teams competed over.

Watch on YouTube

Key moments

1. What's missing when you take over

   When he joins a new organization, the first question he asks is what the security posture is, from endpoints and people through to cloud and AI. The most common answer is that nobody really knows, and there are gaps.

   It isn't so much that we don't have a security posture. It's that we don't exactly know what we have and what we don't have.

2. Visibility across tools and integrations

   Asked whether anyone has the full picture of what's connected to what, he was candid. Banning tools outright pushes people toward shadow IT and shadow AI, so his approach starts with visibility, then nudges people toward approved tools and protects sensitive data when they use unapproved ones.

   If I sat here and told you we have full hundred percent visibility, that probably wouldn't be an honest answer.

3. When agents talk to agents

   On accountability between agents, he described an inline AI gateway that monitors what agents are talking to, and applying the same principles used for people: least privilege and just-in-time access.

   If you don't have the visibility, there's no way you can get further information on what is going on.

4. When the engineer who built a connection leaves

   If a connection is tied to a person's own credentials, standard offboarding handles it. A non-human identity, such as a service account, is harder. The direction he described: an identity store that maps every non-human identity to a team or business function, with access reviews like the ones run for people.

   We almost have to treat them as onboarding and offboarding an employee.

5. When engineers pushed back

   Developers pushed back on static code scans in the build pipeline: failed builds, slow scans, false positives. His team started with one engineering team, put a time limit on the scan, had an agent handle first-level triage and open the fix, and rolled the results into an engineering excellence scorecard that teams could compare. Pushback turned into competition.

   It's never about whether security is right or the developer is right.

6. The one thing he'd want to see

   Clarity on how AI will change the work itself, so he can prepare his team, possibly for a future where engineers manage agents.

   Maybe in the future we're all going to be more managers of agents.