Convenience: The Common Thread Behind Human and Agentic Risk

If Convenience Wins, We Lose.Evan Gordenker led more than 160 insider investigations at Unit 42, including work on DPRK IT-worker operations, before taking over insider threat and data security at Airwallex.Evan joins Ash Hunt to showcase how intent is often the wrong place to start. Whether the risk comes from an employee, an AI agent, or an adversary using legitimate credentials, the real question is what trusted access allows them to do.Evan explains why convenience sits at the center of human and agentic risk, how AI agents expose the limits of access models built for people, why security teams need finer-grained control over credentials and permissions, and why the DPRK IT-worker playbook keeps working without changing much at all. ConnectEvan Gordenker on LinkedInAirwallex Chapters0:00 The insider threat you're worried about isn't a person1:19 How Evan fell into cybersecurity via the Tokyo Olympics4:20 What the industry gets wrong about who the insider actually is5:25 Why the 'secret police' framing kills your program8:00 Intent doesn't matter — controls do9:30 What a real, messy insider investigation actually looks like12:30 One sentence in an incident report can end a career15:01 Would you classify an AI agent as an insider?16:33 The one-password experiment — how agents test every credential19:39 4 years into agentic systems. Still built for humans only.23:54 If security runs insider risk alone, you're toast28:35 The DPRK IT-worker threat — and why it hasn't had to evolve32:54 How Fortune 500s started frustrating North Korean operators36:48 The one through-line: convenience42:50 Why InfoSec has never mattered more than right now Presented by Cyera. Produced by Mission.org. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.