MCP made connecting an agent to a tool trivial. That’s the risk. A developer adds a server to a config file and the model can now read Jira, query a database, or send email. No review, no inventory, no policy. Security finds out when something breaks.
Least privilege decided who gets the keys. Least agency decides what they can do once inside.
The founding thesis was to move non-human access from secrets to identity. Verifiable workload identity, short-lived credentials issued just in time, policy enforced inline. No code rewrites.
An interview with Micha Rave, CEO and co-founder of Hush Security, covering his cybersecurity career, the company's founding to secure AI agents and non-human identities, its $30 m…