Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI Agents vs. Audit Logs: What We Learned at Security Game Day

Teams of three to four, detective aliases, a magician, and a flag hidden on a Manhattan billboard. This is our second Identity Security Game Day, a tabletop CTF where Teleport engineers and customers team up to simulate the incidents that don’t happen often, but matter when they do. Game days put customers and Teleporters at the same table. You find out how people actually deploy Teleport versus how you expected, spot better ways of doing things together, and build the personal connections remote work rarely gives you.

Offense vs. Defense in the Age of AI | Red Team vs. Blue Team Panel

Who has the edge in AI security when attackers and defenders have the same models? In this red team vs. blue team panel, Teleport's Ben Arent (Director of Product) talks with Rob (Director of Security, Teleport) and Marcus (founder, maker of Nemesis) about how AI is reshaping infrastructure security: frontier models like Mythos, the Hugging Face incident, prompt injection and the "lethal trifecta," alert fatigue in the SOC, and Teleport's "Pressure Washing" project, where 13 engineers spent a quarter hunting vulnerabilities with LLMs and found more high-severity bugs than in 2024 and 2025 combined.

How to Tie Kubernetes Audit Logs to Individual Engineers

Kubernetes audit logs may show multiple engineers as one user and do not capture what is typed after a kubectl exec session starts. Assign each engineer a unique identity, make sure it stays consistent through proxies and cloud IAM, and use a session recorder if you need to review terminal activity.

How to Reduce Overprivileged Kubernetes Service Accounts

Overprivileged Kubernetes ServiceAccounts persist when broad RBAC, cloud IAM permissions, and long-lived credentials outlive their intended use. Reduce overprivileged access with least privileged RBAC, scoped cloud permissions, and short-lived certificates that eliminate static credentials. I spent two days last quarter tracking down why a developer could delete production secrets. The RBAC looked fine. The ClusterRoleBinding said edit, not cluster-admin.