Sources

Every number on screen, and where it comes from

The talk is built from the article The ultimate insider on the SGit Newsroom, which links each figure to its source. They are listed here by act, in the order they appear. Where a figure is a prediction, a survey or preliminary, the slide says so.

Act one: the insider

• Ponemon Institute and DTEX Systems, 2025 Cost of Insider Risks Global Report, February 2025: 17.4 million dollars a year on average.
• Anthropic, Building effective agents, December 2024: an agent as a model in a loop with tools.
• Simon Willison, The lethal trifecta for AI agents, June 2025.
• EchoLeak, CVE-2025-32711, June 2025: Hack The Box analysis.
• Replit, July 2025: account and timeline; Jason Lemkin's original thread.
• Gemini CLI, July 2025: AI Incident Database entry 1178.
• Amazon Q extension for VS Code, July 2025: SC Media.
• Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 2025; MITRE ATT&CK campaign C0062.
• CyberArk, 2025 Identity Security Landscape, April 2025: 82 to 1, 42 per cent privileged, 88 per cent.

Act two: the infrastructure

• Microsoft, 2023 State of Cloud Permissions Risks: under 5 per cent, under 2 per cent, 40 per cent.
• ThousandEyes, AWS outage analysis, 20 October 2025.
• Cloudflare, 18 November 2025 outage post-mortem.
• Palo Alto Unit 42, SharePoint ToolShell threat brief, July to August 2025.
• On this network: nhi.sgit.ai on non-human identity, pki.sgit.ai on keys for agents, nfrs.sgit.ai on the requirements that are not features.

Act three: the spreadsheet

• Secureframe 2024 survey as reported by RegScale: 48 per cent; SureCloud, The Risk Reckoning 2025.
• Gartner, over 40 per cent of agentic AI projects cancelled by the end of 2027, June 2025, a prediction.
• MIT NANDA, The GenAI Divide, August 2025: preliminary, not peer reviewed.

The turn, and the way out

• NASA, Aviation Safety Reporting System.
• CISA, CIRCIA final rule targeted for September 2026; the slide gives the status as of the article and is to be checked on the day.
• Verizon, 2025 Data Breach Investigations Report.
• RiskMandate, Agent Behaviour Policy and licence to operate.
• The Kit Bag plan, on sgit.ai: thirteen things beyond its purpose, four stopped by the platform.