Voices in Cloud Security is a series of candid conversations with people who work in and around cloud security.
This one is with Michael St. Onge. Michael is a self-taught engineer who got his start making computers work for a Marine Corps tank unit in the mid-90s, then built a career through operations, network engineering, and security. Today, he is an Enterprise Security Architect at Okta. Before that, he spent two years at Tamnoon as our Head of Technical Services.
In this installment, we talked about identity, tokens, why so much of security is really a people problem, and what AI is changing. This is a candid conversation. Michael’s views are his own.
How He Got Here
A self-taught path that started with making a Marine Corps job easier.
How did you end up in cybersecurity?
I grew up with computers. First generation to do so. When I joined the Marine Corps in the mid-90s, they found out I knew how to use one. It was a tank unit, and most of the other tankers did not. So all of a sudden, I was the computer guy.
I started building applications and databases to make my own job easier. I went to school to teach myself new skills. When I got out of the Marine Corps, I walked straight into a contractor role doing operations and engineering. Network engineering, a little security engineering, and Active Directory.
I started as a builder. Help desk, then operations, then building things. Once you understand how things work, people start asking you to make things work for them. Then in the mid-2000s, security became its own discipline. It became a title. And the irony was that you got paid more, and you did not even have to make it work. That has always been my joke. You will pay me more, give me a different title, and I do not even have to make it work? Sounds great.
That is how I went from systems engineering and operations into security.
Security Is a People Problem
Most of the job turns out to be human rather than technical. Michael learned that the hard way.
When you came into the industry, what did you expect would be normal that turned out to be wrong?
I was most surprised that a lot of the people in security were non-technical. At least in the areas I worked, which was federal government, the Department of Defense, and the intelligence community. That really surprised me. And I think it did security an injustice for years, because that is how we got checklist security. People could not go any deeper.
So we ended up with a lot of people who could read a policy and say, no, you are not allowed to do that. Well, why? I have no idea. The policy says so.
That is actually what differentiated me early on. I could tell you why. I could tell you why it mattered and what you could do to change it. Instead of saying, “No, you cannot do that,” I would say, “What are you trying to do?” Let me show you a secure way to do it. That was genuinely differentiating, and it made my career.
And I do not think it was a lack of curiosity. Those were people who grew up in the 70s and 80s, when computers were not in every house. For me, it was different. I had a computer at five. I learned I could hack a video game, change the files, and alter how it worked. So breaking things came naturally to me. Other people had to migrate into that world. It was not their fault. It was a lack of accessibility.
What’s one part of your job that would surprise people who don’t do it?
How much of security has nothing to do with technology.
At the end of the day, security is driven by executive decisions. I spend most of my time convincing people of what they should do. Most of the job is sitting in front of executives and teaching them how to make good decisions. Very little of it is hacking a configuration or fighting an attacker.
Everyone has a currency. You have got to figure out what it is. You have to frame the ask for each executive, so they see the value, not just another security investment. I have always liked that analogy.
What do the best teams do differently? Is there a secret sauce?
Diverse perspectives. And I mean background, not skin color. The way you were raised, the way you grew up, your early career, all of it shapes how you think and how you approach problems.
The best teams have the humility to go find those perspectives. They will ask someone, “Hey, how would you think about this? What do you see here? How would you solve it?” And they do it without ego.
That is the best team. Unfortunately, it is not popular these days. Why would I ask you? I already know everything.
Identity Is the New Perimeter
The problem Michael saw coming, and the one he keeps coming back to.
What’s a problem in the field that’s gotten worse, not better?
Identity.
I am not trying to toot my own horn, but I could see this one coming around the corner. It is pretty obvious. The more automation you have, the more AI, the more agents doing things, the more identities you have. Look behind everything right now, and there are tokens everywhere. The number of JSON web tokens in the world has probably grown by factors of ten, maybe a hundred, in the last two years, just from all the agentic AI.
And we were not doing identity well before that, even for humans. I will give you a personal example. In the US we have three credit reporting agencies. One of them has my information so wrong that I cannot authenticate as me to fix my own credit report. So I have an identity that is me, but is not me.
Your digital identity is arguably more important and more powerful than your human identity. More people, more corporations, more entities recognize my digital identity than would recognize me if I walked into the room. So we already struggled with identity, and now we have an explosion of them. Congratulations. You have scaled the problem.
You’ve heard “identity is the new perimeter.” Is that true, or just a marketing slogan?
It absolutely is. And the shift began when we moved our data centers out of our data centers and into the cloud.
It used to be that you had a physical door to walk through. A physical server to log into. You needed the admin password. None of that is true anymore. Your primary defense layer is authentication.
Think about hanging an application on the internet. If anyone can hit the endpoint, your first layer of defense is authentication. It is identity. That trend continues as more things move to the cloud or the open internet. Sure, there are other layers. But identity is the first layer of defense. It is the middle layer. It is the last layer.
What’s the most common identity mistake you’re seeing at scale?
Too much focus goes on the initial authentication. IP restrictions, policies, and all these hoops to get the token. But once you have that JSON web token, the thing you present with every call, it often does not carry the same restrictions.
So to get the token, I had to jump through every hoop. Scratch my head, rub my belly, hop on one foot, bark like a dog, say my name backward. But once I have it, I can do whatever I want with it, wherever I want.
There is a lot of theater around that. People are not paying enough attention to what happens after authentication. And it gets worse, because a lot of these applications are architected so that if you can mint tokens, it does not matter that the token expires in 15 minutes. A short expiry is better. But if I can mint as many tokens as I want, whenever I want, the result is the same.
Where does MFA actually help, and why do one-year refresh tokens exist?
MFA controls the initial authentication. Once you have the token, there is no more MFA. And you would not want it there. Imagine getting an MFA prompt on every single call to an application. It would be miserable. Nobody would use it.
But that is the problem. If you have the token and can request a refresh token, then MFA is useless. I have seen many successful attacks come down to exactly that. The attacker does not need to hack any deeper. As long as they can keep requesting a refresh token, they are still in. That is their persistence.
So why would you allow a one-year refresh token? Ease of use. Everything is on a sliding scale between security and usability. I have a fingerprint reader on my laptop. Imagine getting prompted for it every time I click a Jira ticket, add a comment, or update a status. It would be miserable. So for some apps, teams decide it is just not that important and make it easy. You can keep requesting refresh tokens for a year. Or someone set that value once and forgot to change it. Or the app was built before AI.
And now your tool is a lot more dangerous than it used to be. Look at all the AI integrations going into Salesforce. Most customers store sensitive data there, and AI is a great way to retrieve it. Every tool that has an integration and now has an AI interface, your attack surface just grew a lot. Things that were not dangerous before AI are now very dangerous, and the threat models have not kept up.
Treat AI Like a Person
Impressive but early. And the fix for AI looks a lot like the fix for people.
AI is the big hype right now. What’s overhyped, and what’s underrated?
What is overhyped is that AI right now is still predicting the next word. It is doing amazing things, but this is not the AI that changes humanity and society. This is the precursor. We will get there, probably in the next five to ten years. We can build all the data centers and hyperscaling we want, but this technology is not the end state. This is the Stone Age compared to what is coming.
What is underrated is harder to say, because it is so hyped. But I think it is more powerful than people realize. The real limit is people’s ability to think about how to use it well.
When an account gets compromised, what’s often the most boring root cause?
Someone clicked on something dumb. Phishing is still remarkably effective. It just is.
And if I were an attacker today, you might expect a technical answer. External attack surface, what domains are owned, who the partners are, looking for the weak link, the forgotten thing that has no security attention. That is all real. But honestly, I would probably go to LinkedIn first. People are the weakest link. They do not mean harm. They just make mistakes. If it is stupid and it works, it is not stupid.
What about AI, though? The prompt injection and poisoning risks we keep reading about?
AI is effective for exactly the reason it is risky. To be useful to the business, it needs access to your data. By its nature, it has access to things that used to be hard to reach. We spent generations building defenses, and the moment AI showed up, we punched a hole right through all of it, because AI needs the access.
And this is where it gets interesting. We had the same problem with humans. In the intelligence world, they call them compartments. If you have access to one compartment, you probably should not have access to another, because knowing both together is more dangerous. Maybe that is the future of AI. You treat AI agents like humans. They do not get access to everything. They get the narrow scope that lets them do their job.
Take the Salesforce example again. Someone connects an AI agent and says, “We will just give it read-only.” But read only to everything. Would you do that with a human? No. You would create roles. A sales role, a marketing role, solutions architects, whatever. We are not doing that with AI. We just give it read-only access to everything. That has to change.
Detection You Can’t Act On
The industry’s favorite metric is finding things. The hard part is doing anything about them.
What’s a piece of advice that’s still treated as gospel but shouldn’t be?
There is too much focus on detection. And this one is a little funny for me to say, because I spent two years at Tamnoon and helped write some of that messaging. But I believe it. If you had all the detection in the world, it would not help you if you had no ability to do anything about it.
I saw this a lot in financial services, and the compliance industry created it. People would say, I do not want the detection tool unless I know I can do something about it. Because if I know about the problem, I am now obligated to act on it. So do not give me something that finds a problem I cannot solve. I hate that mindset, but I understand where it comes from.
And it is about to get worse. Look at the CVE flood. NIST is getting buried in submissions and cannot score them the traditional way or at the same pace. For 2026, if you extrapolate, we are on pace for almost 50 times the volume. Then you add a tool like Mythos, which is genuinely good, and I am glad it exists. But it promises to find every vulnerability in your applications. How many CVEs do you already have sitting there unpatched, with no plan to patch them? If you cannot triage and prioritize the work you already have, finding 50 times more does not help. It overwhelms you.
What AI Opens Up
A leave-behind on what AI makes possible for people without a traditional technical background.
Anything you want to plug?
Chicken Fat, our new party game, has been a fun one. My co-founder (and wife) and I built something based on a fun couple’s game we used to play. Normally, developing a game takes years. You build it, print it, playtest it in a bunch of places, and gather feedback. But with AI helping speed up the time-consuming parts, we skipped six months to a year of normal game development, and I did not spend a ton of money to do it.
I am not a developer by trade. I am dangerous enough, but it is not my job. And I was able to do that on my own, securely, using my own skills.
That is my leave-behind. AI is going to let people turn ideas into reality in a way we have never had before. It opens the door to entrepreneurship for more people. You do not have to have gone to MIT or Harvard to be effective anymore. The value will still come down to systems design and understanding architecture, because AI loses focus as the scope grows. But the field is more level than it used to be.
Where This Leaves Us
Thanks to Michael for a conversation that ran from Marine Corps tank units to refresh tokens to the future of AI agents.
More of these are coming. The thread he kept pulling on, that finding a problem and fixing it are two very different things, is the gap between detection and remediation. It is the reason Tamnoon exists, and it is what we measure in our State of Cloud Remediation report.
