# The Secrets Workshop

> How CEOs lose company secrets through AI agents — and the seven rules that stop it. Deep-dive companion to M7 OP3. 11 slides, 40 minutes.

*WS·01 · Module WORKSHOPS — Workshops · The CEO AI Playbook by Stephen Forte*

Canonical: https://academy.buildclub.com/workshops/secrets

## Thesis

Seed. Vault. Agent. Audit.

## Key Takeaways

- Seed. Vault. Agent. Audit.
- $10.22M — record-high average cost of a U.S. data breach in 2025, up 9% YoY — and AI agents are the new attack surface.
- 22% — of breaches in the 2024 Verizon DBIR involved stolen credentials — the primary vector.
- 292 days — average time to identify and contain a breach involving stolen credentials.
- How many agents are running in production today? If you cannot get a number in five minutes, that is the answer.

## The Playbook

1. **No secret in code, ever** — Not in env files committed to repos. Not in CI variables visible to every job. Not in screenshots.
2. **Bootstrap key on hardware** — YubiKey or equivalent. The only credential that touches the laptop file system is the agent's scoped token — never the root key.
3. **One identity per agent** — If two agents share an identity, treat them as one agent for blast-radius math. Usually they should not share.
4. **Vertical vaults, not horizontal** — Vault per domain (email, cloud, billing, code). No vault contains the union of two domains.
5. **Time-limited tokens by default** — 30 days max. Renewable by automation, not by a human pasting.
6. **Monthly audit, calendar-locked** — Last Friday of the month. Review identities, rotate keys, read the audit log. Treat it like board prep.
7. **Document the policy in 200 words** — If your security policy is longer than a page, nobody reads it. If nobody reads it, it is not a policy — it is theater.

## Key Numbers

- **$10.22M** — record-high average cost of a U.S. data breach in 2025, up 9% YoY — and AI agents are the new attack surface. (IBM Cost of a Data Breach Report 2025)
- **22%** — of breaches in the 2024 Verizon DBIR involved stolen credentials — the primary vector. (Verizon DBIR 2024)
- **292 days** — average time to identify and contain a breach involving stolen credentials. (IBM Cost of a Data Breach Report)

## What to Do Monday

- How many agents are running in production today? If you cannot get a number in five minutes, that is the answer.
- Where does the bootstrap key live? If the answer involves a laptop hard drive, escalate.
- How many vaults do we have? One is the wrong answer. So is twenty.
- When was the last identity audit? If the answer is "we'd have to check," schedule one this week.
- If our biggest agent's identity leaked tomorrow, what is the blast radius? If nobody can answer in 60 seconds, the radius is too large.

## FAQ

**What is the core idea of The Secrets Workshop?**

Seed. Vault. Agent. Audit.

**What does the data say a CEO should pay attention to?**

$10.22M record-high average cost of a U.S. data breach in 2025, up 9% YoY — and AI agents are the new attack surface. 22% of breaches in the 2024 Verizon DBIR involved stolen credentials — the primary vector.

**What should a CEO do Monday morning after reading The Secrets Workshop?**

Start here: How many agents are running in production today? If you cannot get a number in five minutes, that is the answer; Where does the bootstrap key live? If the answer involves a laptop hard drive, escalate; How many vaults do we have? One is the wrong answer. So is twenty.

**What are the steps in The Secrets Workshop?**

1) No secret in code, ever; 2) Bootstrap key on hardware; 3) One identity per agent; 4) Vertical vaults, not horizontal; 5) Time-limited tokens by default.

**Where do the claims in The Secrets Workshop come from?**

The playbook cites IBM Cost of a Data Breach Report 2025; Verizon Data Breach Investigations Report 2024; Infisical machine identity model; OWASP Agentic Security Initiative — over-permissioned identities.

## Sources

- [IBM Cost of a Data Breach Report 2025](https://www.ibm.com/reports/data-breach)
- [Verizon Data Breach Investigations Report 2024](https://www.verizon.com/business/resources/reports/dbir/)
- [Infisical machine identity model](https://infisical.com)
- OWASP Agentic Security Initiative — over-permissioned identities
- OWASP Agentic Security Initiative
- [1Password Business](https://1password.com/business)
- [Infisical](https://infisical.com)
- BuildClub operator security stack
- [IBM Cost of a Data Breach Report 2024](https://www.ibm.com/reports/data-breach)

---

Work with BuildClub: https://buildclub.com/engagements