Token Security says blast radius matters more than patch speed

Identity vendor Token Security has argued that organisations should focus on how far an attacker can travel after a breach, rather than on severity scores alone, in a piece published by BleepingComputer on 28 October 2026.

The argument is framed around PHP2Shell. According to the article, PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organisations have time to patch. No further detail about affected products, victims or timelines is given in the piece.

The company's central claim is that patching is not the only lever available to defenders. Token Security says limiting the access of service accounts, API keys and AI agents is just as important as fixing vulnerabilities, because those controls determine how much damage a successful breach can cause. In other words, the vendor positions exposure reduction as a parallel track to vulnerability management, not a replacement for it.

The inclusion of AI agents in that list is notable for readers of this paper. Agents are software that acts on a user's behalf, often holding long-lived credentials so they can call APIs and move between systems without a human in the loop. On the vendor's reasoning, an agent with broad permissions is a non-human identity like any other, and the same question applies: if it were taken over tomorrow, what could it reach?

The piece does not quantify the risk, name affected organisations, or provide incident data. It is a sponsored explainer rather than new research, and the only technical reference point it offers is the speed of exploitation that it attributes to PHP2Shell. Readers looking for details of that vulnerability, including affected versions or indicators of compromise, will not find them in this source.

The broader point the vendor makes is one that security teams will recognise. A CVSS score, the industry's standard 0-to-10 severity rating, describes a flaw in isolation. It does not describe the specific environment the flaw sits in, nor the credentials an attacker would inherit on arrival. Token Security's position is that the second question is the one that determines the size of the eventual incident.

The Agentic Times notes that the article is vendor-authored and should be read as such. We have not independently verified the claims made about PHP2Shell or about the relative value of access limitation versus patching.