None shall pass!

By Rob Linton ·2026-10-02

Me, on the door of the data. Wrong century of helmet, I know. Both arms still attached, so this is early in the scene.

Too many breach statements are the Black Knight scene with a press release attached. If you can’t say what was read, that is the script you will end up reading from.

What happens in the Black Knight scene?

King Arthur cuts off all four of the Black Knight’s limbs, and the knight calls it a scratch, then a flesh wound, then a draw.

In Monty Python and the Holy Grail (1975), Arthur (Graham Chapman) meets the Black Knight (John Cleese) guarding a small bridge over a stream in a forest. Arthur offers him a seat at the Round Table. The knight says nothing until Arthur tries to cross, then delivers the line every security team secretly wants on a T-shirt: “None shall pass.”

Arthur takes off the left arm. “’Tis but a scratch.” Then the right. “Just a flesh wound.” (Not “it’s just a flesh wound”. Everyone adds the “it’s”. The script doesn’t.)

Then a leg (“I’m invincible!” and, in the third person, “The Black Knight always triumphs!”), then the other leg, at which point the Black Knight offers: “All right, we’ll call it a draw.”

Cleese told Wired in 2015 that the idea came from a story he heard in English class about an ancient wrestler who won his bout and died doing it, with the moral “If you never give up, you can’t possibly lose.” It would make a decent motto for an incident comms team.

Is the Black Knight a good security model?

As a perimeter, he’s actually quite good. He dispatches the Green Knight in the opening seconds with a sword through the eye slit, which is a pen test finding if ever I saw one.

The problem is that he is the whole model. All the security sits in one bloke at one crossing, and once he’s in pieces the bridge is open to anyone, including a man banging two coconuts together. Nothing on the far side asks who you are. (I made the serious version of that argument earlier this week, about AI agents walking around a refusal. This is the version with coconuts.)

What does “’tis but a scratch” look like in a real breach?

It looks like a sequence of press releases, each one missing another limb. Three real ones, quoted straight, because they don’t need my help:

Every number went one way: up.

As far as anyone has shown, none of them was lying, which is the interesting part. The knight can see his arm on the ground. A company usually can’t, not until someone has worked out from the logs what was actually read. (LastPass’s CEO, Karim Toubba, later said “I accept the criticism and take full responsibility”, which is more than the Black Knight ever managed.)

Isn’t “no evidence” technically true?

Usually, yes, on the day it is said, and that is exactly the problem.

“No evidence” is a statement about the investigation, not about the data. It means “we haven’t found it yet”, and customers hear “it didn’t happen”. The gap between those two readings is where the limbs come off.

The law has quietly made room for this. GDPR Article 33 asks for notice within 72 hours where feasible, then adds that “the information may be provided in phases”. Australia’s Notifiable Data Breaches scheme gives 30 calendar days to assess a suspected breach. Between them, Brussels and Canberra have more or less legislated the Black Knight.

How do you count the limbs on day one?

Log every read at the data, so “what did they take?” is a query, not a six-week dig. Boring old audit logs, kept where the data lives.

My read: the scratch-to-draw arc happens when the only record of who read what lives out at the bridge, and the data itself keeps no diary. I suspect most of the weeks between the first statement and the last go on rebuilding reads from logs that were never built to answer that question.

Okta’s own root-cause write-up is candid about it: “For a period of 14 days, while actively investigating, Okta did not identify suspicious downloads in our logs.” The attacker had pulled files through the Files tab, which wrote “an entirely different log event” to the one Okta’s investigators were searching for. (So the logs were there. The read just showed up as a different kind of event.)

That’s why every access decision, by a person or an AI agent, is logged in the governed AI data platform I originated, now carried forward at Sovrata, the AI data-governance venture out of Senetas. Rob Linton (yes, me, in the third person, which the Black Knight would respect) made the call to keep that tamper-evident trail at the data, where you can hand it to an auditor. It won’t stop the arm coming off. It does mean you can count the limbs that came off at the data.

The honest caveat

Logs at the data only count the reads that go through the data, so one of my three exhibits is partly an argument against me. LastPass’s vault data left as a copied backup from cloud storage, and I suspect a log on the vault service’s own read path would never have seen it. Anything that leaves by a side door (a backup, a snapshot, anything outside the blast radius you thought you had) still needs its own guard.

Net: keep the knight on the bridge by all means. Just make sure the castle keeps its own diary, so the first number you give the press comes out of a query. Leave “’tis but a scratch” to John Cleese, who at least knew it was a joke.