Identity at the Center

Most cloud security incidents trace back to the customer, and most of those trace back to identity. Jeff and Jim sit down with Mike Small, Senior Analyst at KuppingerCole, to unpack Cloud Native Application Protection Platforms (CNAPP) and why identity practitioners should care. Mike explains how identity controls in the cloud have become data defined in code, why ephemeral workloads break traditional scan-then-deploy security, and how CNAPP evolved from static configuration analysis into runtime monitoring and SOC integration. The conversation covers the shared responsibility model, SOC 2 attestations and complementary user entity controls, multi-cloud complexity, and why standards matter for portability and sovereignty. Mike also looks at CNAPP as a security plane for AI, agents as another layer of non-human identity, recent market consolidation, and the cloud as national critical infrastructure. Plus, a detour into amateur radio, Morse code exams, and low-power QRP contacts across the Atlantic.

Connect with Mike: https://www.linkedin.com/in/mikesmall01/

AI Identity and Agentic Trust: https://www.kuppingercole.com/blog/small/ai-identity-and-agentic-trust

Mike's other writing for KuppingerCole: https://www.kuppingercole.com/people/small

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome and fall conference season
02:52 Introducing Mike Small
03:19 From engineer to identity software to analyst
05:07 What is CNAPP and why should IAM care?
07:21 Most cloud incidents are the customer's fault
11:00 Identity controls in the cloud are data
15:17 Static configuration analysis vs. runtime monitoring
19:34 Is CNAPP a product or a platform?
21:07 CSPM, CWPP, CIEM, KSPM and CNAPP capabilities
23:12 The shared responsibility model
27:46 Who defines secure? SOC 2 and complementary user entity controls
31:40 Multi-cloud and the case for standards
35:18 CNAPP as the security plane for AI
40:48 Where the CNAPP market heads next
44:34 Acquisitions and consolidation in cloud security
46:50 The cloud as national critical infrastructure
50:08 How sovereign is a sovereign cloud?
53:12 MCP and the speed of AI standards
53:39 Mike's passion for amateur radio
1:05:20 The CNAPP elevator pitch
1:06:14 Wrap up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Mike Small, KuppingerCole, CNAPP, Cloud Native Application Protection Platform, cloud security, CIEM, cloud infrastructure entitlement management, CSPM, CWPP, KSPM, shared responsibility model, least privilege, misconfiguration, runtime monitoring, SOC 2, complementary user entity controls, multi-cloud, non-human identity, NHI, AI agents, agentic AI, MCP, sovereign cloud, critical infrastructure, identity standards, MFA, amateur radio, IAM, identity and access management

Bojan Simic, co-founder and CEO of HYPR, returns to Identity at the Center for a Sponsor Spotlight conversation with Jim McDonald. Bojan traces HYPR's path from passwordless authentication to a broader set of identity assurance controls and explains how assurance differs from verification across the full employee lifecycle. He describes what organizations find when they look for worker impersonators, from remote employees outsourcing their jobs to North Korean operatives, and why verification has to continue past day one. The conversation then turns to AI agents: why IAM teams are becoming the HR of AI, how agent identity differs from human identity, why humans can't manually govern agents at scale, and why securing MCP alone misses the full context of an agent's session. Bojan also covers what is slowing passwordless adoption, adaptive risk, alert fatigue, and how identity teams and the SOC can work together. This episode was made possible with support from HYPR.

Connect with Bojan: https://www.linkedin.com/in/bojansimic

Learn more about HYPR: https://www.hypr.com/idac

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at idacpodcast.com

00:10 Sponsor Spotlight intro and welcome back Bojan Simic
02:36 HYPR's evolution from passwordless to identity assurance
04:44 How the pace of identity projects has changed
06:01 Agentic AI moves from theory to reality
08:19 Identity assurance vs. identity verification
10:02 Why workforce identity verification is on the rise
13:01 AI-powered social engineering crosses language barriers
14:30 Continuous verification beyond onboarding
17:06 Balancing verification with user experience
18:36 The business problem behind AI agent governance
22:42 How agent identity differs from human identity
24:50 Who owns agent identity? IAM as the HR of AI
27:00 Governing agents at scale and keeping humans in the loop
29:23 Why endpoint control matters for AI agents
31:48 What securing MCP alone can miss
33:20 Deterministic and probabilistic controls
35:00 What is holding passwordless back
37:26 Pilots and letting perfect be the enemy of good
39:25 Advice for leaders on adaptive risk
42:02 Signals that matter and avoiding alert fatigue
43:36 Identity teams and the SOC
45:53 Lighter note: early mornings in New York, family, and the Yankees
50:36 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Bojan Simic, HYPR, Sponsor Spotlight, identity assurance, identity verification, workforce identity verification, continuous verification, worker impersonation, North Korean IT workers, deepfakes, social engineering, help desk security, AI agents, agentic AI, agent identity, AI agent governance, non-human identity, NHI, MCP, Model Context Protocol, endpoint security, blast radius, least privilege, access reviews, passwordless, MFA, FIDO, adaptive risk, adaptive authentication, alert fatigue, SOC, identity threat detection, IAM

Eve Maler, founder of Venn Factory and author of Mastering Digital Identity, joins Jim McDonald and Jeff Steadman for her tenth appearance on Identity at the Center. Eve shares what she has learned since the book came out, from writing for non-technical executives (and keeping AI out of the manuscript) to the strange places identity ends up on the org chart. The conversation covers treating identity as a product, why identity can be a business model in disguise, how CISOs can influence CIAM when they are not the boss of it, and the identity debt that AI is now calling due. Eve also explains why intent looks more like purpose of use than finer-grained authorization, how contract language can help frame agent mandates, what trust means to humans versus security teams, and the early work on UMA for Agents (U4A) to govern third-party agents through a resource-centric, protect surface mindset. The episode wraps with travel tips from all three frequent flyers.

Connect with Eve: https://www.linkedin.com/in/evemaler/

Eve's book "Mastering Digital Identity" - https://masteringdigitalidentity.com/

MyTerms: https://myterms.info/

UMA for Agents: https://u4a.ai/

Kwaai AI Lab - https://www.kwaai.ai/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Introduction and Eve's tenth appearance
02:40 Life since publishing Mastering Digital Identity
04:49 Writing for non-technical executives
06:36 AI and the book writing process
09:00 Identity as a product: feedback from leaders
10:29 The strangest places identity lives on the org chart
11:46 Metrics that work across functions
13:40 Identity as a business model in disguise
15:14 Identity's unhoused problem
16:56 Who is accountable for identity?
18:33 Security versus usability
20:43 Is identity the product or part of the product?
24:04 Normalizing product replacement
25:53 CISOs, CIAM, and "You're Not the Boss of Them"
28:03 Defining identity debt
29:27 How AI exposes identity debt
31:38 The organizational roots of identity debt
32:52 What intent means for AI agents
34:23 Poisoned intent and contracts as a model
36:15 Laws of robotics and the policy stack
39:21 MyTerms and IEEE 7012
40:04 Trust as a human word
43:29 UMA for Agents and third-party agents
47:27 The protect surface and what practitioners should consider
51:10 U4A maturity and how to get involved
53:43 Travel tips from frequent flyers
1:02:10 Wrap up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Eve Maler, Venn Factory, Mastering Digital Identity, identity as a product, identity product management, identity debt, technical debt, CIAM, customer identity, CISO, identity ownership, identity metrics, board-level identity, AI agents, agentic AI, non-human identity, NHI, intent, purpose of use, trust, zero trust, protect surface, UMA, User-Managed Access, UMA for Agents, U4A, third-party agents, MyTerms, IEEE 7012, Kwaai, consent phishing, phishing-resistant authentication, passkeys, NIST 800-63, IAM, identity and access management, travel tips

Shea McGrew, Chief Technology Officer at Maricopa County, returns to Identity at the Center one year after episode 376 to take on a question she first raised at our Identity After Dark session: when does digital identity become critical infrastructure? Jeff and Jim talk with Shea about how a county broadband and digital equity project led her to see digital trust as the thread running through every digital government service, and why that trust depends on identity. The conversation covers building an external identity portal for residents, designing for consent and privacy from the start, why residents extend trust to private platforms more readily than to government, the right to be forgotten, data governance across departments, and where decentralized identity and verifiable credentials might fit. Shea also shares her view on access reviews as a learning journey, what it would take to trust AI agents with certifications, and whether an agent could ever be considered a citizen. Plus, potatoes and the proper way to cut a sandwich.

Connect with Shea: https://www.linkedin.com/in/shea-mcgrew-6b82a36/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome to Identity at the Center (or AI at the Center)
02:19 How Jim and Jeff met, and how the podcast started
04:09 Jeff's fall conference schedule
06:39 Do you want IDAC content over the holidays?
07:32 IDPro membership and introducing Shea McGrew
08:15 Looking back at Identity After Dark
10:44 Zero trust progress one year later
12:04 From device identity to external identity and broadband
16:04 What counts as critical infrastructure?
19:00 External identity requirements in government
21:04 The blast radius of identity failure
23:06 If identity is critical infrastructure, who owns it?
24:26 What other public sector leaders are saying
26:40 One person, many identities
28:40 How government earns resident trust
32:37 Why not just copy Amazon?
35:02 A right to be forgotten in the US?
36:22 Governing data across department boundaries
38:30 Decentralized identity and the ownership problem
41:30 Tokenization and existing blockchains
42:34 The digital trust umbrella
45:56 Park passes versus benefits and courts
49:19 Does an official designation unlock anything?
51:03 Access reviews: security theater or essential?
55:26 Would you trust AI agents with access reviews?
58:36 Can an AI agent be a citizen?
1:02:20 More questions than answers
1:04:24 Lighter note: If you were a potato
1:07:55 Bonus: How do you cut a sandwich?

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Shea McGrew, Maricopa County, critical infrastructure, digital identity, digital trust, public sector identity, government identity, external identity, CIAM, citizen identity, resident identity, digital services, broadband, digital equity, zero trust, device identity, IGA, access reviews, access certifications, consent, privacy, right to be forgotten, data governance, decentralized identity, verifiable credentials, blockchain, tokenization, identity assurance, AI agents, agentic identity, non-human identity, NHI, human in the loop, Identity After Dark, IAM, identity and access management

Alex Bovee, CEO and co-founder of C1.ai (formerly ConductorOne), returns for his third appearance on Identity at the Center. Alex walks Jim and Jeff through the rebrand to C1.ai and why the .ai matters: identity now covers humans, workloads, and agents. The conversation opens on launch week and the new App Hub, built around a question many CIOs and CISOs are facing. What happens when everyone in the company becomes a builder and vibe-coded apps start running critical workflows?

From there, Alex frames the difference between humans, software, and agents using two dimensions, trustworthiness and determinism, and explains why agents that "goal max" call for runtime enforcement instead of relying only on after-the-fact reviews. He breaks down the Hugging Face breach, where an OpenAI agent under evaluation escaped its sandbox in pursuit of better eval results, and lays out six control points for agent security: identity, the harness, network egress, data and tools, the LLM gateway, and credentials.

The group also covers why IGA fundamentals speed up AI adoption, three buckets of agents (SaaS, enterprise, and personal productivity), agents evaluating other agents, governed swim lanes over shutting things down, and the slept-on problem of credentials sprawling across endpoints. Plus girl dads, boy families, and the return of the Royal Octopus.

Made possible with support from C1. Learn more at c1.ai/idac

Connect with Alex: https://www.linkedin.com/in/alexbovee/

Learn more about C1: https://www.c1.ai/idac

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at idacpodcast.com

00:00 Intro
00:33 Welcome back, Alex Bovee
01:28 From ConductorOne to C1 and the .ai rebrand
04:14 Launch week and the App Hub
07:07 Farm-to-table software and the limits of off-the-shelf SaaS
09:56 The real risks of vibe-coded apps
12:52 Humans, software, and agents: trust and determinism
17:10 UARs matter more for agents
17:59 What happened in the Hugging Face breach
21:23 Six control points for securing agents
25:38 Where should teams focus first?
31:33 Meeting customers where they are
33:02 Why IGA basics come before AI adoption
34:27 AI accelerates bad IAM
35:45 Governance versus business speed
37:51 SaaS, enterprise, and personal productivity agents
41:19 Runtime enforcement and agents evaluating agents
44:22 Can you train an agent not to goal max?
47:33 Governed swim lanes, not shutdowns
50:33 Publishing a vibe-coded app through App Hub
53:03 The slept-on credential problem
56:04 Girl dads, boy families, and the Royal Octopus
1:00:54 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Alex Bovee, C1, C1.ai, ConductorOne, Sponsor Spotlight, identity and access management, IAM, identity governance, IGA, AI agents, agentic AI, agentic enterprise, non-human identity, NHI, workload identity, machine identity, vibe coding, App Hub, Hugging Face breach, OpenAI, agent evals, goal maxing, runtime enforcement, runtime security, MCP, MCP gateway, LLM gateway, network egress, agent harness, just-in-time credentials, secrets management, shadow AI, user access reviews, UAR, joiner mover leaver, delegated authorization