Identity at the Center

Recorded live from the expo hall at InfoSec World 2026, Jeff and Jim welcome back Joseph Carson, host of the Security by Default podcast, for his third appearance on the show. Joseph explains how his thinking has moved from "AI vs AI" to "AI vs reality" after talking with CISOs at roughly 40 events this year, including stories of agents breaking into systems they were never meant to touch and a CFO vibe coding a family scheduler on a corporate laptop. He walks through his three-tier framework for agent risk (task, operational, and legally binding agents), makes the case that agents need identifiers and audit trails rather than human-style treatment, and describes Identity Under Attack, a Dungeons and Dragons style tabletop exercise he ran at NATO CyCon with identity coins, chaos cards, and dice. The conversation also covers why identity resiliency keeps landing last on the shopping list, what Locked Shields teaches about communication and identity strategy, a sobering prediction for 2027, and what identity practitioners can do today with ephemeral, auditable access. The episode closes with a podcaster gear chat and the difference between AI slop and AI enabled work.

Connect with Joe: https://www.linkedin.com/in/josephcarson/

Security by Default podcast: https://www.youtube.com/@SecuritybyDefaultPodcast

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com00:00 Intro from InfoSec World 2026 and Jeff's broken finger
02:33 Welcome back Joseph Carson
03:18 From AI vs AI to AI vs reality
05:02 CISO stories: rogue agents and the vibe-coding CFO
06:46 The rise of consumer agents
07:50 A three-tier framework for agent risk
10:52 Onboarding digital workers with a code of conduct
12:39 Identities or identifiers? Estonia's agent identity debate
15:34 Identity Under Attack: a Dungeons and Dragons style tabletop exercise
22:32 Bringing the exercise to conferences
24:49 What surprised Joseph: collaboration across roles
26:52 Common choices and why MFA comes first
28:16 Designing a budget that forces hard choices
29:29 Identity resiliency as an afterthought
31:24 AI as the Mario Kart mushroom
32:53 Lessons from NATO Locked Shields
35:49 Supply chain and third-party risk
37:18 Predictions for 2027
38:59 What identity practitioners can do now
40:23 Vibe coding and governance at AI speed
42:04 Podcast gear and AI-assisted production
48:02 AI slop vs AI enabled
52:17 About the Security by Default podcast
53:45 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Joseph Carson, Security by Default, InfoSec World 2026, Cyber Risk Alliance, agentic AI, AI agents, non-human identity, agent identity, digital workers, AI governance, vibe coding, tabletop exercise, Identity Under Attack, gamification, NATO CyCon, Locked Shields, MITRE ATT&CK, incident response, identity resiliency, MFA, privileged access, just-in-time access, ephemeral access, least privilege, supply chain risk, third-party risk, AI slop, podcasting

Most cloud security incidents trace back to the customer, and most of those trace back to identity. Jeff and Jim sit down with Mike Small, Senior Analyst at KuppingerCole, to unpack Cloud Native Application Protection Platforms (CNAPP) and why identity practitioners should care. Mike explains how identity controls in the cloud have become data defined in code, why ephemeral workloads break traditional scan-then-deploy security, and how CNAPP evolved from static configuration analysis into runtime monitoring and SOC integration. The conversation covers the shared responsibility model, SOC 2 attestations and complementary user entity controls, multi-cloud complexity, and why standards matter for portability and sovereignty. Mike also looks at CNAPP as a security plane for AI, agents as another layer of non-human identity, recent market consolidation, and the cloud as national critical infrastructure. Plus, a detour into amateur radio, Morse code exams, and low-power QRP contacts across the Atlantic.

Connect with Mike: https://www.linkedin.com/in/mikesmall01/

AI Identity and Agentic Trust: https://www.kuppingercole.com/blog/small/ai-identity-and-agentic-trust

Mike's other writing for KuppingerCole: https://www.kuppingercole.com/people/small

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome and fall conference season
02:52 Introducing Mike Small
03:19 From engineer to identity software to analyst
05:07 What is CNAPP and why should IAM care?
07:21 Most cloud incidents are the customer's fault
11:00 Identity controls in the cloud are data
15:17 Static configuration analysis vs. runtime monitoring
19:34 Is CNAPP a product or a platform?
21:07 CSPM, CWPP, CIEM, KSPM and CNAPP capabilities
23:12 The shared responsibility model
27:46 Who defines secure? SOC 2 and complementary user entity controls
31:40 Multi-cloud and the case for standards
35:18 CNAPP as the security plane for AI
40:48 Where the CNAPP market heads next
44:34 Acquisitions and consolidation in cloud security
46:50 The cloud as national critical infrastructure
50:08 How sovereign is a sovereign cloud?
53:12 MCP and the speed of AI standards
53:39 Mike's passion for amateur radio
1:05:20 The CNAPP elevator pitch
1:06:14 Wrap up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Mike Small, KuppingerCole, CNAPP, Cloud Native Application Protection Platform, cloud security, CIEM, cloud infrastructure entitlement management, CSPM, CWPP, KSPM, shared responsibility model, least privilege, misconfiguration, runtime monitoring, SOC 2, complementary user entity controls, multi-cloud, non-human identity, NHI, AI agents, agentic AI, MCP, sovereign cloud, critical infrastructure, identity standards, MFA, amateur radio, IAM, identity and access management

Bojan Simic, co-founder and CEO of HYPR, returns to Identity at the Center for a Sponsor Spotlight conversation with Jim McDonald. Bojan traces HYPR's path from passwordless authentication to a broader set of identity assurance controls and explains how assurance differs from verification across the full employee lifecycle. He describes what organizations find when they look for worker impersonators, from remote employees outsourcing their jobs to North Korean operatives, and why verification has to continue past day one. The conversation then turns to AI agents: why IAM teams are becoming the HR of AI, how agent identity differs from human identity, why humans can't manually govern agents at scale, and why securing MCP alone misses the full context of an agent's session. Bojan also covers what is slowing passwordless adoption, adaptive risk, alert fatigue, and how identity teams and the SOC can work together. This episode was made possible with support from HYPR.

Connect with Bojan: https://www.linkedin.com/in/bojansimic

Learn more about HYPR: https://www.hypr.com/idac

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at idacpodcast.com

00:10 Sponsor Spotlight intro and welcome back Bojan Simic
02:36 HYPR's evolution from passwordless to identity assurance
04:44 How the pace of identity projects has changed
06:01 Agentic AI moves from theory to reality
08:19 Identity assurance vs. identity verification
10:02 Why workforce identity verification is on the rise
13:01 AI-powered social engineering crosses language barriers
14:30 Continuous verification beyond onboarding
17:06 Balancing verification with user experience
18:36 The business problem behind AI agent governance
22:42 How agent identity differs from human identity
24:50 Who owns agent identity? IAM as the HR of AI
27:00 Governing agents at scale and keeping humans in the loop
29:23 Why endpoint control matters for AI agents
31:48 What securing MCP alone can miss
33:20 Deterministic and probabilistic controls
35:00 What is holding passwordless back
37:26 Pilots and letting perfect be the enemy of good
39:25 Advice for leaders on adaptive risk
42:02 Signals that matter and avoiding alert fatigue
43:36 Identity teams and the SOC
45:53 Lighter note: early mornings in New York, family, and the Yankees
50:36 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Bojan Simic, HYPR, Sponsor Spotlight, identity assurance, identity verification, workforce identity verification, continuous verification, worker impersonation, North Korean IT workers, deepfakes, social engineering, help desk security, AI agents, agentic AI, agent identity, AI agent governance, non-human identity, NHI, MCP, Model Context Protocol, endpoint security, blast radius, least privilege, access reviews, passwordless, MFA, FIDO, adaptive risk, adaptive authentication, alert fatigue, SOC, identity threat detection, IAM

Eve Maler, founder of Venn Factory and author of Mastering Digital Identity, joins Jim McDonald and Jeff Steadman for her tenth appearance on Identity at the Center. Eve shares what she has learned since the book came out, from writing for non-technical executives (and keeping AI out of the manuscript) to the strange places identity ends up on the org chart. The conversation covers treating identity as a product, why identity can be a business model in disguise, how CISOs can influence CIAM when they are not the boss of it, and the identity debt that AI is now calling due. Eve also explains why intent looks more like purpose of use than finer-grained authorization, how contract language can help frame agent mandates, what trust means to humans versus security teams, and the early work on UMA for Agents (U4A) to govern third-party agents through a resource-centric, protect surface mindset. The episode wraps with travel tips from all three frequent flyers.

Connect with Eve: https://www.linkedin.com/in/evemaler/

Eve's book "Mastering Digital Identity" - https://masteringdigitalidentity.com/

MyTerms: https://myterms.info/

UMA for Agents: https://u4a.ai/

Kwaai AI Lab - https://www.kwaai.ai/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Introduction and Eve's tenth appearance
02:40 Life since publishing Mastering Digital Identity
04:49 Writing for non-technical executives
06:36 AI and the book writing process
09:00 Identity as a product: feedback from leaders
10:29 The strangest places identity lives on the org chart
11:46 Metrics that work across functions
13:40 Identity as a business model in disguise
15:14 Identity's unhoused problem
16:56 Who is accountable for identity?
18:33 Security versus usability
20:43 Is identity the product or part of the product?
24:04 Normalizing product replacement
25:53 CISOs, CIAM, and "You're Not the Boss of Them"
28:03 Defining identity debt
29:27 How AI exposes identity debt
31:38 The organizational roots of identity debt
32:52 What intent means for AI agents
34:23 Poisoned intent and contracts as a model
36:15 Laws of robotics and the policy stack
39:21 MyTerms and IEEE 7012
40:04 Trust as a human word
43:29 UMA for Agents and third-party agents
47:27 The protect surface and what practitioners should consider
51:10 U4A maturity and how to get involved
53:43 Travel tips from frequent flyers
1:02:10 Wrap up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Eve Maler, Venn Factory, Mastering Digital Identity, identity as a product, identity product management, identity debt, technical debt, CIAM, customer identity, CISO, identity ownership, identity metrics, board-level identity, AI agents, agentic AI, non-human identity, NHI, intent, purpose of use, trust, zero trust, protect surface, UMA, User-Managed Access, UMA for Agents, U4A, third-party agents, MyTerms, IEEE 7012, Kwaai, consent phishing, phishing-resistant authentication, passkeys, NIST 800-63, IAM, identity and access management, travel tips

Shea McGrew, Chief Technology Officer at Maricopa County, returns to Identity at the Center one year after episode 376 to take on a question she first raised at our Identity After Dark session: when does digital identity become critical infrastructure? Jeff and Jim talk with Shea about how a county broadband and digital equity project led her to see digital trust as the thread running through every digital government service, and why that trust depends on identity. The conversation covers building an external identity portal for residents, designing for consent and privacy from the start, why residents extend trust to private platforms more readily than to government, the right to be forgotten, data governance across departments, and where decentralized identity and verifiable credentials might fit. Shea also shares her view on access reviews as a learning journey, what it would take to trust AI agents with certifications, and whether an agent could ever be considered a citizen. Plus, potatoes and the proper way to cut a sandwich.

Connect with Shea: https://www.linkedin.com/in/shea-mcgrew-6b82a36/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome to Identity at the Center (or AI at the Center)
02:19 How Jim and Jeff met, and how the podcast started
04:09 Jeff's fall conference schedule
06:39 Do you want IDAC content over the holidays?
07:32 IDPro membership and introducing Shea McGrew
08:15 Looking back at Identity After Dark
10:44 Zero trust progress one year later
12:04 From device identity to external identity and broadband
16:04 What counts as critical infrastructure?
19:00 External identity requirements in government
21:04 The blast radius of identity failure
23:06 If identity is critical infrastructure, who owns it?
24:26 What other public sector leaders are saying
26:40 One person, many identities
28:40 How government earns resident trust
32:37 Why not just copy Amazon?
35:02 A right to be forgotten in the US?
36:22 Governing data across department boundaries
38:30 Decentralized identity and the ownership problem
41:30 Tokenization and existing blockchains
42:34 The digital trust umbrella
45:56 Park passes versus benefits and courts
49:19 Does an official designation unlock anything?
51:03 Access reviews: security theater or essential?
55:26 Would you trust AI agents with access reviews?
58:36 Can an AI agent be a citizen?
1:02:20 More questions than answers
1:04:24 Lighter note: If you were a potato
1:07:55 Bonus: How do you cut a sandwich?

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Shea McGrew, Maricopa County, critical infrastructure, digital identity, digital trust, public sector identity, government identity, external identity, CIAM, citizen identity, resident identity, digital services, broadband, digital equity, zero trust, device identity, IGA, access reviews, access certifications, consent, privacy, right to be forgotten, data governance, decentralized identity, verifiable credentials, blockchain, tokenization, identity assurance, AI agents, agentic identity, non-human identity, NHI, human in the loop, Identity After Dark, IAM, identity and access management