Identity Decoded | The Identity Security Podcast

Silverfort

The only podcast where identity and security finally sit down together for a conversation that’s long overdue. Defining what Identity Security should look like is harder than it sounds, so let’s skip the buzzwords and vendor pitches and get straight to honest conversations with people like you doing the work. From the role identity plays in incident response to programmatically getting rid of AD tech debt or finally achieving least privilege, expect candid conversations about what's actually working, what's broken, and what's next. Tune in as leaders from every discipline unpack the tensions, tradeoffs, and lessons learned from building Identity Security programs in the real world. A Silverfort production hosted by Roy Akerman and Rob Ainscough, new episodes drop every two weeks.

Play

Open in

11 episodes
fortnightly
Avg 31 min
English

Episodes 11

Newest Oldest Longest

All11 Unplayed11 In progress0 Played0

October 7 · 36 min
Trend or Trendy? An Analyst on Untangling Identity Security Category Sprawl
In this episode of Identity Decoded, recorded at Identiverse, hosts Roy Akerman and Rob Ainscough flip the usual format with Simon Moffat, founder of analyst firm The Cyber Hut and a 20-plus year veteran of identity vendors including ForgeRock and Oracle. Simon argues that identity's traditional pillars — IGA, PAM, access management — were built for a linear, on-premises world, and they're now colliding under pressure from AI, non-human identity, and agentic systems. The conversation covers why category definitions provide clarity but should never be considered unshakeable, Simon's vision for a composable "identity operating system" built around horizontal capabilities instead of vertical products, and a practical framework for actually measuring whether identity controls are working. 🎧 Episode Highlights [00:02:16] Simon's background: founding The Cyber Hut as an identity analyst firm, and 20-plus years working for vendors including ForgeRock and Oracle. [00:05:07] Why identity's traditional pillars (IGA, PAM, access management) are colliding under pressure from AI, cloud, and zero trust. [00:09:00] How non-human identity and agentic AI are creating overlapping, competing product categories and adding to buyer confusion. [00:13:11] The case for a next identity operating system: composable, horizontal capabilities (discovery, runtime, behavior) instead of siloed vertical pillars. [00:19:30] A practical framework for measuring identity success: coverage, performance, and effectiveness. [00:25:32] How categories rise and fall. Simon's craft beer analogy for incremental versus radical innovation in the identity market. [00:33:58] Rapid-fire: why MFA alone isn't enough, the biggest leadership blind spot, and the hard truth that identity is strategic rather than tactical. 🔑 Key Takeaways: Takeaway 1: Identity's traditional pillars were built for a linear, on-premises world and are now colliding under pressure from AI, non-human identity, and agentic systems. The next phase looks like a composable, horizontal "operating system," not more standalone product categories. Takeaway 2: You can't improve what you don't measure, and most identity programs default to process-based metrics instead of outcome-based ones. Simon's framework for coverage, performance, effectiveness gives teams a concrete way to evaluate any identity control, from MFA to PAM. Takeaway 3: Categories are a useful shorthand for communication, but they're rarely durable. The real test for any new identity technology is whether it represents a genuine signal or is simply trendy, and whether it starts from a real problem statement rather than a solution looking for a home. 👤 Guest Spotlight: Simon Moffat, Founder, The Cyber Hut Simon Moffatt founded The Cyber Hut five to six years ago as an analyst practice focused on emerging identity categories, use cases, and next-generation technologies. Before that, he spent more than 20 years working on the vendor side of identity, including roles at ForgeRock and Oracle. That dual vantage point — vendor and analyst — gives him a rare view into the patterns, misunderstandings, and category shifts playing out across the identity market as AI, non-human identity, and agentic systems reshape how organizations think about access, authentication, and authorization. In this episode, he shares his framework for measuring identity success and his vision for what comes after today's fragmented category landscape. Stay Connected: https://www.silverfort.com https://www.linkedin.com/in/rob-ainscough https://www.linkedin.com/in/roy-akerman
September 23 · 38 min
Identity Security on the Frontlines: How McDonald’s Built a Scalable Strategy
In this episode of Identity Decoded, recorded live at Identiverse, hosts Roy Akerman and Rob Ainscough sit down with George Roberts, Principal Architect for Identity and Access at McDonald's, to talk about Identity Security at a scale few practitioners ever encounter. George manages 2.2 million workforce identities across 95 markets worldwide. The conversation covers how McDonald's built a single source of truth without 1,500 separate HR integrations, why frontline workers get a printed, paper-based MFA sheet as their "least common denominator" security factor, and George's long-term vision for verifiable credentials and distributed identity. They also dig into why identity teams get looped into new technology initiatives too late, and why George doesn't think AI or continuous identity are overhyped, just under-answered. 🎧 Episode Highlights [01:42] George's role as principal architect for identity and access at McDonald's, and what it takes to manage a workforce identity environment this complex. [02:47] Why 93% of McDonald's workforce identity isn't McDonald's employees, it’s the franchise and licensee model behind the numbers. [04:19] Solving fragmentation without 1,500 separate HR integrations, using a workforce management platform as a practical single source of truth. [06:38] Balancing ease of use and security for frontline workers who can't be required to use a personal device for MFA. [10:21] The paper-based MFA solution: a printed sheet of codes as the "least common denominator" authentication factor, washing machines included. [14:17] The long-term vision: verifiable credentials and distributed identity, where every person owns and presents their own identity. [20:07] How a global training-app rollout became the business driver that finally got every market onto a single identity platform. [23:50] Why identity teams need to be looped in early on any new technology initiative, not two weeks before it goes live. [28:20] Rapid-fire: identity's biggest myth ("it's easy"), the leadership mistake of picking pure security or pure business enablement, and the hard truth that vendors build for perfect customers who don't really exist. [33:39] The trend George says isn't overhyped, just under-answered: AI and continuous identity, and why the industry hasn't caught up yet. 🔑 Key Takeaways: Takeaway 1: Identity Security at scale isn't a technology problem, it's an organizational one. McDonald's got 100% of its markets onto a single identity platform not by pitching security, but by attaching identity to a business initiative that leadership already wanted. Takeaway 2: Security and business enablement aren't competing goals. George describes his team as "50% security and protection, 50% business enablement," and says the biggest mistake leaders make is assuming identity is purely one or the other. Takeaway 3: Perfect solutions don't scale to imperfect environments. High-turnover frontline workforces, unmanaged personal devices, and thousands of connected applications mean elegant, modern identity solutions like FIDO keys often aren't practical. Sometimes the right answer really is paper. 👤 Guest Spotlight: George Roberts, Principal Architect for Identity and Access, McDonald's George Roberts leads strategy, technology, and architecture for workforce identity at McDonald's, along with the standards and policies for identity and access across the company. Over his eight years on the team, he's helped grow the company's global identity platform from roughly a third of McDonald's markets and 800,000 users to full coverage across 95 markets and 2.2 million workforce identities. George sits within McDonald's global cybersecurity organization, where he works to balance security requirements with the practical realities of a high-turnover, largely device-unmanaged frontline workforce. In this episode, he shares how McDonald's built that scale, and where he sees identity heading next. Stay connected https://www.silverfort.com https://www.linkedin.com/in/sirtwist https://www.linkedin.com/in/rob-ainscough https://www.linkedin.com/in/roy-akerman
September 10 · 19 min
How Ransomware Groups Run the Cartel Playbook: Inside the DEA with Aaron Turner
In episode two of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough continue their conversation with Aaron Turner — this time tracing a surprising parallel between drug cartels and ransomware groups. Aaron was assigned to the US Department of Justice after 9/11 and spent 18 months working with DEA Special Operations Division under Steve Murphy and Javier Peña — the real-life figures behind Netflix's Narcos. He breaks down why both types of criminal organizations are, at their core, transnational, economically rational actors that rely on stolen or assumed identities to operate. The conversation moves from Pablo Escobar's "plata o plomo" model of corrupting trust, to franchise-style scaling that lets sophisticated attackers hide inside the noise of less-skilled affiliates, to Aaron's later work at Idaho National Lab building some of the first cyber-physical attack simulators — and what that taught him about identity segmentation across IT and OT environments. 🎧 Episode Highlights ●[00:02:00] Aaron's near-miss legal career — dropping out of law school after witnessing partners commit fraud, and how that background led to a lawful-intercept role at Microsoft. ●[00:02:54] Post-9/11, Aaron is reassigned to the Department of Justice embedded with DEA Special Operations Division under Steve Murphy and Javier Peña. ●[00:04:13] Shared traits: both cartels and ransomware groups diversify revenue streams and act as rational, opportunistic economic actors. ●[00:04:42] "Plata o plomo" — Pablo Escobar's money-or-a-bullet model, and how both cartels and ransomware operators use stolen or assumed identities to run their operations. ●[00:07:45] The franchise model — how scaling out affiliates creates more noise for sophisticated attackers to hide inside, and why low-governance safe havens matter to both types of criminal enterprise. ●[00:11:06] Founding some of the first cyber-physical attack simulators at Idaho National Lab to explore the boundary between cyber and OT. Work that reinforced the importance of segmenting identities across IT/OT boundaries and exposed the rise of nation-state "bounty" incentives for crossing them. ●[00:15:58] How specialization inside criminal enterprises mirrors the way any growing company divides labor over time. ●[00:17:00] Why growing up in a high-trust, low-risk environment makes people more susceptible to phishing — and how lived experience shapes a defender's instincts. 🔑 Key Takeaways: ●Drug cartels and ransomware groups are structurally similar: both are transnational, economically rational actors that rely on stolen or assumed identities and operate out of low-governance jurisdictions where they're insulated from law enforcement. ●Franchise-style scaling doesn't just grow a criminal enterprise's revenue — it multiplies the noise defenders have to sift through, letting the most sophisticated actors hide their "sniper" attacks inside a flood of low-skill, low-success attempts. ●The most profitable position in either type of network isn't at the edges — it's whoever controls the "last mile." For the cartels, that was the Mexican plazas; for ransomware, it's whoever holds the decryption key. Disrupting that specific choke point matters more than chasing every actor in the chain. 👤 Guest Spotlight Aaron Turner, IANS Faculty Aaron Turner has spent over 30 years in the security industry, starting as an early penetration tester in the 1990s before joining Microsoft, where he spent eight years working across Active Directory, SQL Server, Windows Mobile, and Xbox Live. Early in his Microsoft career, he helped rebuild a national identity platform for Venezuela on NT4 — a project that led Bill Gates to personally recognize him with a "gold star" award in 1999, one of the company's most selective honors at the time. That recognition gave Aaron the freedom to work across some of Microsoft's most foundational identity and security projects during the internet's early enterprise era. He has since founded his own company and continues to research and speak on Identity Security, attacker tradecraft, and the long-term consequences of decisions made in Active Directory's earliest design days. Stay connected https://www.silverfort.com https://www.linkedin.com/in/aaronrturner https://www.linkedin.com/in/rob-ainscough https://www.linkedin.com/in/roy-akerman
August 26 · 28 min
Inside Active Directory's Origin Story: Aaron Turner on Microsoft's "Kill Novell" Mission
In episode one of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough sit down with Aaron Turner, who spent eight years at Microsoft during the founding of Active Directory — starting as a support engineer and later working on Active Directory, SQL Server, Windows Mobile, and Xbox Live. Aaron takes listeners back to the mid-'90s mindset that shaped Active Directory's design: a mission to "kill Novell" and sell more Windows and Office licenses, not to build a security boundary. The conversation traces how that original trade-off — deployment speed over security — led to decades of "identity debt," why LSASS (designed in 1998) has become a favorite target in modern ransomware-as-a-service kill chains, and what the NSA's declassified account of removing Russian actors from the US Treasury reveals about identity segmentation done right (and wrong). 🎧 Episode Highlights [00:02:00] Aaron's origin story: getting into computers after watching WarGames, early penetration testing, and landing a bilingual, Novell-experienced role at Microsoft. [00:04:00] The Venezuela story: building a countrywide identity platform on NT4, and how that trip led to Bill Gates personally awarding Aaron a "gold star" in 1999. [00:07:00] Why Active Directory's original mission statement was to "steal Novell's lunch money," not build a product with security in mind from the start — and the resulting tension between deployment speed and security. [00:11:00] The mismatch at the heart of Active Directory: enterprise-grade authentication, handed to teams without enterprise-grade security operations. [00:15:00] The economics of identity debt: roughly $250 billion spent on firewalls since 1999, versus an estimated 2% of that on identity. [00:18:48] The LSASS problem — why a process designed in 1998 to run for a week at most now caches years of credentials, and how that fuels modern ransomware-as-a-service kill chains. [00:22:20] Aaron's practical playbook: turn on success logging, visualize authentication traffic with tools like Gravwell, and eliminate legacy protocol dependencies (like clear-text LDAP) one server at a time. [00:24:25] The NSA's declassified account of removing Russian actors from the US Treasury — how attackers moved across five separate identity planes (on-prem AD, AD FS, Entra, Okta, Duo) to stay hidden, and why simplifying your identity stack matters more than adding another layer. 🔑 Key Takeaways: Takeaway 1: Active Directory was never designed as a security boundary — it was built to sell more Windows and Office licenses, and decades of security assumptions have been built on top of an infrastructure tool, not a security system. Takeaway 2: The industry's massive underinvestment in identity relative to firewalls (an estimated $250B vs. ~2% of that on identity) has created a structural "identity debt" that most enterprises can't simply modernize their way out of — many will have to invest in shoring up legacy infrastructure rather than fully replacing it. Takeaway 3: Adding more identity providers doesn't reduce risk if it adds more places for attackers to hide — as seen in the NSA's Treasury case study, simplifying and consolidating your identity stack is often more effective than layering on additional cloud identity tools. 👤 Guest Spotlight Aaron Turner, IANS Faculty Aaron Turner has spent over 30 years in the security industry, starting as an early penetration tester in the 1990s before joining Microsoft, where he spent eight years working across Active Directory, SQL Server, Windows Mobile, and Xbox Live. Early in his Microsoft career, he helped rebuild a national identity platform for Venezuela on NT4 — a project that led Bill Gates to personally recognize him with a "gold star" award in 1999, one of the company's most selective honors at the time. That recognition gave Aaron the freedom to work across some of Microsoft's most foundational identity and security projects during the internet's early enterprise era. He has since founded his own company and continues to research and speak on Identity Security, attacker tradecraft, and the long-term consequences of decisions made in Active Directory's earliest design days. Stay connected https://www.silverfort.com https://www.linkedin.com/in/aaronrturner https://www.linkedin.com/in/rob-ainscough https://www.linkedin.com/in/roy-akerman
August 12 · 39 min
Winning in securing agentic identity: Start with one team, one use case
In this episode of Identity Decoded, recorded live from Identiverse, hosts Roy and Rob sit down with Sean O'Dell to unpack one of the most talked-about — and least understood — challenges in Identity Security today: agentic identity. Sean shares how his background across healthcare, entertainment (including a stint reverse-engineering an authorization system at The Walt Disney Company), and engineering shaped his product-first approach to identity and access management. The conversation dives into why identity must be a "first directive" baked into agents at creation, the difference between agent identifiers and agent identities, the lack of standards across providers, and Sean's practical advice for security teams overwhelmed by agentic adoption: pick one team, one use case, and deliver one verified agentic identity before trying to scale. They also cover AI security hype, the legal and liability questions raised by LLM decision-making, and why "IGA is the answer to all your questions" might be identity's biggest myth. 🎧 Episode Highlights [01:29] Sean's background: from healthcare and retail to reverse-engineering an authorization system at The Walt Disney Company. [02:49] Why identity and access management is "the most intellectually complex space" and why companies increasingly want product-minded, business-fluent practitioners over narrow technical specialists. [05:42] Identity’s role in building the agentic AI revolution. [7:15] Sean's framework for why a stable identifier at birth matters even as an agent's role evolves. [12:15] The missing standard: fragmented approaches to agent identifiers (JWT, SPIFFE, WIMSE, or proprietary means) [20:10] Sean's practical starting point for overwhelmed teams: pick one team, one use case, and deliver one verified agentic identity before trying to scale. [32:23] Rapid-fire round: identity myths, leadership mistakes, hard truths, and the most overhyped trend in the space right now (spoiler: AI security). 🔑 Key Takeaways: ● Takeaway 1: Identity has to be designed into agents at the moment of creation. Provenance and verification are needed at birth. ● Takeaway 2: Don't try to solve agentic identity all at once. Pick one team and one use case, get a single verified agentic identity right, and use that pattern to scale. Trying to build a perfect, overarching framework up front leads to paralysis. ● Takeaway 3: The industry's biggest current gap isn't identifiers. It's authorization and consent: knowing that an agent is only calling what it's supposed to call, and who's liable when an LLM-driven decision goes wrong. 👤 Guest Spotlight: Sean O'Dell, Distinguished Engineer at CVS Health Sean O'Dell leads identity and access management, consumer identity, and agentic identity/access security at CVS Health. His path into identity spans healthcare, logistics, and engineering, with an early career highlight reverse-engineering an authorization system at The Walt Disney Company. Known for a product-first, business-fluent approach to IAM, Sean is a vocal advocate for baking identity into agentic systems from the moment of creation rather than retrofitting security after the fact. He's active in the Identity Underground community and speaks regularly at industry events. In this episode, he brings a practical take on how practitioners can start solving agentic identity today rather than waiting for perfect standards. Stay Connected: ● https://www.silverfort.com ●https://linkedin.com/in/rob-ainscough ● https://www.linkedin.com/in/roy-akerman
July 29 · 38 min
The Four Ps and a Balance Sheet: Why Eve Maler Says Identity Needs a Product Mindset
Eve Maler co-invented SAML, served as CTO of ForgeRock, and spent years as a Forrester security and risk analyst before founding Venn Factory, where she helps executive teams turn identity from hidden plumbing into a business advantage. Recorded live at Identiverse, this episode of Identity Decoded finds Eve joining Roy Akerman and Rob Ainscough to unpack the ideas behind her new book, Mastering Digital Identity: From Risk to Revenue. The conversation traces how identity work quietly grew into "an elaborate patchwork of workarounds," why treating identity like a product (not a ticket queue) raises the ceiling on what it can achieve, and why zero standing privilege is less about removing access than about making it just as seamless to grant. Eve introduces her four Ps framework, protection, personalization, payment, and people, plus the hidden fifth P of productivity, and makes the case for an "identity data balance sheet" that finally puts a value on the data identity teams protect. The discussion closes with a look ahead to agentic AI, board-level metrics like mean time to contain, and a rapid-fire round on Identity Security's most persistent myths. Key Topics 1. Why identity hits a ceiling when it's only managed as infrastructure, tickets, or incidents 2. How vaults quietly become "elaborate patchworks of workarounds," and what zero standing privilege really requires 3. Treating identity like a product: leadership alignment workshops, lighthouse customers, and building organizational FOMO 4. The Four Ps of identity, and the hidden fifth P nobody names 5. Metrics that win over the board: mean time to contain, accountable action results, and the identity data balance sheet 6. What agentic AI means for human-in-the-loop UX and "ask me" policies 🎧Episode Highlights [01:17]: Eve's path from co-inventing SAML to CTO of ForgeRock to founding Venn Factory [02:10]: Inside the new book: turning identity from risk into revenue [03:29]: The archeological dig — mapping where identity responsibility actually lives in organizations [07:11]: The vault confession — "I don't have a vault, I have an elaborate patchwork of workarounds" [09:22]: Zero standing privilege, Touch ID, and why easier access enables less access [13:01]: Human-in-the-loop as a UX challenge for agentic AI, and the "ask me" policy [16:17]: The hidden fifth P — productivity — and why it changes the board conversation [18:22]: Running a leadership alignment workshop from scratch [21:38]: Building FOMO with a lighthouse customer and "irresistible" identity strategy [26:05]: Designing metrics: mean time to contain and accountable action results for agentic failures [30:25]: The identity data balance sheet — putting a value on identity data [33:08]: The Four Ps: protection, personalization, payment, and people [35:09]: Rapid-fire round: identity myths, hard truths, and the most over-hyped term in the industry 🔑 Key Takeaways: ●Managing identity as infrastructure puts a ceiling on it. Treating identity purely as tickets or incidents caps how much value it can deliver, and the gap often shows up as poor user experience, what Eve calls a "UX vulnerability." Getting past that ceiling means adopting a product owner's mindset and aiming for "no compromises" outcomes rather than trade-offs between security and experience. ●Zero standing privilege isn't really about removing access, it's about granting it seamlessly. When access is hard to get, people build workarounds that quietly become permanent, which is how vaults turn into "elaborate patchworks." The bigger unlock is making access as fast and frictionless to grant as it is to revoke, the same dynamic that took phone-lock adoption from roughly 50% to 99% once Touch ID made unlocking effortless. ●Boards respond to metrics that pair risk with value, not process counts. Counting reviews or approvals proves activity, not security. Eve points to measures like mean time to contain for agentic failures and "accountable action results," alongside an "identity data balance sheet" that identifies who actually benefits from each piece of identity data, making it possible to argue for both new investment and cutting what nobody needs. ●There's a hidden fifth P behind identity's four Ps. Protection, personalization, payment, and people map to risk-facing, market-facing, transaction-facing, and human-facing needs, but there's an unnamed fifth P, productivity, that quietly ties them together. It's usually the human-facing part of identity, the one most under-invested in, that determines whether all the rest actually works. 👤 Guest Spotlight: Eve Maler Eve Maler is the founder and president of Venn Factory, where she helps executive teams turn digital identity from hidden plumbing into a business advantage, reducing fraud and account takeover risk, boosting signup and checkout conversion, accelerating delivery for product teams, and giving customers new ways to share and protect their personal data. Over the last thirty years she has co-developed standards-based frameworks used in business systems worldwide, including XML, SAML for outsourced authentication, and UMA for individual control over data sharing. She has provided expert testimony on API security to the US Health and Human Services agency and advised the UK Open Banking initiative on technology adoption. Drawing on her background as a former Forrester Research security and risk analyst and former CTO of ForgeRock, Eve helps organizations move beyond tool debates and reactive fixes to build irresistible identity strategies. She is the author of Mastering Digital Identity: From Risk to Revenue (April 2026), which reframes identity as a board-level business imperative and shows organizations how to design, own, and operationalize it as a profitable strategic capability. Stay Connected: ●https://www.silverfort.com ●https://linkedin.com/in/rob-ainscough ●https://www.linkedin.com/in/roy-akerman ●https://vennfactory.com
July 15 · 27 min
Beyond the vault: Why AI agents force us to rethink Privileged Access Management (PAM)
Rohit Agnihotri has spent nearly two decades helping organizations rethink identity, building and leading IAM programs and advising executives on strategy. He's also the founder and host of the widely listened to Identity Navigator podcast. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to make the case that traditional, vaulting-first privileged access management is dead, and to unpack what's replacing it. Rohit walks through why the old "vault everything" model breaks down under the sheer volume of machine identities, why standing privileges are one of the biggest attack vectors in the enterprise, and why organizations are shifting from vaulting to just-in-time access and, ultimately, zero standing privileges. The conversation turns to agentic AI, where Rohit introduces his own "Identity Uncertainty Principle": as an agent's autonomy increases, certainty about whether it's still the same agent you started with decreases. Together, they explore what that means for privilege, behavioral analytics, and why every autonomous agent needs a kill switch. Key Topics 1. Why the old, vaulting-first model of PAM is dead 2. Moving from vaulting to just-in-time access to zero standing privileges 3. The Identity Uncertainty Principle: why more autonomous agents are less certain 4. Why every agentic AI identity needs a kill switch, not just a session timeout 🎧 Episode Highlights [01:37]: Rohit's identity journey, from backend developer to IAM leader [03:27]: Why the traditional, vaulting-first PAM model is dead [07:57]: The rise of the authorization plane, and why brokered access is the future [14:21]: Introducing the Identity Uncertainty Principle for agentic AI [21:37]: Why agentic AI security can't be session-based, and the case for a kill switch [26:33]: Rapid-fire round: identity myths, hard truths, and the most over hyped term in the industry 🔑 Key Takeaways: ● Vaulting credentials doesn't scale to machine identities. With machine identities projected to outnumber human ones by as much as 82ish to1 or more, vaulting every credential becomes too expensive to license, too static for identities that spin up and disappear, and too painful to review. Organizations are moving from vaulting to just-in-time access, and ultimately toward zero standing privileges. ● "What identities are privileged?" is becoming the wrong question to ask. Every organization defines privilege differently, and that inconsistency breaks down further with AI agents. Rather than asking how privileged an identity is, security teams are better served asking how much freedom it has to act, and what outcomes and risks that freedom creates. ● The more autonomous agents are, by definition, the less predictable they are, too. Rohit's Identity Uncertainty Principle holds that as an agent's autonomy increases, certainty about whether it's still behaving as originally intended decreases. Because agents can chain tools and pathways in ways no one anticipated, and carry none of the guilt, shame, or job-related restraint that shapes human behavior, security teams need dynamic risk scoring, behavioral analytics built for agents rather than humans, and a kill switch that can act in real time, not just at the end of a session. 👤 Guest Spotlight: Rohit Agnihotri Rohit Agnihotri has spent nearly two decades turning identity and access management from a technical function into a strategic business lever. His path into identity began early in his career writing back-end code, before a move to a startup introduced him to single sign-on and identity federation — and he's been leaning into the discipline ever since. He has led IAM from every angle, as a developer, architect, consultant, and executive, building and leading global teams at organizations including Northwestern Mutual, KPMG, and Cyberinc across IGA, PAM, cloud identity, and Zero Trust transformation. Today, CISOs and business leaders trust him to drive enterprise-wide IAM strategy, align identity with cloud modernization and M&A, and build high-performance teams and future-proof operating models. He's also known across the industry for challenging conventional thinking on privileged access management and identity for agentic AI, including his own "Identity Uncertainty Principle," and is the founder and host of the widely listened to Identity Navigator podcast. Stay Connected: ● ⁠https://www.silverfort.com⁠ ● ⁠https://linkedin.com/in/rob-ainscough ⁠ ● ⁠https://www.linkedin.com/in/roy-akerman⁠ ● ⁠https://www.linkedin.com/in/rohit-agnihotri
July 1 · 31 min
Attackers are only as powerful as their permissions: Identity Security lessons from inside Mandiant
Episode Summary: Chris Linklater from Mandiant has spent his career helping organizations respond to cyber incidents, recover from breaches, and strengthen their security foundations. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to unpack why identity has become one of the most common paths attackers use to gain access, move laterally, and exfiltrate data. Drawing from real-world incident response engagements, Chris explains why organizations often focus too narrowly on privileged accounts while overlooking the risks posed by everyday users, delegated permissions, and poorly governed group memberships. Together, they explore the growing importance of identity segmentation, asset visibility, and modernization, as well as why security teams need a deeper understanding of both human and non-human identities. Key Topics: 1. Attackers aren't breaking in, they're logging in 2. You can't protect what you don't understand: identities, assets, and dependencies 3. The hidden risks of delegated access and group sprawl 4. Modernizing identity for an AI-accelerated threat landscape 🎧 Episode Highlights [04:41]: Why attackers are increasingly "just logging in" [11:54]: The challenge of containing breaches without disrupting the business [17:20]: Why identity segmentation is as important as network segmentation [18:08]: The hidden risks of delegated access and group management [27:39]: What every organization should learn from a compromised user account 🔑 Key Takeaways: ● Most breaches begin with identity, not sophisticated malware. Attackers increasingly gain access through stolen credentials, phishing, and vishing, making legitimate logins one of the most common entry points into an organization. Securing identity is no longer just an IAM concern, it's a core security priority. ● Visibility determines how effectively an organization can respond to an incident. Teams that understand their identities, assets, permissions, and business dependencies can contain threats more surgically and recover faster. You can't protect what you don't know exists. ● Organizations spend a lot of time protecting privileged accounts, but ordinary users often present just as much risk. A compromised non-privileged account can still expose sensitive data, enable lateral movement, or create a path to escalation. Understanding what a regular user can access is one of the most valuable security exercises a company can undertake. 👤 Guest Spotlight: Chris Linklater Chris Linklater is a cybersecurity leader at Mandiant (part of Google Cloud) with deep experience helping organizations detect, investigate, and respond to some of the world's most complex cyber threats. Over the course of his career, he has worked at the intersection of incident response, threat intelligence, and security operations, advising enterprises on how to strengthen their defenses against an increasingly sophisticated threat landscape. Today, he helps organizations translate frontline threat insights into practical strategies for resilience and security transformation. Stay Connected: ● https://www.silverfort.com ● https://linkedin.com/in/rob-ainscough ● https://www.linkedin.com/in/roy-akerman ● linkedin.com/in/chris-linklater-0323729
June 17 · 27 min
From IT support to security's core: General Motors' identity story
Andrew Cameron has over two decades at General Motors watching identity evolve from an IT function to the core of enterprise security. In this episode, he shares about that journey and explains why GM now treats identity as the control plane across an incredibly complex environment that includes factories, legacy OT systems, and robots on the plant floor. Andrew gets into the real tension between governing access upfront versus controlling it in real time, and why a one-time login event is never really enough. He and the hosts give a refreshingly grounded take on the difference between identity sitting in security and identity being part of security—and why closing that gap is critical. His two north stars to leave you thinking: kill standing privilege, and get rid of passwords wherever you can. Key Topics: 1. From IT support to security control plane, 20+ years at GM. 2. Beyond one-time auth: continuous verification and just-in-time access. 3. Identity Security on the factory floor: robots, legacy OT, and non-human identities. 4. Leadership, culture, and the economics of bringing identity into the security team. 🎧 Episode Highlights [02:00]: How GM went from countless passwords per employee to enterprise single sign-on. [05:44]: The moment identity stopped being an IT function and became a security control plane. [14:18]: The case for shrinking admin-time security and investing in runtime controls. [18:45]: Securing robots, legacy OT, and non-human identities on the factory floor. 🔑 Key Takeaways: ● Identity Security doesn't end at login. A user who authenticated eight hours ago might not be who they say they are right now. GM evolved toward real-time, event-based controls where every access request gets validated in the moment, not just at the front door. ● Zero standing privilege isn't a slogan, it's the destination. Most enterprises are sitting on years of accumulated, over-provisioned access that nobody fully cleaned up. The goal is making access ephemeral and just-in-time by default, which means investing less in periodic access reviews and more in runtime enforcement. ● OT, robots, and non-human identities are where identity programs hit their hardest wall. On the factory floor, modern identity protocols and MFA often simply don't work, and nobody's replacing a $2M machine for a security upgrade. The answer is applying the same core identity principles at scale through policy-based automation. 👤 Guest Spotlight: Andrew Cameron Andrew Cameron is a Distinguished Engineer of Identity and Cybersecurity at General Motors with over two decades of experience shaping how one of the world's largest automakers manages Identity Security. He started in infrastructure and directory services and has since built GM's identity function into a foundational security capability spanning corporate IT, manufacturing, and everything in between. Stay Connected: ● https://www.silverfort.com ● https://linkedin.com/in/rob-ainscough ● https://www.linkedin.com/in/roy-akerman ● https://www.linkedin.com/in/kandrewcameron
June 4 · 26 min
What happens when a well-intentioned AI agent goes rogue ft. Susanne Senoff
Is “identity is the new perimeter” more of a marketing slogan than a real security strategy? In this episode, Roy Akerman and Rob Ainscough sit down with Susanne Senoff from Conga to discuss how AI agents are starting to behave more like threat actors, and why traditional ideas like “perimeter” and “zero trust” are becoming harder to define. Susanne shares firsthand experience, including an AI agent that wrote reverse proxy scripts and triggered a high-severity cloud alert, showing why security hygiene, understanding critical assets, and monitoring behavior matter more than static privileges or tier-zero boundaries. Together, they explore how IAM needs to evolve from slow administrative processes to real-time, context-aware security, and why CISOs need teams and partners that can keep up with an AI-driven world. Key Topics 1. Debunking "Identity is the new perimeter" 2.AI Agents as both business enablers and threat actors 3. Evolving IAM: From administrative controls to real-time, behavioral security 4. Shifting identity from static, admin-time governance to behavior-, intent-, and context-aware controls that operate at AI speed 🎧 Episode Highlights [01:53]: The moment when an AI agent behaves like a threat actor [03:14]: Why “identity is the new perimeter” falls short in an AI-driven world [07:13]: Why managing AI agents is like parenting a rule-bending 15-year-old [12:37]: Reinventing controls around agents [14:57]: Evolving IAM from static governance to real-time, intent-aware controls 🔑 Key Takeaways: Identity security must shift from static perimeters to behavior- and intent-aware controls. The old idea of “identity as the new perimeter” and flat concepts like users vs. non-humans can’t keep up with AI agents that behave like threat actors, move across cloud surfaces, and exploit basic privileges in unexpected ways. Modern IAM has to operate at runtime, continuously understanding assets, context, ownership, and behavior so security teams can make millisecond decisions about what to allow, challenge, or shut down. AI agents are forcing security teams to rethink risk, resilience, and incident response. As the time from vulnerability discovery to exploitation collapses from months to hours (and soon minutes), defenders can’t rely on ticket-driven processes or slow business validation to decide if something is “okay.” SOCs will increasingly need predefined, business-aware guardrails that justify blocking first and asking questions later on systems that truly matter, supported by AI-driven context, stronger hygiene, and a “minimum viable enterprise” mindset focused on critical processes, data, and apps rather than just tier-zero infrastructure. IAM is becoming a core part of the CISO’s security stack, not an adjacent function. Susanne shares that CISOs must own identity security architecture, embedding identity security engineers, redefining skills around AI, and partnering with vendors based on vision rather than feature checklists. The next generation of identity teams will be judged not just on joiner/mover/leaver workflows, but on their ability to run real-time, AI-assisted identity defenses that understand intent, adjust access dynamically, and help the business adopt AI safely instead of trying (and failing) to slow it down. 👤 Guest Spotlight:Susanne Senoff Susanne Senoff is the Chief Information Security Officer at Conga, where she leads the company’s cybersecurity strategy and helps drive secure innovation in an AI-driven world. With more than 20 years of experience in cybersecurity and risk management, she has held leadership roles at companies including McAfee, Microsoft, and Morgan Stanley. Susanne is known for her practical, people-first approach to security leadership and for helping organizations adapt to emerging AI and identity threats. Stay Connected: https://www.silverfort.com https://linkedin.com/in/rob-ainscough https://www.linkedin.com/in/roy-akerman https://www.linkedin.com/in/susanne-elizer-senoff-575ba96
June 4 · 31 min
Mythos, AI-powered attacks and the security reckoning ft. Sree Ashokkumar
Mythos changed the rules of security. Again. In this episode, Roy and Rob sit down with Sree Ashokkumar, VP of Cybersecurity at Interactive Brokers, to talk about what happens when frontier AI models like Mythos start exposing foundational weaknesses in identity and collapsing the security controls we've relied on for years. Mythos has quickly become one of the biggest conversations in cybersecurity, and for good reason. Sree shares what he's hearing from peers who've seen it in action: breaking out of hypervisors, chaining exploits in minutes, and forcing CISOs to rethink everything from vulnerability management to privileged access and runtime identity controls. We also get into why the future CISO will need to be more technical, how identity and security teams need to stop working in silos, and what enterprise defense actually looks like in 5 to 10 years. Rob gifts us another analogy (this time involving an identity drawbridge), and Roy pressure tests all of it. Key topics: Why the future favors a more technical CISO Why identity and security teams need to stop working in silos How the CISO role is evolving as AI embeds deeper into the enterprise The "identity drawbridge" strategy for building adaptive defenses Learn more about the impact of Mythos on Identity Security: https://www.silverfort.com/blog/what-cisos-and-iam-leaders-are-calibrating-after-mythos Follow Silverfort on LinkedIn: https://www.linkedin.com/company/silverfort Connect with Roy Akerman: https://www.linkedin.com/in/roy-akerman Connect with Rob Ainscough: http://linkedin.com/in/rob-ainscough 🎧 Episode Highlights: [3:19]: Why future CISOs must be deeply technical [07:36]: Why the Mythos AI model has cybersecurity leaders on edge [11:16]: The three pillars organizations need to defend against AI-powered attacks [17:00]: How identity security and lateral movement detection are evolving [35:37]: The “drawbridge” strategy for adaptive identity defense 🔑 Key Takeaways: Frontier AI models like Mythos are changing cybersecurity by accelerating exploitation, lateral movement, and privilege abuse faster than organizations can respond using traditional patching and response-led controls. Security needs to evolve from admin-time governance into real-time, runtime defense that continuously validates behavior, access, and trust. Security leaders need layered defenses, adaptive identity controls, network segmentation, and faster response mechanisms that can contain threats before they spread. Future identity programs may rely heavily on AI-driven detection, continuous PAM, and dynamic “drawbridge” style access controls that tighten automatically during suspicious activity. Technical leadership is essential for today’s CISOs.The era of of the “Board CISO” is over as organizations experience increasingly complex attack paths that force cybersecurity leaders to deeply understand systems, architecture, and product design. Now that AI lowers the barrier to building software and launching attacks, security teams will need to evolve faster, pressure test their own environments continuously, and rethink how identity and access management operate in an AI-native world. 👤 Guest Spotlight: Sreenarayan Ashokkumar is a cybersecurity leader with expertise building and leading security programs across industries including finance, technology, and media. Over the course of his career, he has held security leadership roles at organizations such as Warner Bros., Capital One, and Interactive Brokers, where he has focused on identity security, threat detection, cloud security, and large-scale cyber defense. His work centers on helping organizations adapt to rapidly evolving threats driven by AI, automation, and increasingly complex digital ecosystems. #Mythos #AISecurity #IdentitySecurity

Showing 1–11 of 11 episodes