Why Identity Is Now the Control Plane

Your network is locked down. Your endpoints are secure. So why are you still getting breached?

Anders Åskåsen sits down with Simon Moffett of The Cyber Hut to make the case that identity is the real control plane of security.

They dig into why identity became a single point of failure, why logs only tell you what already went wrong, and why "just-in-time" access is killing the old pre-provisioned model.

Simon's takeaway: you can have the fanciest AI in the world, but if you can't log in, none of it works.

For anyone who owns security, identity, or risk. Press play.

What is Radio Logic?

Cybersecurity podcast Radio Logic delivers essential, no‑nonsense conversations with trusted experts on all things identity security. Hosted by Anders Askasen, SVP of Marketing at Radiant Logic and author of Cybersecurity Explained, the show draws on his 20+ years in security and digital identity to address today’s challenges.

00:00:00 - This is Radio Logic, the show about digital identities, the people behind it, the tech behind it. In each episode, we'll cover what works, what doesn't, and what's next. Let's dig into it.
00:00:29 - Anders: Identity is not an IT function anymore. It's really the essence of any cybersecurity or security architecture. I'm joined today by Simon Moffett from The Cyber Hut. Welcome, Simon.
00:00:42 - Simon: Hi Anders, good to be here. I'm looking forward to discussing how identity is really at the center of security.
00:00:50 - Anders: In the modern-day world, cyber information security does not function without identity. So, in your view, Simon, what is the deepest structural problem that enterprises are facing today? Is it tool sprawl, the pace of things, or data fragmentation?
00:01:14 - Simon: Honestly, I think it's a combination of those. Information security is there to protect, but also to identify things of risk to things of value. That's a complex problem. If your identity infrastructure is fragmented, leveraging legacy technology, and the data sprawl is not being managed, it's not able to respond to change—be it cyber threats, compliance, or business requirements. Identity wasn't built for security 30 years ago; it was productivity infrastructure sitting under the CIO. Now it has more requirements to make the cyber world effective.
00:02:44 - Anders: Does this mean identity is a single point of failure?
00:02:54 - Simon: It absolutely can be. It's not just about a system being unavailable. If your identity provider is down, it has a catastrophic impact. You can have the fanciest AI systems, but if you can't log in, they cease to function. It's also about single points of failure across the entire identity life cycle—like credential issuance or policy decision points not delivering consistent, high-fidelity responses. This has huge impacts on both security and productivity.
00:04:11 - Anders: Do you think organizations underestimate the risk hidden inside these identity layers?
00:04:19 - Simon: 100%. Identity is evolving to report under the CISO, which brings different requirements. CISOs think about mean time to detection and response—conversations identity wasn't historically part of. It was a tactical problem in the past, but now you need to apply observability to identities to detect behaviors once users are logged in.
00:05:31 - Simon: Organizations are realizing they need to observe both the identity data (profiles, permissions, policies) and the usage of those identities. They want to put identity at the foundation of their security landscape.
00:06:42 - Anders: Historically, identity was someone else's problem, but now it's a primary concern for the CISO.
00:07:09 - Simon: Right. In any breach, the identity layer is what allowed it to take place. The "bad guys" are highly automated and sophisticated; they don't care about your specific systems—they just want a path to the data. We're talking about the identity attack life cycle. In the old days, we'd check logs, but if it's in the logs, it's already happened. That's great for forensics, but you actually need observability to act in real time.
00:09:11 - Anders: It's like policing. You don't just want them to find the perpetrator after the fact; you want them to stop the crime before it happens.
00:09:23 - Simon: Exactly. You want to identify risk before the attack completes. This requires understanding identity data—identifying high-risk identities, stale accounts, or excess permissions—and acting immediately when an observation occurs. You need evidence and context to make informed, fine-grained decisions, like temporarily giving someone read-only access because they are on public Wi-Fi.
00:11:31 - Anders: The annual Verizon breach report illustrates how much impact identity has on the attack surface. How do you see Zero Trust impacting this?
00:12:06 - Simon: Zero Trust is a strategy involving people, process, and technology. Network teams say the perimeter has moved to the person, but in the identity world, the perimeter was always the person. Zero Trust relies on continuous authentication and authorization. It's complex because it's stateless—you're checking every interaction at scale. We're moving away from pre-provisioned access toward "just-in-time" access that is removed when the context changes.
00:14:11 - Anders: We've spent time implementing the Shared Signals Framework (SSF). Can you articulate what that is from a wider lens?
00:14:31 - Simon: Identity was historically isolated. SSF is like a blanket you throw across your entire infrastructure that allows the bidirectional exchange of risk information. For example, if a mobile device management system finds a zero-day vulnerability on an iOS device, that information should spread to identity providers and the network world so they can react. It's like a sandbox where everyone plays well together.
00:16:14 - Anders: What is the adoption of SSF like? It’s a fairly new standard.
00:16:40 - Simon: Standards take a while to proliferate, but there is huge interest. It introduces a "publisher-subscriber" model for risk that is well-understood in other parts of tech. The more complimentary vendors get involved, the better.
00:17:32 - Anders: The industry has changed. It used to be proprietary, but now there's a sense that security is a problem for all of us.
00:18:05 - Simon: 100%. Traditional security conferences like RSA and Black Hat now have a huge percentage of identity-related research. Identity is more aligned with the CISO world now because CISOs realized that even after securing the network and endpoints, they were still getting breached. They are now investing in identity discovery, visibility, and observability.
00:20:20 - Anders: To wrap things up, identity is the control plane of everything security, whether human or non-human. We need that observability to act quickly, and it's not a problem one vendor can solve alone—we need to work together. Thank you for your time, Simon.
00:21:03 - Simon: A pleasure. Until next time.
00:21:10 - Thanks for listening to Radio Logic. Subscribe now wherever you get your podcasts.