Subscribe
Share
Share
Embed
Cybersecurity podcast Radio Logic delivers essential, no‑nonsense conversations with trusted experts on all things identity security. Hosted by Anders Askasen, SVP of Marketing at Radiant Logic and author of Cybersecurity Explained, the show draws on his 20+ years in security and digital identity to address today’s challenges.
00:00:00 - This is Radio Logic, the show about digital identities, the people behind it, the tech behind it. In each episode, we'll cover what works, what doesn't, and what's next. Let's dig into it. 00:00:29 - Welcome to Radio Logic, the monthly podcast where identity actually matters. I'm joined today by Michael from Cyber IAM. Michael, welcome. 00:00:40 - Thank you. 00:00:40 - Tell us, tell the audience, who's Cyber IAM and what do you do within identity? 00:00:46 - So Cyber IAM is an identity and access management and governance professional services business. What we do is we help vendors like yourselves deploy your software and technology in the identity space to most of the enterprise customers in the UK and Europe. 00:01:05 - I'm sure you get this question a lot from your customers: "How can AI help us?" 00:01:10 - Oh wow, it's a big question. It's loaded, isn't it? 00:01:13 - It is loaded. 00:01:14 - Yeah. So AI is changing very quickly at the moment. We've become an AI-first company ourselves. I think my employees are sick of hearing me talk about AI, but we need to embrace what it's good at and then evolve over time as it gets better at other tasks. What's AI good at today in our space? It's really good at taking large amounts of data and being able to make sense of it. It's using AI built inside of the tools, but also some external AI to help companies like ourselves help customers make sense of the bigger chunks of what they're trying to achieve. 00:01:57 - At Radiant Logic, we have what we call the "three identity problem"—it's kind of like a flirt to that movie about three stars and three planets. But essentially, there's human identity—and you've been on the podcast in the past and we talked about the human identity side, how we potentially have solved that, although projects fail, we have a pattern on how to approach it. Then we have the machine identities with SSH, certificates, API keys, all those typical things. But then we have that third emerging category of agentic AI—agents that operate instantaneously. They make decisions, they do things; often the term is "ephemeral." Is that something that is popping up on requests from your customers? Are they considering AI? I'm asking because MIT came out with research saying 90% of these projects have a tendency of failing, but at the same time, every single big enterprise has some kind of initiative. 00:03:14 - Yes. The answer is yes, we are seeing our customers looking at AI quite aggressively. I think they went down the initial thought process of "how do we do it better, how do we get an ROI," and the security got sort of pushed aside, as it always does. But the CISOs and the heads of identity are concerned and looking for ways to bring that under control. On the "failed project" side, it's an interesting space to be in because you get to a stage where the agents are autonomous and you're ready to go, and then someone goes, "Well, I don't know if I trust it." That's why we're seeing failed projects—they're not ready to let these agents loose yet on their environment because there aren't the guardrails in place. 00:04:06 - I guess in order for these agents to actually do something useful, you kind of have to give up the keys to the kingdom and give them the authority to do things on your behalf. A couple of weeks ago, "Open-Claude" came out as something that took the market by storm—an open-source project where you give up everything and you get a personal assistant that actually does things for you. This kind of indicates where identity is heading. This surfaces a whole bunch of new risks for CISOs. What's on their mind when it comes to Agentic AI? 00:05:02 - I think CISOs and business in general are concerned about when you let something loose—how do you put the guardrails in place to say what it can and can't do? I think the answer, and there are technologies starting to emerge, is that you need a gateway. You need a gateway between agents that has policies in place to say what it can and can't do. If you give it the guardrails of, "these are the 50 tasks these agents can do," and "only these two agents can talk to each other," you're putting the guardrails on and then letting it go. When you give it access to everything and let it loose, that's what's scaring CISOs right now. 00:05:46 - You touched on something interesting we've seen with the acquisition spree by these types of companies. Typically network companies like Palo Alto have some kind of API gateway, and it's not a big stretch from looking at what you communicate with an LLM. Does that consolidate risk or create a single point of failure? 00:06:22 - I think what's been really impressive about the traditional SOC/network type organizations is that they've finally identified that identity is core to all of this. That's why they're now acquiring identity companies to put identity-type controls around the access that's out there—whether it's agents, machines, or IoT. They're really bringing it to the identity now. Whereas before, they were doing their own thing, and licensing was always endpoints. Now they're moving towards identity licensing, which shows the market shifting to putting controls around the identity, not just the endpoint. 00:07:13 - A recent article highlighted these risks, and one thing that emerged was "Shadow IT"—how do we know what's in there? From Radiant Logic's perspective, we operate under what I call the "Holy Trinity": unify, observe, and act. We make sure we have everything under control as one source of truth, apply observability, and if there's an anomaly, we can act. We're looking at agents where we need an inventory of all these agents—a virtual directory for the agentic era. Would that resonate with you? 00:08:20 - Absolutely. I think we've coined the term "Shadow AI." Everyone has employees using their personal credit cards to get a better version of an AI agent that the organization doesn't have access to, allowing potential leakage of internal data because it's not being governed by the company's approved solution. But the ability to go out and look at your network and find all the agents is easier said than done. There are custom agents as well as standard ones from Microsoft, Google, AWS. Custom agents are harder. Technologies are coming to give that oversight so you can get it under control. We're not there yet; we still need guardrails and standardization. 00:09:35 - I have a thesis: traditional IGA vendors either need to adapt to a new type of identity governance driven by AI, or they will disappear. 00:10:04 - I've heard this before: "Death to IGA, long live IGA." I think what some vendors are doing is using traditional IGA methodology to manage agents because we've got nothing now, and it's a great first step—get it registered, governed, get ownership in place, put certification campaigns around it. That's phase one. But I agree, total identity governance is going to move into the next era using AI. We don't know what that is yet, but at least they're doing something short-term to get agents under management. 00:11:00 - I think in the short term, the problem with Agentic is that LLMs are non-deterministic. There's an 87% probability that we should take away Michael's entitlements—that's not a binary decision. Plus, currently, you kind of have to give up all the keys to the kingdom to do something useful with agents in a provisioning or "joiner-mover-leaver" scenario. 00:11:44 - Before the podcast, we spoke about browser access and extensions. What we need to see more of is AI suggesting you do something—"You haven't used this entitlement in six months, do you want to remove it?" There needs to be more continuous AI suggesting right now until we get to 100% confidence. 00:12:09 - I think you're saying Zero Trust is the way forward—least privilege, starting with nothing, and surfacing context when something is requested. 00:12:36 - I agree. I was asked the other day how to make a CISO concerned about AI. The scenario I gave was: imagine if it was a workforce identity and you were going to give it 45 times more accounts than it has today, access to 100 times more data, and then not govern it. What would the CISO say? That's what we're giving agents. Agents are 45 times more than workforce identity and growing fast. The data access is accelerating. Vendors need to part of getting that under control. 00:13:35 - Radiant Logic supports MCP (Model Context Protocol). We expose our capabilities as MCP tools, yet there needs to be governance and proper authentication. These agents have a tendency of being chained up—one agent calls another. How do you put accountability in that chain? Is it "human in the loop"? 00:14:20 - Customers definitely want "human in the loop." No one's ready to let "The Terminator" loose yet. They want AI to suggest intelligent things to make things faster and more secure, but let the human make the final decision. 00:14:54 - That gives control back to the enterprise as opposed to giving it to an off-the-shelf hyperscaler. Speaking of that, is there thought around local LLMs on-prem versus off-the-shelf? 00:15:25 - I met with a bank this week whose strategy is to be "the best bank at AI." They said they can use local, but it won't have the quality of AI they need. They'd rather use off-the-shelf stuff in a protected way so the data remains within their tenant and doesn't get exposed to the internet. They're accepting that off-the-shelf AI is going to be better than trying to bring it on-prem. 00:16:25 - One thing important from Radiant Logic's perspective is the data layer. If you serve up these AI processes with crappy data, you get crappy results. 00:16:46 - Absolutely. If you point an AI agent at your OneDrive or SharePoint site and you've been there for 10 years, how much of that data is still relevant? You don't want it making decisions based on a meeting from four years ago. We'll probably have to get AI to ignore data beyond a certain point. Identity didn't care about data before AI, but now it's become really important. 00:17:44 - Michael, one provocative question: Have you tried any of these personal assistant agents and given them the "keys to the kingdom"? 00:17:58 - Yes, we use Microsoft Copilot. I tell my team: the reason it's called a "copilot" is because you're still the pilot. They aren't allowed to fly the plane; they only help you. I have a "CEO agent" trained on my data and articles to help me strategize. So I adopt it, but I'm careful. We use the guardrails of our Azure tenant where everything is locked down. 00:18:56 - Use AI to help you, don't take it as gospel, review everything, and don't copy-paste. 00:19:05 - With those wise words from Michael, we'll wrap this up. AI is here to stay; it won't necessarily replace you, but you should use it to augment your work. Over and out.