Subscribe
Share
Share
Embed
Cybersecurity podcast Radio Logic delivers essential, no‑nonsense conversations with trusted experts on all things identity security. Hosted by Anders Askasen, SVP of Marketing at Radiant Logic and author of Cybersecurity Explained, the show draws on his 20+ years in security and digital identity to address today’s challenges.
00:00:00 - This is Radio Logic, the show about digital identities, the people behind it, the tech behind it. In each episode, we'll cover what works, what doesn't, and what's next. Let's dig into it.
00:00:29 - Anders: Hello, my name is Anders Asson. I'm the Senior Vice President of Marketing for Radiant Logic. And with me today, I've got Simon from The Cyber Hut. Simon, tell the audience who you are.
00:00:39 - Simon: Hi Anders, great to be here. My name is Simon Moffett, founder and research analyst at The Cyber Hut. The Cyber Hut is a global industry analyst firm tracking about 150 different vendors globally, all around the identity security space. It's great to be chatting about a topic that is a great source to understand what everybody else is doing in the market space and figuring out what's going on, trying to synthesize change and the voice of change and where things may or may not be heading to.
00:01:07 - Anders: I thought we would open Pandora's box today a little bit and talk about Agentic AI and identity. Just to set the scene, I think we're looking at a massive paradigm shift when it comes to identities and how you govern and deal with them in the very near time. I think the way that you do identity governance and administration is going to change. Why do I say that? With the introduction of Agentic AI agents that can react to things and deal with natural language, I think the world is going to be completely different. You'll interact with an agent through natural language using your collaborative suites—Slack or Microsoft Teams. You'll chat and get whatever access you need. It will interact with you instead of these clunky UIs. Maybe even the role-based model will disappear in the future because it's no longer needed. That's my vision. What are your thoughts on that?
00:02:38 - Simon: AI is a generational thing—it's the industrial revolution of how we think about digital services and data. It's going to be hugely transformative for all parts of society. We're not quite there yet; we're still in the baby steps of its adoption, security, ethics, and governance. We've seen reports on how you can use AI to build semi-autonomous attacking platforms. The benefits are huge, but right now is a period of transition and uncertainty. Back to identity specifically, you're absolutely spot on. Things change because they're not working effectively. IGA (Identity Governance and Administration) projects often end in distress. Research shows certification processes take too long, systems don't integrate with enough applications, and access requests lack context. Similarly, PAM (Privileged Access Management) systems are expensive and often only cover a tiny percentage of high-risk systems. AI is like a hosepipe of power; you have to force it into the right problems.
00:05:32 - Anders: I've witnessed vendors approaching this with baby steps because of the uncertainty. You have tools like Harbor Pilots, Jarvis, and our own IDA assistant. They all tackle discrete problems. The underlying issue is the deterministic versus non-deterministic problem. It's all statistics—an LLM gives you a percentage of certainty, not a binary yes or no.
00:06:34 - Simon: Absolutely. Process automation is difficult because trying to automate an end-to-end flow is fragile. Any slight change breaks it. In identity, I think of it in two ways: the life cycle (joining, moving, offboarding) and the identity data (profile, permissions, policies). All these parts are fraught with data inefficiencies—stale accounts and excess permissions.
00:08:27 - Anders: That's our bread and butter at Radiant Logic—establishing that identity layer and cleaning everything up. We often talk about human and non-human identities (NHI). Can you help define this in the context of Agentic AI?
00:09:05 - Simon: Definitions are tricky. You have B2E (employees, contractors) and B2C (customers). Then there's NHI, which traditionally fell under machine identity (PKI, certificates). This expanded to service accounts and then microservices (API-to-API communication). NHI has proliferated hugely. It's a broad term for services, APIs, and secrets without a human involved. Now, Agentic AI is a different beast—perhaps a subset of NHI, but more complex. Normal NHI is predictable, like a metronome. Agentic AI is goal-oriented, not task-oriented. It’s probabilistic; it may learn and change its behavior from Monday to Friday.
00:14:09 - Anders: I see three main deployment patterns: 1. Orchestration (Zapier, Bedrock) using low-code/no-code. 2. The developer approach (LangChain). 3. The "Agentic OS" (in-browser) where you give up credentials to your inbox and tools—which seems like shaky ground. What are your thoughts?
00:16:26 - Simon: It's very early and experimental. The browser world is interesting but brings security risks regarding impersonation. No-code is popular but it's like a toddler in a Ferrari—making it easy to drive doesn't mean you should give a four-year-old the keys. It's about accountability. We need a named accountable person and a responsible party (like a developer). For IGA, AI can tackle "low-hanging fruit" like cleaning up Active Directory group descriptions to manage "group explosion" or "role explosion." You need basic data fitness before you can do advanced things.
00:20:01 - Anders: We seem far from securing AI within these patterns. If it's just API keys and OAuth 2, is that enough?
00:20:30 - Simon: It’s never enough. We need to apply human concepts—attribution, verification, and just-in-time permissions—to the agentic world. We need an authoritative state for who created an agent and why.
00:21:52 - Anders: The big elephant in the room is Shadow IT/Shadow AI. It's easy to paste sensitive data into a free AI tool, leading to data leakage to unknown models.
00:22:36 - Simon: Shadow AI is a real concern. It's built into browsers and SaaS systems, improving productivity but creating attack points outside business control. You can't fix it on day one, but you need visibility, risk registers, and eventually, agentic security controls.
00:24:22 - Anders: It's three-fold: technology, people (training), and modernized processes. This has been a great conversation, Simon.
00:24:58 - Simon: A pleasure. In six to nine months, this conversation would probably look entirely different. It's an exciting space.