Identity Decoded | The Identity Security Podcast

The only podcast where identity and security finally sit down together for a conversation that’s long overdue. Defining what Identity Security should look like is harder than it sounds, so let’s skip the buzzwords and vendor pitches and get straight to honest conversations with people like you doing the work. From the role identity plays in incident response to programmatically getting rid of AD tech debt or finally achieving least privilege, expect candid conversations about what's actually working, what's broken, and what's next. Tune in as leaders from every discipline unpack the tensions, tradeoffs, and lessons learned from building Identity Security programs in the real world. A Silverfort production hosted by Roy Akerman and Rob Ainscough, new episodes drop every two weeks.

Identity Decoded | The Identity Security Podcast is a technology podcast hosted by Silverfort, with 7 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Silverfort hosts Identity Decoded | The Identity Security Podcast, a technology show with 7 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Identity Decoded | The Identity Security Podcast

  Winning in securing agentic identity: Start with one team, one use case

  Aug 12, 202639 min

  In this episode of Identity Decoded, recorded live from Identiverse, hosts Roy and Rob sit down with Sean O'Dell to unpack one of the most talked-about — and least understood — challenges in Identity Security today: agentic identity. Sean shares how his background across healthcare, entertainment (including a stint reverse-engineering an authorization system at The Walt Disney Company), and engineering shaped his product-first approach to identity and access management. The conversation dives into why identity must be a "first directive" baked into agents at creation, the difference between agent identifiers and agent identities, the lack of standards across providers, and Sean's practical advice for security teams overwhelmed by agentic adoption: pick one team, one use case, and deliver one verified agentic identity before trying to scale. They also cover AI security hype, the legal and liability questions raised by LLM decision-making, and why "IGA is the answer to all your questions" might be identity's biggest myth. Episode Highlights [01:29] Sean's background: from healthcare and retail to reverse-engineering an authorization system at The Walt Disney Company. [02:49] Why identity and access management is "the most intellectually complex space" and why companies increasingly want product-minded, business-fluent practitioners over narrow technical specialists. [05:42] Identity’s role in building the agentic AI revolution. [7:15] Sean's framework for why a stable identifier at birth matters even as an agent's role evolves. [12:15] The missing standard: fragmented approaches to agent identifiers (JWT, SPIFFE, WIMSE, or proprietary means) [20:10] Sean's practical starting point for overwhelmed teams: pick one team, one use case, and deliver one verified agentic identity before trying to scale. [32:23] Rapid-fire round: identity myths, leadership mistakes, hard truths, and the most overhyped trend in the space right now (spoiler: AI security). Key Takeaways: ● Takeaway 1: Identity has to be designed into agents at the moment of creation. Provenance and verification are needed at birth. ● Takeaway 2: Don't try to solve agentic identity all at once. Pick one team and one use case, get a single verified agentic identity right, and use that pattern to scale. Trying to build a perfect, overarching framework up front leads to paralysis. ● Takeaway 3: The industry's biggest current gap isn't identifiers. It's authorization and consent: knowing that an agent is only calling what it's supposed to call, and who's liable when an LLM-driven decision goes wrong. Guest Spotlight: Sean O'Dell, Distinguished Engineer at CVS Health Sean O'Dell leads identity and access management, consumer identity, and agentic identity/access security at CVS Health. His path into identity spans healthcare, logistics, and engineering, with an early career highlight reverse-engineering an authorization system at The Walt Disney Company. Known for a product-first, business-fluent approach to IAM, Sean is a vocal advocate for baking identity into agentic systems from the moment of creation rather than retrofitting security after the fact. He's active in the Identity Underground community and speaks regularly at industry events. In this episode, he brings a practical take on how practitioners can start solving agentic identity today rather than waiting for perfect standards. Stay Connected: ● https://www.silverfort.com ●https://linkedin.com/in/rob-ainscough ● https://www.linkedin.com/in/roy-akerman

  ListenShow Notes
• 

  Identity Decoded | The Identity Security Podcast

  The Four Ps and a Balance Sheet: Why Eve Maler Says Identity Needs a Product Mindset

  Jul 29, 202638 min

  Eve Maler co-invented SAML, served as CTO of ForgeRock, and spent years as a Forrester security and risk analyst before founding Venn Factory, where she helps executive teams turn identity from hidden plumbing into a business advantage. Recorded live at Identiverse, this episode of Identity Decoded finds Eve joining Roy Akerman and Rob Ainscough to unpack the ideas behind her new book, Mastering Digital Identity: From Risk to Revenue. The conversation traces how identity work quietly grew into "an elaborate patchwork of workarounds," why treating identity like a product (not a ticket queue) raises the ceiling on what it can achieve, and why zero standing privilege is less about removing access than about making it just as seamless to grant. Eve introduces her four Ps framework, protection, personalization, payment, and people, plus the hidden fifth P of productivity, and makes the case for an "identity data balance sheet" that finally puts a value on the data identity teams protect. The discussion closes with a look ahead to agentic AI, board-level metrics like mean time to contain, and a rapid-fire round on Identity Security's most persistent myths. Key Topics 1. Why identity hits a ceiling when it's only managed as infrastructure, tickets, or incidents 2. How vaults quietly become "elaborate patchworks of workarounds," and what zero standing privilege really requires 3. Treating identity like a product: leadership alignment workshops, lighthouse customers, and building organizational FOMO 4. The Four Ps of identity, and the hidden fifth P nobody names 5. Metrics that win over the board: mean time to contain, accountable action results, and the identity data balance sheet 6. What agentic AI means for human-in-the-loop UX and "ask me" policies Episode Highlights [01:17]: Eve's path from co-inventing SAML to CTO of ForgeRock to founding Venn Factory [02:10]: Inside the new book: turning identity from risk into revenue [03:29]: The archeological dig — mapping where identity responsibility actually lives in organizations [07:11]: The vault confession — "I don't have a vault, I have an elaborate patchwork of workarounds" [09:22]: Zero standing privilege, Touch ID, and why easier access enables less access [13:01]: Human-in-the-loop as a UX challenge for agentic AI, and the "ask me" policy [16:17]: The hidden fifth P — productivity — and why it changes the board conversation [18:22]: Running a leadership alignment workshop from scratch [21:38]: Building FOMO with a lighthouse customer and "irresistible" identity strategy [26:05]: Designing metrics: mean time to contain and accountable action results for agentic failures [30:25]: The identity data balance sheet — putting a value on identity data [33:08]: The Four Ps: protection, personalization, payment, and people [35:09]: Rapid-fire round: identity myths, hard truths, and the most over-hyped term in the industry Key Takeaways: ●Managing identity as infrastructure puts a ceiling on it. Treating identity purely as tickets or incidents caps how much value it can deliver, and the gap often shows up as poor user experience, what Eve calls a "UX vulnerability." Getting past that ceiling means adopting a product owner's mindset and aiming for "no compromises" outcomes rather than trade-offs between security and experience. ●Zero standing privilege isn't really about removing access, it's about granting it seamlessly. When access is hard to get, people build workarounds that quietly become permanent, which is how vaults turn into "elaborate patchworks." The bigger unlock is making access as fast and frictionless to grant as it is to revoke, the same dynamic that took phone-lock adoption from roughly 50% to 99% once Touch ID made unlocking effortless. ●Boards respond to metrics that pair risk with value, not process counts. Counting reviews or approvals proves activity, not security. Eve points to measures like mean time to contain for agentic failures and "accountable action results," alongside an "identity data balance sheet" that identifies who actually benefits from each piece of identity data, making it possible to argue for both new investment and cutting what nobody needs. ●There's a hidden fifth P behind identity's four Ps. Protection, personalization, payment, and people map to risk-facing, market-facing, transaction-facing, and human-facing needs, but there's an unnamed fifth P, productivity, that quietly ties them together. It's usually the human-facing part of identity, the one most under-invested in, that determines whether all the rest actually works. Guest Spotlight: Eve Maler Eve Maler is the founder and president of Venn Factory, where she helps executive teams turn digital identity from hidden plumbing into a business advantage, reducing fraud and account takeover risk, boosting signup and checkout conversion, accelerating delivery for product teams, and giving customers new ways to share and protect their personal data. Over the last thirty years she has co-developed standards-based frameworks used in business systems worldwide, including XML, SAML for outsourced authentication, and UMA for individual control over data sharing. She has provided expert testimony on API security to the US Health and Human Services agency and advised the UK Open Banking initiative on technology adoption. Drawing on her background as a former Forrester Research security and risk analyst and former CTO of ForgeRock, Eve helps organizations move beyond tool debates and reactive fixes to build irresistible identity strategies. She is the author of Mastering Digital Identity: From Risk to Revenue (April 2026), which reframes identity as a board-level business imperative and shows organizations how to design, own, and operationalize it as a profitable strategic capability. Stay Connected: ●https://www.silverfort.com ●https://linkedin.com/in/rob-ainscough ●https://www.linkedin.com/in/roy-akerman ●https://vennfactory.com

  ListenShow Notes
• 

  Identity Decoded | The Identity Security Podcast

  Beyond the vault: Why AI agents force us to rethink Privileged Access Management (PAM)

  Jul 15, 202628 min

  Rohit Agnihotri has spent nearly two decades helping organizations rethink identity, building and leading IAM programs and advising executives on strategy. He's also the founder and host of the widely listened to Identity Navigator podcast. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to make the case that traditional, vaulting-first privileged access management is dead, and to unpack what's replacing it. Rohit walks through why the old "vault everything" model breaks down under the sheer volume of machine identities, why standing privileges are one of the biggest attack vectors in the enterprise, and why organizations are shifting from vaulting to just-in-time access and, ultimately, zero standing privileges. The conversation turns to agentic AI, where Rohit introduces his own "Identity Uncertainty Principle": as an agent's autonomy increases, certainty about whether it's still the same agent you started with decreases. Together, they explore what that means for privilege, behavioral analytics, and why every autonomous agent needs a kill switch. Key Topics 1. Why the old, vaulting-first model of PAM is dead 2. Moving from vaulting to just-in-time access to zero standing privileges 3. The Identity Uncertainty Principle: why more autonomous agents are less certain 4. Why every agentic AI identity needs a kill switch, not just a session timeout 🎧 Episode Highlights [01:37]: Rohit's identity journey, from backend developer to IAM leader [03:27]: Why the traditional, vaulting-first PAM model is dead [07:57]: The rise of the authorization plane, and why brokered access is the future [14:21]: Introducing the Identity Uncertainty Principle for agentic AI [21:37]: Why agentic AI security can't be session-based, and the case for a kill switch [26:33]: Rapid-fire round: identity myths, hard truths, and the most over hyped term in the industry 🔑 Key Takeaways: ● Vaulting credentials doesn't scale to machine identities. With machine identities projected to outnumber human ones by as much as 82ish to1 or more, vaulting every credential becomes too expensive to license, too static for identities that spin up and disappear, and too painful to review. Organizations are moving from vaulting to just-in-time access, and ultimately toward zero standing privileges. ● "What identities are privileged?" is becoming the wrong question to ask. Every organization defines privilege differently, and that inconsistency breaks down further with AI agents. Rather than asking how privileged an identity is, security teams are better served asking how much freedom it has to act, and what outcomes and risks that freedom creates. ● The more autonomous agents are, by definition, the less predictable they are, too. Rohit's Identity Uncertainty Principle holds that as an agent's autonomy increases, certainty about whether it's still behaving as originally intended decreases. Because agents can chain tools and pathways in ways no one anticipated, and carry none of the guilt, shame, or job-related restraint that shapes human behavior, security teams need dynamic risk scoring, behavioral analytics built for agents rather than humans, and a kill switch that can act in real time, not just at the end of a session. 👤 Guest Spotlight: Rohit Agnihotri Rohit Agnihotri has spent nearly two decades turning identity and access management from a technical function into a strategic business lever. His path into identity began early in his career writing back-end code, before a move to a startup introduced him to single sign-on and identity federation — and he's been leaning into the discipline ever since. He has led IAM from every angle, as a developer, architect, consultant, and executive, building and leading global teams at organizations including Northwestern Mutual, KPMG, and Cyberinc across IGA, PAM, cloud identity, and Zero Trust transformation. Today, CISOs and business leaders trust him to drive enterprise-wide IAM strategy, align identity with cloud modernization and M&A, and build high-performance teams and future-proof operating models. He's also known across the industry for challenging conventional thinking on privileged access management and identity for agentic AI, including his own "Identity Uncertainty Principle," and is the founder and host of the widely listened to Identity Navigator podcast. Stay Connected: ● ⁠https://www.silverfort.com⁠ ● ⁠https://linkedin.com/in/rob-ainscough ⁠ ● ⁠https://www.linkedin.com/in/roy-akerman⁠ ● ⁠https://www.linkedin.com/in/rohit-agnihotri

  ListenShow Notes
• 

  Identity Decoded | The Identity Security Podcast

  Attackers are only as powerful as their permissions: Identity Security lessons from inside Mandiant

  Jul 1, 202632 minS0

  <p>Episode Summary:</p> <p>Chris Linklater from Mandiant has spent his career helping organizations respond to cyber incidents, recover from breaches, and strengthen their security foundations. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to unpack why identity has become one of the most common paths attackers use to gain access, move laterally, and exfiltrate data. Drawing from real-world incident response engagements, Chris explains why organizations often focus too narrowly on privileged accounts while overlooking the risks posed by everyday users, delegated permissions, and poorly governed group memberships. Together, they explore the growing importance...

  ListenShow Notes
• 

  Identity Decoded | The Identity Security Podcast

  Attackers are only as powerful as their permissions: Identity Security lessons from inside Mandiant

  Jul 1, 202632 min

  Episode Summary: Chris Linklater from Mandiant has spent his career helping organizations respond to cyber incidents, recover from breaches, and strengthen their security foundations. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to unpack why identity has become one of the most common paths attackers use to gain access, move laterally, and exfiltrate data. Drawing from real-world incident response engagements, Chris explains why organizations often focus too narrowly on privileged accounts while overlooking the risks posed by everyday users, delegated permissions, and poorly governed group memberships. Together, they explore the growing importance of identity segmentation, asset visibility, and modernization, as well as why security teams need a deeper understanding of both human and non-human identities. Key Topics: 1. Attackers aren't breaking in, they're logging in 2. You can't protect what you don't understand: identities, assets, and dependencies 3. The hidden risks of delegated access and group sprawl 4. Modernizing identity for an AI-accelerated threat landscape 🎧 Episode Highlights [04:41]: Why attackers are increasingly "just logging in" [11:54]: The challenge of containing breaches without disrupting the business [17:20]: Why identity segmentation is as important as network segmentation [18:08]: The hidden risks of delegated access and group management [27:39]: What every organization should learn from a compromised user account 🔑 Key Takeaways: ● Most breaches begin with identity, not sophisticated malware. Attackers increasingly gain access through stolen credentials, phishing, and vishing, making legitimate logins one of the most common entry points into an organization. Securing identity is no longer just an IAM concern, it's a core security priority. ● Visibility determines how effectively an organization can respond to an incident. Teams that understand their identities, assets, permissions, and business dependencies can contain threats more surgically and recover faster. You can't protect what you don't know exists. ● Organizations spend a lot of time protecting privileged accounts, but ordinary users often present just as much risk. A compromised non-privileged account can still expose sensitive data, enable lateral movement, or create a path to escalation. Understanding what a regular user can access is one of the most valuable security exercises a company can undertake. 👤 Guest Spotlight: Chris Linklater Chris Linklater is a cybersecurity leader at Mandiant (part of Google Cloud) with deep experience helping organizations detect, investigate, and respond to some of the world's most complex cyber threats. Over the course of his career, he has worked at the intersection of incident response, threat intelligence, and security operations, advising enterprises on how to strengthen their defenses against an increasingly sophisticated threat landscape. Today, he helps organizations translate frontline threat insights into practical strategies for resilience and security transformation. Stay Connected: ● https://www.silverfort.com ● https://linkedin.com/in/rob-ainscough ● https://www.linkedin.com/in/roy-akerman ● linkedin.com/in/chris-linklater-0323729

  ListenShow Notes

Recent guests on Identity Decoded | The Identity Security Podcast. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.