KuppingerCole Analysts

KuppingerCole Analysts AG is an international, independent analyst organization offering technology research, neutral advice and events in Identity Management, Cybersecurity and Artificial Intelligence.

KuppingerCole Analysts is a technology podcast hosted by Unknown Host, with 416 episodes on record and a Required Pod Score of 80.

Unknown Host hosts KuppingerCole Analysts, a technology show with 416 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  KuppingerCole Analysts

  Analyst Chat #317: MCP Is Just Another API, and That's the Bad News

  Sep 29, 202652 min

  MCP servers are showing up on the internet without authentication, malicious tool definitions are being injected into trusted projects, and three security teams are defending the same environment without sharing a single threat signal. In this week's episode, Matthias sits down with Alexei Balaganski, Lead Analyst and CTO at KuppingerCole Analysts, to dig into the real MCP security problem and why the answer isn't an MCP security product. Key Topics: ✅ The LocalAI attack: 23 unprotected MCP servers, root access in minutes, military data exposed ✅ Is MCP a new security problem or just a new label for old ones? ✅ The Deadbugs attack: how tool descriptions were silently poisoned to manipulate AI agents ✅ Who is responsible for MCP security: Anthropic, the vendor, or you? ✅ Tool poisoning, prompt injection, and the gaps between AppSec, NetSec, and endpoint teams ✅ Monday morning recommendations: what to actually do about MCP security right now "Models reason, APIs act, and identity grants the authority to act" Alexei Balaganski's one-line summary of why MCP security cannot be solved by a single tool or a single team. MCP is a symptom, not the disease, join KuppingerCole Analysts at the upcoming AIdentity & NHI Impact Day , CIAM Impact Day , and Identity-Centric Cybersecurity Summit events in Germany to continue this conversation in person.

  ListenShow Notes
• 

  KuppingerCole Analysts

  Analyst Chat #316: Integration Debt & the Vibe Coding Trap in Identity Management

  Sep 22, 202626 min

  Orchestration has been part of the Identity Fabric concept from the beginning but most organizations are still getting it wrong. In this episode, Matthias sits down with Martin Kuppinger, to explore why orchestration is one of the most underestimated architectural capabilities in identity management, what "integration debt" really means, and why vibe coding is the new Lotus Notes disaster waiting to happen. Key Topics: ✅ Orchestration inside the Identity Fabric: capability, not product category ✅ Integration debt: how organizations quietly accumulate orchestration they no longer understand ✅ The Lotus Notes warning: what vibe coding and no-code/low-code get wrong at scale ✅ Why AI can document and test code — but still doesn't understand what it's doing ✅ Start with orchestration strategy, not the tool — and always ask "how do I get rid of this?" ✅ Ownership and governance: who is responsible for orchestration artifacts when people leave? "Lotus Notes: a wonderful example of where vibe coding went rogue — organizations ending up with thousands of databases, not knowing who did it, why, or if it's still needed." Sound familiar? Martin Kuppinger on why orchestration governance is non-negotiable. Join KuppingerCole Analysts at the AIdentity & NHI Impact Day on October 6th in Munich

  ListenShow Notes
• 

  KuppingerCole Analysts

  Analyst Chat #315: Shadow SaaS, Shadow AI & the Governance Gap

  Sep 7, 202629 min

  SSPM is dead, long live SaaS Security and AI Governance. When Matthias and Matthew last spoke in February, SaaS Security Posture Management was the topic. Six months on, the market has moved decisively: shadow SaaS and shadow AI are now the same problem, and the vendors covering them have merged the two worlds into one. What changed? What do the new capabilities look like? And what does KuppingerCole Analysts' newly published research says about where the market is heading? Key Topics: ✅ Why SSPM is passé — and why SaaS Security and AI Governance belong together ✅ Shadow IT, shadow SaaS, shadow AI: the same problem at increasing speed and scale ✅ Discovery as the foundational capability: you can't govern what you can't see ✅ Where to sniff: browser plugins, email, endpoints, identity providers, and procurement systems ✅ AI agents as a new identity type — and why the controls for humans and NHIs are converging ✅ Market outlook: the AI side is hitting another gear, and acquisitions are coming "The majority of SaaS and AI applications are still unknown to the IT and security team." Matthew Gardiner on why discovery is the gating capability — and why most organizations haven't closed that gap yet.

  ListenShow Notes
• 

  KuppingerCole Analysts

  Analyst Chat #314: Can You Trust AI to Verify AI Code?

  Aug 31, 202636 min

  AI writes the code. But who checks it, and who is accountable when it goes wrong? In this episode, Matthias is joined by two colleagues: Guillaume Teixeron, bringing 20 years of experience on the product side of identity and authentication, and Jonathan Care, KuppingerCole Analysts' Director of Practice AI. Together they tackle the security gap opening up between how fast AI generates code and how slowly organizations are catching up on assurance, provenance, and accountability. Key Topics: ✅ AI in software development: from hype to structural baseline — but governance is still improvised ✅ Three tectonic shifts in AppSec: provenance, scale, and non-human identity ✅ Why organizations have industrialized code production but not code assurance ✅ The core question: can you trust AI to verify AI-generated code? ✅ Agent autonomy in production pipelines — the next flashpoint nobody has resolved yet ✅ How regulation (CRA, NIS2, DORA) will settle the provenance argument before the market does ⚡ "We have industrialized code production. We have not industrialized code assurance." Jonathan Care on why the security control set was built for human-authored code moving at human speed — and neither assumption is true anymore. Join KuppingerCole Analysts at the AIdentity & NHI Impact Day in Munich this October — where the accountability and provenance questions raised in this episode will be front and center.

  ListenShow Notes
• 

  KuppingerCole Analysts

  Analyst Chat #313: When AI Agents Don't Play Nice - Multi-Agent Security Risks

  Aug 24, 202637 min

  What happens when you put three AI agents in a room and tell them to solve the same problem? Anthropic ran the experiment — and the results are more unsettling than you'd expect. In this episode, Matthias Reinwarth sits down with Jonathan Care, KuppingerCole Analysts' newly appointed Director of Practice AI, to unpack the findings and ask what they mean for enterprise security, identity management, and the CISOs trying to govern it all. Key Topics: ✅ Anthropic's multi-agent experiment: three Claude instances, one codebase, unexpected outcomes ✅ Why coordination does not emerge naturally from intelligence — in agents or in humans ✅ The anthropomorphism trap: why comparing agents to dogs, kids, and wizards is useful but dangerous ✅ Social pressure, mechanisms, and the open research problem of agent cooperation ✅ Risk tolerance as a prerequisite for any agentic architecture — and how to define it ✅ Why correlated agents without coordination break your redundancy and business continuity assumptions "If agents are highly correlated but lack coordination, redundancy does not provide the risk diversification we would expect." Jonathan Care on why multi-agent systems are a different beast and why CISOs need to treat them that way. Join KuppingerCole Analysts at the AIdentity & NHI Impact Day on October 6th in Munich where many of the open questions raised in this episode will be on the agenda

  ListenShow Notes

Recent guests on KuppingerCole Analysts. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.