TRANSCRIPTION 🔗
WEBVTT
00:00:02.560 --> 00:00:05.599
Hello and welcome to the Technology Risk Podcast.
00:00:05.679 --> 00:00:06.799
I'm David Horn.
00:00:07.120 --> 00:00:19.760
Before we get started, I'd like to thank the sponsor of today's episode, Cortics, who help organisations strengthen technology governance, improve operational resilience, and build confidence in the controls that protect their most critical services.
00:00:20.239 --> 00:00:29.679
Now, when people think about cybersecurity, they tend to think about hackers, ransomware, phishing attacks, or perhaps the latest critical vulnerability that's making headlines.
00:00:29.920 --> 00:00:37.600
But if you ask many CISOs today what keeps them awake at night, increasingly the answer isn't malware or firewalls, it's identity.
00:00:37.840 --> 00:00:42.000
In fact, many security leaders now describe identity as the new perimeter.
00:00:42.320 --> 00:00:43.200
Reason's simple.
00:00:43.439 --> 00:00:46.880
Attackers don't necessarily need to break into organisations anymore.
00:00:47.119 --> 00:00:49.600
More often than not, they simply log in.
00:00:49.759 --> 00:01:03.280
And that's what we're going to explore today, why identity security has become one of the most important technology risk challenges facing organizations, where many businesses are getting it wrong, and what good looks like if you're trying to manage identity risk effectively.
00:01:06.879 --> 00:01:08.159
The world has changed.
00:01:08.400 --> 00:01:11.760
Twenty years ago, most organisations had fairly clear boundaries.
00:01:12.000 --> 00:01:14.640
Applications sat inside corporate data centres.
00:01:14.879 --> 00:01:16.640
Employees worked from offices.
00:01:16.879 --> 00:01:20.079
Access was largely restricted to internal networks.
00:01:20.400 --> 00:01:23.760
Security teams focused heavily on protecting the perimeter.
00:01:24.079 --> 00:01:27.200
But today, most organisations operate very differently.
00:01:27.439 --> 00:01:29.359
Applications live in the cloud.
00:01:29.599 --> 00:01:32.239
Employees work from almost anywhere in the world.
00:01:32.480 --> 00:01:35.680
Suppliers connect directly into your business systems.
00:01:35.920 --> 00:01:38.079
Customers access services online.
00:01:38.480 --> 00:01:44.000
And increasingly, artificial intelligence systems are interacting with applications on our behalf.
00:01:44.239 --> 00:01:48.239
In that world, the traditional perimeter has largely disappeared.
00:01:48.480 --> 00:01:51.280
The one thing that remains constant though is identity.
00:01:51.519 --> 00:02:02.959
Every action within an organization is ultimately performed by some form of identity, whether that be a person, a supplier, a service account, an application, or increasingly, an AI agent.
00:02:03.200 --> 00:02:07.120
And that's why identity has become such a critical focus area.
00:02:12.159 --> 00:02:14.479
So why do attackers target identities?
00:02:14.960 --> 00:02:20.400
One of the most interesting
Load full transcript
shifts we've seen over recent years is how attackers gain access to organisations.
00:02:20.639 --> 00:02:24.000
Historically, attackers needed sophisticated exploits.
00:02:24.159 --> 00:02:29.120
They had to find vulnerabilities, develop attack code, and work hard to break through technical defences.
00:02:29.520 --> 00:02:43.039
Today, many attacks start with something much simpler: a compromised account, a stolen password, a successful phishing attack, a supplier account that wasn't properly secured, or perhaps a privileged account with excessive access.
00:02:43.599 --> 00:02:46.080
Let's think about it from an attacker's perspective.
00:02:46.319 --> 00:02:50.560
Why spend weeks trying to break into a building when somebody has left the front door unlocked?
00:02:50.800 --> 00:02:55.199
That's essentially what compromised identities provide: legitimate access.
00:02:55.439 --> 00:02:58.639
And that's what makes identity attacks so dangerous.
00:03:02.719 --> 00:03:07.520
One issue I see repeatedly when reviewing organisations is something called privilege creep.
00:03:07.759 --> 00:03:11.120
Now that sounds quite technical, but the concept is actually very straightforward.
00:03:11.280 --> 00:03:14.240
Imagine somebody joins an organisation in a junior role.
00:03:14.400 --> 00:03:18.719
Over time they get promoted, they move departments, they take on additional responsibilities.
00:03:18.960 --> 00:03:24.000
Every new role requires new access, but often nobody removes the old one.
00:03:24.240 --> 00:03:29.520
Five or ten years later, that individual may have permissions accumulated from multiple previous roles.
00:03:29.759 --> 00:03:35.599
In many organisations, if you ask why somebody has access to a particular system, nobody can actually tell you.
00:03:35.759 --> 00:03:38.000
It's simply because they've always had it.
00:03:38.319 --> 00:03:48.400
And that's where risk starts to emerge, because excessive access doesn't just increase the impact of insider threats, it also increases the potential damage if an account is compromised.
00:03:48.719 --> 00:03:57.360
One of the easiest indicators of identity maturity is whether an organization can confidently explain why people have the access they currently have.
00:03:57.599 --> 00:03:59.120
Surprisingly many can't.
00:03:59.280 --> 00:04:01.439
Now let's take that challenge one step further.
00:04:01.680 --> 00:04:03.599
Not all accounts are created equal.
00:04:03.759 --> 00:04:12.719
Some users can reset passwords, some can create new accounts, some can change security settings, some can effectively control entire environments.
00:04:12.879 --> 00:04:14.639
These are privileged accounts.
00:04:14.879 --> 00:04:19.519
And if there's one category of identity that deserves attention from senior management, it's these.
00:04:19.759 --> 00:04:24.639
Because if a privileged account is compromised, attackers often gain the keys to the kingdom.
00:04:24.800 --> 00:04:34.560
I've seen organisations with hundreds of privileged accounts, I've seen administrators sharing credentials, I've seen service accounts with administrator rights that nobody realised still existed.
00:04:34.800 --> 00:04:40.480
One question I often ask is, how many people in this organisation have administrative access?
00:04:40.720 --> 00:04:44.079
The answer is usually much higher than the leadership expects.
00:04:44.399 --> 00:04:47.120
Mature organisations take a very different approach.
00:04:47.279 --> 00:04:55.279
They minimise privileged access, they monitor it closely, and increasingly they only grant elevated permissions when they're actually needed.
00:05:00.319 --> 00:05:05.279
What's particularly interesting is that many organisations focus heavily on human users.
00:05:05.519 --> 00:05:10.399
Employees receive training, levers are processed, access reviews take place.
00:05:10.639 --> 00:05:13.759
But often the biggest identity risks aren't people at all.
00:05:13.920 --> 00:05:20.319
They're machine identities, service accounts, application accounts, APIs, certificates, cloud workloads.
00:05:20.480 --> 00:05:26.720
These identities often outnumber employees many times over, yet they frequently receive far less scrutiny.
00:05:26.959 --> 00:05:28.560
The challenge is ownership.
00:05:28.720 --> 00:05:32.079
When you ask who owns a service account, the answer is often unclear.
00:05:32.319 --> 00:05:35.120
Maybe it belonged to a project team that no longer exists.
00:05:35.279 --> 00:05:37.600
Maybe the original owner left years ago.
00:05:37.759 --> 00:05:39.519
Maybe nobody really knows.
00:05:39.759 --> 00:05:46.160
And that's where risk accumulates, because unmanaged identities inevitably become poorly controlled identities.
00:05:46.399 --> 00:05:53.199
One of the strongest indicators of identity maturity is whether every identity has a clearly accountable owner.
00:05:53.439 --> 00:05:56.560
Not most identities, every identity.
00:06:01.680 --> 00:06:04.319
Another major challenge involves suppliers.
00:06:04.560 --> 00:06:07.439
Modern organisations rely heavily on third parties.
00:06:07.680 --> 00:06:15.360
Cloud providers, managed service providers, software vendors, consultants, support partners, all of these relationships often require access.
00:06:15.519 --> 00:06:19.279
The problem is that third-party access frequently falls into a grey area.
00:06:19.519 --> 00:06:28.319
Internal teams assume suppliers are managing security, suppliers assume the organization is monitoring access, and somewhere in the middle visibility is lost.
00:06:28.720 --> 00:06:34.639
When major incidents occur, organisations are often surprised by the extent of supplier access that exists.
00:06:34.959 --> 00:06:44.480
One useful exercise is to ask a simple question: if we terminated every supplier relationship tomorrow, could we identify every account that we would need to remove?
00:06:45.040 --> 00:06:49.439
If that answer isn't immediately available,
there may be more risk than people realise.
00:06:54.079 --> 00:06:57.839
Perhaps the biggest identity story right now involves AI agents.
00:06:58.079 --> 00:07:05.759
Increasingly, organisations are deploying systems that can retrieve information, make decisions, trigger workflows, and interact with applications.
00:07:06.079 --> 00:07:10.079
In many ways, these agents are beginning to behave like digital employees.
00:07:10.240 --> 00:07:15.519
But unlike employees, organizations often haven't yet developed governance frameworks for them.
00:07:15.759 --> 00:07:17.600
Who owns the AI agent?
00:07:17.759 --> 00:07:19.360
What systems can it access?
00:07:19.600 --> 00:07:21.199
What actions can it perform?
00:07:21.439 --> 00:07:23.120
How is activity monitored?
00:07:23.360 --> 00:07:25.839
What happens if it behaves unexpectedly?
00:07:26.079 --> 00:07:30.800
These are rapidly becoming some of the most important identity questions organizations face.
00:07:31.279 --> 00:07:33.519
The key principle is actually very simple.
00:07:33.759 --> 00:07:40.319
If an AI agent can perform actions inside your organization, it should be governed just like any other user.
00:07:40.720 --> 00:07:44.959
Unfortunately, many organizations are only beginning that journey.
00:07:48.800 --> 00:07:51.439
One final point that I think is often overlooked.
00:07:51.680 --> 00:07:56.399
Identity security isn't just about preventing attacks, it's also about resilience.
00:07:56.639 --> 00:08:00.959
Think about how many critical services depend on identity platforms today.
00:08:01.439 --> 00:08:10.160
Employees logging into systems, customers accessing applications, administrators managing environments, cloud platforms authenticating users.
00:08:10.399 --> 00:08:13.759
Now imagine your identity platforms become unavailable.
00:08:14.160 --> 00:08:17.120
How long could your organisation continue to operate?
00:08:17.439 --> 00:08:20.720
For many businesses, the answer is surprisingly short.
00:08:20.959 --> 00:08:26.319
That's why leading organisations increasingly treat identity systems as critical infrastructure.
00:08:26.560 --> 00:08:34.480
They test recovery procedures, they validate backup mechanisms, and they ensure that they can recover identity services rapidly following disruption.
00:08:34.720 --> 00:08:40.879
Because ultimately, resilience is about assuming nothing will go wrong, it's about being prepared when it does.
00:08:45.039 --> 00:08:52.240
So, if there's one message I'd leave you with today, it's this identity security is no longer an IT administration activity.
00:08:52.480 --> 00:08:57.600
It's one of the most important technology risk disciplines in any modern organization.
00:08:58.480 --> 00:09:07.440
As organizations become more cloud-based, more interconnected, and increasingly dependent on AI, identity becomes the foundation upon which trust is built.
00:09:07.759 --> 00:09:17.200
The organizations that understand this are investing heavily in identity governance, privileged access management, machine identity management, and resilience.
00:09:17.600 --> 00:09:22.399
Those that don't may discover during an instant that they were far more exposed than they realized.
00:09:24.000 --> 00:09:25.200
I'm David Horn.
00:09:25.519 --> 00:09:28.879
Thank you for listening to the Technology Risk podcast sponsored by Cortex.
00:09:29.120 --> 00:09:34.399
Until next week, stay resilient, stay informed, and stay ahead of Technology Risk.