Latest / Identity at the Center / #409 - Q1 2026 Identity Threat Report Roundup

Transcript

#409 - Q1 2026 Identity Threat Report Roundup · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good got about a foot of snow
0:18
over the weekend. The rest of the country seems to
0:20
be getting warmer, but not in South Dakota.
0:24
That is too much snow. We're fighting for the winter.
0:28
It's raining here in the Asheville, NC area and maybe
0:32
turns to snow a little bit later today.
0:34
And I've got to drive out to Charlotte right after we record
0:36
this. So I have the feeling split in
0:38
those days where I think everybody's experienced this,
0:40
where you have to make a trip and you're travelling with the
0:43
weather. So I think I'll be like with
0:46
this little, you know, Stormfront that's kind of moving
0:49
along to the east. Yeah, it's kind of scary when
0:52
you see like, tornado, I don't know.
0:56
Denise is a real tornado person. Like she knows her although all
1:01
the Tornadoes are popping up and she has an app for it and
1:04
everything and gets me worried, gets me feeling anxious.
1:08
I think anyone who's grown up in the Midwest, myself included,
1:11
had tornadoes throughout their lives.
1:13
So definitely in the Chicago area we would have those.
1:16
We had tornadoes actually come through a Kankakee area a few
1:19
weeks ago and I have some down members down there that had some
1:22
damage to their house and cars and stuff like that.
1:24
But fortunate everybody was OK. But tornadoes are are no joke.
1:28
Yeah, she might not enjoy going to the sphere for the Wizard of
1:33
Oz like that's the game plan, but might be too intense for
1:37
her. Yeah, you said that like it
1:38
blows wind around or something. It's like a a sensory
1:41
experience, not just the audio individual.
1:42
Huh. Yeah, it sounds like there's
1:44
like raindrops and leaves that fly around as well.
1:48
So this is like third hand information.
1:51
I might be totally like, you know, totally blowing it up into
1:56
something is not. So you know, well that's it,
2:01
that's it. Now making it something that's
2:04
part of the the history of the Internet.
2:06
Yep, and this will get transcribed and it'll end up in,
2:09
you know, podcast players and therefore become fact and on the
2:13
record. So no disputing the the the
2:15
knowledge that's being shared here, whether it's right or
2:18
wrong. That's right.
2:19
Do we have a wiki? A Wikipedia page yet?
2:23
I have no idea. I haven't even.
2:24
We should have one. It hasn't even occurred to me
2:26
why we would have a Wikipedia page.
2:28
Oh yeah? Well, I don't know if you're
2:30
supposed to write one about yourself or if that's something
2:33
that has to be pursued on you like a nickname.
2:36
I think it would be weird to write your own Wikipedia page
2:39
that just seems kind of self promotional.
2:41
I'm I'm not interested in that. I still want to write one fine,
2:43
but that I'm not about that. Yeah, I'm not about that life
2:47
either. You know what life I am about in
2:51
clever Segways is conferences. We've got a few different ones
2:54
coming up. We've got EIC, European Identity
2:57
and Cloud Conference coming up in Berlin in a couple months.
3:00
So you and I are headed up to Berlin in May for that.
3:04
That'll be fun. I know we haven't really kind of
3:05
figured out what we're going to do while we're out there, but I
3:09
I assume we'll be recording some podcasts, right?
3:11
We are recording some podcasts, yeah, so I don't want to mention
3:14
the guests names yet, but going to record 2 to 3 podcasts while
3:18
we're there. Plus we'll do the identity or
3:21
episodes. It's always fun just to spend
3:25
time with our, you know, people who are aware of the podcasts
3:29
out there or people maybe who aren't and we're meeting them
3:32
for the first time and they're just becoming aware of the
3:34
podcasts and the community that we're trying to build around it.
3:38
I mean, it's really this identity practitioner community.
3:42
So ID pro our podcast, there's other things that kind of the
3:48
entire community rallies behind and I'm just, you know, you
3:53
know, glad to be part of that. Yeah, it's a warm, welcoming
3:56
community, happy to be a part of it.
3:58
And the water is warm, so come on in.
4:01
You can come on in. Yeah, you can be as
4:03
demonstrative or just a wallflower.
4:05
Either way, you know all are accepted.
4:09
That's right. Yeah.
4:10
One of the things that's great about recording a couple extra
4:12
episodes that, you know, at the conferences in the summer is
4:16
that it's the summer and usually we, you know, want to take some
4:21
time off and take a break from all the recordings.
4:24
So if we can, you know, do a a power couple of hours and record
4:29
a few podcasts, that always helps.
4:31
Yeah, I remember the old days where it would be you and I
4:34
trying to like record episodes and then kind of get them out
4:36
the next day. And that was just like, that's
4:38
not sustainable, so. Yeah, it's not really good.
4:40
I. Think you want to go to the
4:41
conference and enjoy it rather than be like in a hotel room
4:43
editing, you know, 20 hours a day?
4:46
Yeah, no, that was kind of crazy.
4:49
But I think the one reason I bring up conferences in the
4:52
beginning of all the episodes is that we have discount codes.
4:56
Go to our website, idcpodcast.com.
4:59
All the discount codes are listed there.
5:01
You can just copy and paste them in in the registration form.
5:03
I think we even link right to the registration form for the
5:07
conferences that give us the discount codes.
5:09
And by the way, if you're listening and you run a
5:12
conference or are connected to folks who run a conference and
5:16
you want to have your discount code listed, you don't need to
5:19
be a sponsor of the podcast. If you're doing something for
5:21
the community, like giving a discount, we are more than happy
5:25
to to share that out using the the platform.
5:29
Yeah, for sure. Have them all listed there at on
5:31
the website, Scroll down, try to keep everything updated as best
5:33
as I can. I know you and I are looking to
5:35
get to RSA. Maybe I don't think we're going
5:37
this year, but next year. So maybe if somebody has any
5:41
pull with the RSA folks, let us know, put us in touch.
5:44
We'd be happy to like, figure out how to get the podcast out
5:46
there as well. Yeah.
5:48
Or if the RSA folks are listening, we'd like to come in
5:51
and and bring the podcast experience to RSA, you know,
5:55
they, they could use the growth in their, in their conference.
5:58
Yeah, exactly. They're, they're, they're a
6:00
small struggling conference that needs a lot of help.
6:02
So we're happy to to lend the power of our platform for that.
6:05
Yeah, exactly. What else do we have coming up?
6:07
Well, after EIC, we've got Identiverse in June, so looking
6:10
forward to that. So of course, discount codes for
6:14
that one as well. Check our website, but that'll
6:15
be in June. In Vegas, you and I will have
6:18
another game show type session. I don't think we've locked it
6:22
down completely as far as like time and date, probably the
6:25
opening night. But to hold us to that, that is
6:27
subject to change. And then of course, we'll be
6:29
probably recording some episodes there.
6:31
I think we'll have a, a booth like we did last year, kind of
6:33
out on the show floor that, you know, we'll be recording some
6:35
live episodes from and hopefully people will wander by and say
6:39
hello. Yeah, yeah.
6:40
We love the conference and you know, you and I enjoy Vegas and
6:44
I know that everyone shares that opinion, but try to make the
6:48
most of it. Try to.
6:49
I mean, there's a lot of experience out there.
6:51
I mentioned the sphere. Everybody can find something to
6:55
do there. Yeah, I enjoy it.
6:59
There are. There are ways to find enjoyment
7:00
no matter where you are, and I try to look for that.
7:03
Yeah, exactly. Exactly.
7:06
All right. So for this episode, we kind of
7:08
decided to take a step back for this first quarter, which
7:11
shockingly is almost gone. I think by the time people
7:13
listen to this, I think next week, it'll be basically over.
7:17
And there were a few different reports in the IM industry that
7:20
were kind of put out. So decided to just take those
7:22
episodes like at a high level, kind of talk through what the
7:25
reports were. We'll have links in our show
7:27
notes for all of these reports. So hopefully as many direct
7:30
links as I can find to go there so that hopefully, you know,
7:33
it'll be less spammy if I can avoid it.
7:36
But I'm sure for, you know, some of these you'll have to exchange
7:40
a e-mail, you know, for the report itself, that's to see the
7:43
actual data. But there were six or seven, I
7:46
believe that kind of put together on this list.
7:48
And So what I'm going to do is kind of talk about the report,
7:51
say here's what it is, here's some of the high level stuff,
7:54
maybe on it. Jim is going to take his hot
7:55
takes and then we'll kind of move to the next one.
7:58
And hopefully we can get through everything we've got on the list
8:00
and the time we've kind of set aside for this.
8:02
So, Jim, Are you ready? I'm ready.
8:05
Are you ready? I'm always ready.
8:07
Let's start with the first one, the Checkpoint Cybersecurity
8:10
Report 2026. This one came out in January
8:14
28th of this year. Basically the kind of high
8:18
levels on this were of course risky AI prompts increased quite
8:22
a bit shocking that our first report, it's going to talk about
8:26
AI right away. And of course, identity
8:29
weaknesses, misconfigurations, unmanaged assets.
8:32
I'm reading through my notes here were always, you know, a,
8:35
a, a problem there throughout the year.
8:38
But what do you, what are your hot takes?
8:40
What do you take out of this report?
8:42
Few things. So probably number one was
8:47
around this AI PS and it being not just more attacks because
8:53
there are that there is that right, There's more attacks
8:56
happening, but the speed of the attacks are all happening at
9:00
programming speed. So it talks a little bit about
9:03
how long the attacks took, something in the neighborhood of
9:06
like on average the one hour attack where you go from initial
9:11
intrusion all the way through data exfiltration or data
9:15
encryption taking like an hour to two hours.
9:19
That's happening so fast that there's not time to shift into
9:24
human defenses, right? So that's kind of hot take
9:29
number one. I think hot take #2 was around,
9:33
you know, we're, we're seeing it and we're talking about it,
9:36
which is that MFA by itself and not just good MFA versus bad
9:41
MFA, but just counting on the initial authentication alone is
9:48
not enough, right? And you hear Ian Glazer talk
9:51
about this continuous identity, continuous authentication.
9:55
And that's really what this is speak to.
9:57
And by the way, like all the reports we're going to talk
10:00
about today, I don't think anything came out where it's
10:02
like, Oh my gosh, like I hadn't thought of that at all.
10:05
Like these are all friends that are major things that are
10:08
happening within the industry. And if you walk the halls of the
10:12
vendor hall in any like of the major identity conferences is
10:16
full of solutions that talk about these problems.
10:19
So the speed of AI attacks, the need for continuous identity and
10:26
not just banking on MFA. And then kind of the third one
10:30
was around machine identities and them being the next big
10:36
identity crisis. So you have all these machine
10:39
identity, so it's accounts that you're using to connect your SSO
10:46
site to your, your IDP, to your SAS applications, it's API keys.
10:52
It's all the things that if you're not doing a good job of
10:55
managing those, those are the targets.
10:57
Those are the way that folks get entrance.
10:59
And by the way, like the API keys are are, I'm sorry the the
11:03
admin accounts for your SAS applications like those are the
11:07
crown jewels now. Yeah, there's so much going on
11:11
here. I think there were a couple of
11:12
things that kind of struck out to me was the the usage of MPMCP
11:16
servers, which is supposed to be the savior of how, you know,
11:19
things interact with each other. I think they found roughly like
11:22
40% were, you know, not configured securely.
11:26
Yeah, that's a lot, especially when you're considering that
11:29
those MCP servers probably branch out to other MCP servers.
11:31
So it can be a compounding problem as you go through it.
11:35
The other thing that I thought was interesting was the delivery
11:38
mechanism for a lot of the malicious files was
11:41
predominantly e-mail. I think it was something like
11:44
over 80% of the the path for the emails coming in or or 80 / 80%
11:51
of the map, the malicious delivery of of intent came in
11:57
through e-mail. So that was interesting to me
11:59
that people are still clicking on things in emails and still
12:03
downloading and still running things that they don't
12:05
recognize. But hey, that's why we have
12:07
jobs. Yeah, right.
12:11
Anything else jump out of you on this report?
12:13
No, I, you know, we have like 7 reports we want to get through,
12:17
right? I think there's some themes that
12:19
are going to repeat as we go, so we probably ought to go through
12:24
them somewhat quickly and then talk about like the big
12:27
takeaways afterwards. OK, I'm going to go ahead and
12:30
like predict AI. So in a shock to no one, yeah,
12:34
probably at this point. All right, the next report was
12:37
recorded future 2026 State of Security report.
12:40
This one came out in February. What are your thoughts on this
12:43
one? Well, this is to your point.
12:48
So, so First off, the the backdrop to all this is the idea
12:52
of not just cybercrime for the fact of stealing monetary type
12:59
assets, right? It's also the geopolitical
13:02
context and hacktivists and kind of this Venn diagram, if you
13:07
will, of the three of those and the intersecting circles.
13:11
And so that was the background of it.
13:15
But I think what kind of the cybersecurity takeaways were,
13:21
you know, there's a lot about AI to kind of like get people's,
13:28
you know, to basically make the, the phishing process on the
13:32
social engineering process more successful.
13:38
And then about the the cyber criminals using that to get onto
13:42
networks, kind of live off the land or not set off alarm flags.
13:48
So kind of the learning coming away from this is that the, the
13:53
threat actors get, get onto your network and then try to stay
13:57
there unnoticed while they slowly discover your network,
14:02
right? They're not doing things that
14:03
will like, hey, we're going to hit the HR database right away,
14:07
or we're going to start scanning the network right away or doing
14:10
things that would immediately set off alarm bells.
14:14
We've known about this. I mean, I think I, I remember
14:18
there's maybe the IBM threat Vectors report, which is a big
14:21
one in our industry saying something like the average from
14:26
the time of, of the initial intrusion to the time of
14:30
detection of something like 170 days on average, which on
14:34
average means like there are a lot that are a lot longer than
14:37
that. So keep all that in mind.
14:39
And I think it tells you that, you know, as the identity
14:44
practitioners, we need better tools to discover if we've
14:48
already been preached, if we already have somebody on our
14:51
network who's just basically, you know, trying to lay low.
14:56
Yeah, this one seems like it had a lot more to do with a
14:59
geopolitics as well as artificial identities.
15:04
So deepfakes identities up like 1010 times compared to 2024.
15:09
Synthetic identity fraud was up like 300%, something like that.
15:13
Lots of new ransomware variants, which was like a third increase
15:17
over the year before that. Now specifically called out
15:20
nation states like China, Russia, Iran and North Korea
15:25
basically being covert and kind of lying in wait to your to your
15:28
point, sitting there with access but not really doing anything
15:32
with it yet. And most of these most of these
15:36
issues were coming through identity again, credentials
15:40
rather than like a technical exploit of some sort.
15:42
So. And that's crazy when you think
15:44
about like China or Russia, because then you think like, oh,
15:48
they're using some kind of 0 day exploit, right?
15:51
These are advanced hackers, but and while those things do
15:55
happen, the preferred methodology is like just find
15:59
somebody's credentials and login.
16:02
And that's like you hear every executive who knows a little bit
16:06
about cybersecurity nowadays saying hackers don't break in,
16:09
they login. It's like, yes, that's obvious,
16:14
but sometimes the obvious stuff needs to continue to be restated
16:18
because it's not core truth of what we do.
16:22
Yeah, identity at the center, baby, for good or for bad.
16:27
All right, let's get to the next one.
16:29
Sophos Active Adversary Report 2026, not the one that came out
16:33
in February. So just within the last month.
16:36
Some of the highlights on this one, 2/3 of the incidents were
16:41
identity related as a root cause.
16:44
MFA was missing in almost I think 60% of the attacks.
16:49
So that's bad brute force getting just as popular as
16:55
exploitation as an initial access method.
16:58
So again, identity at the center photo of another report.
17:03
What are your thoughts on the SOFOS report?
17:06
I, you know, I, I think you're, you're right on is that it's
17:09
another one where identity is or AI is a recurring theme.
17:14
What I thought made this report different was a little bit of a
17:18
focus on identity infrastructure as kind of a where, where folks
17:26
or where the the attackers were focusing their attack paths on.
17:32
It's like the identity infrastructure.
17:34
So identity infrastructure needs to be protected.
17:39
That's the ITDR. It's kind of the ISISPM, like
17:44
really understanding where you have potential breaches to make
17:47
it harder to attack your identity infrastructure, Like
17:51
identify the gaps, identify potentially where you have weak
17:55
passwords or where you have like default configurations that just
18:00
make it easier for for the attackers to gain entry into
18:06
your system. Those are some of the things
18:09
that jumped out at me about this one.
18:10
Yeah. I think there was another thing
18:13
was talking about the median attacker to all times.
18:15
So how long the attackers in the environment before you find out?
18:19
And they said it was down to three days, which is great.
18:21
Hey, progress is progress, but three whole days in an
18:24
environment that's still far too long.
18:26
And so you know, that's something to take a look at.
18:30
And I think this is, I'm not sure.
18:32
I have to look at my notes on the other reports, but this one
18:34
also mentioned AI but not what I expected in that there was no
18:38
evidence of major AI driven transformation in how like the
18:44
attacker behavior was found. Which I find interesting because
18:47
pretty much every other report seems to indicate AI is
18:50
accelerating things and and this one did not come to that
18:54
conclusion. Yeah.
18:56
You know, I think that the whole 12 time thing also is, you know,
19:00
if you have, if you're like a hacktivist, right, your goal
19:04
might be to time and exploit or you know, your action around
19:10
something that your target did. So for example, if you're if it
19:16
was a nonprofit organization or political action committee that
19:20
you know you were against or your your hacking organization
19:25
was against, you might wait until they make some big
19:29
announcement or something happens and then try to defame
19:33
their website or hold them for ransom or things like that.
19:37
If your motivation is strictly profit, you might want to get in
19:42
and conduct an exploit as quickly as possible, right?
19:45
If you're just saying I want to encrypt this database and or
19:50
steal these files, like once you find them, why wait?
19:54
Why sit and wait? Yeah, Well, I think there's you.
19:57
You've, I mean, these are basically two different types of
20:01
motives, right? One is to make money.
20:03
And that is the one where just spray and pray, get as many
20:07
things as you can out there in the wild and see what hits.
20:09
And if you get 1% back, that's a great success rate, you know,
20:13
for some of these folks, because somebody's going to pay.
20:16
And then the other one is a target attack, which is much
20:18
more difficult to defend against.
20:20
If someone is actively targeting your organization, you know that
20:24
is. That is when you're really in
20:26
trouble and you've really got to get put hand all hands on deck
20:28
and and try to batten down as many holes as possible.
20:31
So you know, that's that's a whole different beast that
20:35
frankly, I don't ever want to be.
20:36
I don't want to be a part of that right now.
20:38
Want to keep a? Yeah, right.
20:40
Definitely. All right.
20:42
The next report came from Palo Alto Networks Unit 42 Global
20:47
Incident Response Report, this one also in February.
20:50
Some of the highlights in this one, again, identity weaknesses
20:54
and nearly 90% of the investigation, which is more
20:57
than the 80% that I typically hear.
20:58
So I wonder where they came with the 90%, if they're just
21:02
identifying more or associating more of those investigations
21:06
with an identity issue. Let's see, 65% of initial access
21:11
was identity driven. And I liked the stat.
21:14
The fastest attacks in 2025 reached data exfiltration in
21:18
just 72 minutes, down from 285 minutes.
21:23
So almost a four fold increase in, you know, in the speed with
21:28
which the attacker was able to abscond with data.
21:33
Yeah. Well, and you know, out of
21:36
transparency, I mixed up one of my points there with the last
21:40
report. It was actually this report that
21:43
wanted to the identity infrastructure as the main take
21:46
away. And you know, the biggest
21:49
vulnerability in most organizations is now their
21:53
identity infrastructure. So really understanding where
21:57
your caps are relative to your identity infrastructure and
22:01
understanding like, hey, will your MFA, for example, if you're
22:07
depending on MFA as, as your main control, which a lot of
22:10
organizations are for entry onto your network or access to your
22:14
cloud applications, are you susceptible to a man in the
22:18
middle attack? And if you're using like a
22:20
weaker form of MFA, something that's fishable, then the answer
22:24
is yes. All right, next report, this one
22:26
just came out within the last week or so from IBM, the X Force
22:30
Threat Intelligence Index 2026. Couple highlights from this one.
22:35
From what I saw, public facing applications were the most
22:39
common initial access factor, 44% increase from the prior
22:44
year, more extortion groups, not surprised there at all.
22:49
And this is the one that kind of 1st called out the major supply
22:52
chain and 3rd party breaches quadrupled over five years.
22:55
So, and tackers are increasingly going after identity
22:59
integrations, cloud interfaces, all the different back end
23:03
processors that you might have with an organization and
23:07
definitely something to look at. You know, shout out to, you
23:09
know, the couple of sessions that I actually moderated for
23:13
the cybersecurity summits and Chicago and Philadelphia and
23:16
happening in other country or sorry, cities around the US this
23:20
year. My session was moderating a
23:23
discussion on supply chain risk. And so this one's kind of near
23:27
and dear to something I just recently, you know, had
23:29
interactions with. Yeah, no, definitely supply
23:33
chain risk, but you know, because if you can take over
23:36
major infrastructure pieces that have access to the entire
23:41
network or to the entire environment.
23:44
And that's why identity is such a, an ideal attack point.
23:50
You know, I think that the the point that you brought up
23:54
earlier about the cybercrime organizations being more
23:59
fragmented, you you said it was more, but I the take away that I
24:04
had reading the report was that it was just smaller groups.
24:11
Maybe it was people splitting off from larger groups and but
24:15
it's also harder for Are you telling me?
24:18
There's no honor among thieves. No honor among thieves, Right?
24:21
Exactly. You know, the the idea being
24:25
that these groups operate in like smaller units.
24:27
So there's not just big fishing groups or big, you know,
24:35
ransomware groups out there like like there had been in the past.
24:38
Their operating was smaller. And I heard one, I saw one part,
24:42
I think it was this report referred to it as like a gig
24:46
economy. So there's people with computer
24:48
skills and obviously like some ethical concerns who look at
24:53
this as a way to just supplement their income.
24:56
They're doing it as like a part time job.
24:59
And when you know, when you think about what happened with
25:02
the scatters fighter, I think also about this fragmentation
25:07
terms of specialization. So if your specialty is getting,
25:13
you know, social engineering, you focus on social engineering,
25:17
getting the credentials, then selling the credentials.
25:19
And another specialist may work in the length of ransomware
25:24
software like getting into a network.
25:26
Now they can basically can just log right in somebody else, give
25:29
them the login, or they purchase the login and get into the
25:32
network and execute the rest of the exploit.
25:38
I think about when you think about it from that perspective,
25:40
it's like it's really hard. It seems like it would be really
25:43
hard to keep up, but ultimately where everything starts with
25:47
that credential. So when you think about social
25:51
engineering, fishing, and I think a lot of organizations get
25:54
this right. We harp on this point a lot on
25:56
the podcast and you, you're starting to, you know, to see
26:01
like even in the organization that we work for, I shouldn't
26:05
say you're starting to see it. You've been seeing it for a
26:07
while where you get like these, these phishing emails, right?
26:11
And you're supposed to report them or at very least not like
26:14
click on them, right? So we've even people who are not
26:19
super technical historically are getting used to spotting spam
26:25
and saying I'm not going to click on this link because I
26:29
think it's a, it's not a real link.
26:32
People are getting smarter, but so are the attackers.
26:34
You know, we kind of point back to the poorly written e-mail
26:37
spam, you know, from our, you know, Princess that we're trying
26:40
to get money into the, into the US that are now very well
26:43
crafted. You know, I want to go back to a
26:46
point you made around the number of, I guess, threat actors and
26:50
these groups kind of splintering to smaller groups.
26:52
I think this is AI at work here, or at least that's one of the
26:56
one of the reasons because just as you know, everyone is getting
26:59
more efficient with AI, so are attackers.
27:01
You don't need as many people before because if you have a
27:05
bunch of AI bots running around, you can outsource that to your
27:08
own AI agents that are doing bad things.
27:10
So it wouldn't surprise me to read between the details there
27:13
or between the lines in the report and say, hey, you know,
27:16
not only is obviously the the good guys getting more
27:18
efficient, so are the bad guys than some of these groups that,
27:20
you know, used to be, you know, large organizations and that gig
27:24
economy are becoming a little more self-sufficient.
27:26
And you just don't need as many people.
27:27
And so, yeah, they go and splinter off and say, OK, we're
27:30
going to do our own thing and make some money off of it.
27:33
Yeah. And I would say that's a
27:35
probably a trend that's going to continue.
27:39
You know it's not going to reverse itself anytime soon.
27:43
Yeah, one, one man shop with a whole bunch of AI agents, open
27:46
claws and all kinds of different things that are, you know, doing
27:50
bad things. Let's get to the next report
27:52
here, the Dark Trace Annual Threat Report 2026, this one
27:56
else that just came out in the last week.
27:58
Let's see highlights. 70% of incidents in the Americas began
28:03
with stolen or misused accounts. Registered software
28:07
vulnerabilities rose 20% even though attackers shifted towards
28:12
credential abuse of course. And then Azure as the most
28:15
targeted cloud provider, accounting for 43.5% of malware
28:20
samples, which I find surprising.
28:22
I would have thought AWS would be 1, but at least according to
28:26
Dark Dress, Azure was was the top spot.
28:29
Yeah. And look, the more we go through
28:32
this list, the more it's going to, we're going to struggle to
28:35
find new things to talk about. I think, you know, a lot of the
28:40
themes about identity becoming the most important attack
28:45
factor, then transitioning to ransomware once you're in the
28:50
door, trying to get in the door and remain undetected and
28:57
attacks happening at AI speed. So those are kind of some of the
29:01
common themes up to this point. I think the when I read this
29:05
report, you know, my take away was they're really pushing for
29:11
folks to take that detection piece seriously.
29:14
Like almost to the extent that, look, we know we can get to 98%
29:22
or 99% of stopping people from giving up the credentials or
29:28
losing the credentials through social engineering or fishing,
29:31
but we'll never get to 100%. So in other words, you know,
29:34
people are going to get creds and get in.
29:37
The key is going to be how to detect them.
29:41
So in this report to talk about investing in tools to detect
29:45
them, I think that one of the previous tools talked about
29:48
using continuous authentication, continuous identity.
29:54
And I would, I didn't see it anywhere in these reports.
29:57
But kind of shifting more toward a zero trust, not just the zero
30:02
trust environment, but zero standing privileges kind of
30:06
approach. Those things are going to be key
30:10
to preventing kind of these major breaches.
30:14
Yeah. I mean, I think zero trust is
30:16
sort of like foregone conclusion that yeah, everybody kind of
30:18
should be doing that. The 0 standing privilege that I
30:20
struggle with, I it's a great idea, but I think it's really
30:23
tough to do in real life. I don't think most organizations
30:26
are ready to dynamically add and remove permissions to their
30:31
humans and their non their non humans are probably easier
30:33
because that's a little programmatic.
30:35
But you know, there's very few organizations said that have
30:38
reached the maturity where they are actually capable of doing 0
30:42
standing privileges. Yeah, I, I think today that's
30:46
that's probably true because humans operate at human speed.
30:50
We only get so much done. Eventually AI power tool should
30:55
be able to enable us to do that at scale.
30:59
Yeah, an AI that says you can't do that, sorry.
31:02
One thing that just occurred to me was like one other common
31:05
theme that like all these reports started with is that the
31:09
number of breaches has grown tremendously fast.
31:14
And that, you know, they, they all kind of point back or not
31:17
back to AI as being the reason like the number of attempts to
31:23
attack or like, you know, off the charts.
31:27
And then the number that succeed are going to be some percentage
31:31
of that regardless of how many they try.
31:33
So you know AI is enabling or can see or enabling the
31:39
attackers to attack at a much greater rate than before.
31:43
Yep, more, more attempts equals more breaches.
31:47
You know, even if you spot, even if you block 95% or 99%, it's
31:52
still a 1% game. 1% of 100 is one 1% of bigger numbers gross.
31:58
All right, So it's just going to be more breaches.
32:00
Just just thinking about those Nigerian Prince emails, because
32:05
you get them and you're like, who the heck would ever send
32:09
these people money? And then you think like, well,
32:12
they send a million of them. If two people send them money,
32:16
that's a incredibly small percentage, right?
32:19
Yeah. But if two people send the
32:21
money, it costs them nothing to send it to 1,000,000 versus, you
32:25
know, to 500 people. Yeah.
32:27
And now with AI it's even easier.
32:29
You know what that whole like, you know, sending money and gift
32:33
card scams and things like that. You know, I'm seeing more
32:36
headlines around banks being on the front line of those and
32:40
trying to protect their customers, obviously ultimately
32:42
themselves from losing that money from a fraud claim, which
32:45
I find interesting that banks are now, you know, on the front
32:50
side of protecting customers before the issues happened.
32:54
Have you ever seen, I can't remember her name, but she's I
32:59
think with National Geographic and she also have not.
33:03
I have no idea what you're. Talking about there are there
33:05
are on YouTube, but she does these investigations of like
33:09
different types of fraud people do around the world.
33:12
And one of them that she did a episode on was the call centers
33:17
that they have all over the world where people just
33:21
basically once they get somebody hooked, you know, think about
33:26
how many times like, you know, you get like these fake phone
33:29
calls or if you were to click on one of these emails, eventually
33:34
it might turn into a phone call. There's just people who are
33:36
operating these frauds and some of them it's like hundreds of
33:41
people in a location doing that. Now I don't know with what we
33:44
talked about earlier if that is breaking up and like those kind
33:48
of groups don't exist as much anymore, But the local
33:51
authorities for the most part look the other way.
33:56
Yeah, I think it depends on where you're at, but you're
33:58
totally right. These are these are operations,
34:00
they are companies that their entire job is to scam people out
34:03
of money. I'll give a shout out to I I, I
34:07
first discovered him on Twitch, but he's also on YouTube.
34:09
Kit Boga KITBOGAI think it is and he messes with scammers all
34:14
the time and kind of calls in with like crazy voices and, you
34:17
know, tries to take down their, you know, their, their systems
34:19
and things like that and just kind of waste their time, which
34:21
is kind of the best thing you can do if you're not super
34:24
technical and want to, you know, try to hack them is waste their
34:28
time so they're not actually, you know, inflicting harm on
34:30
others. But that's an interesting
34:31
channel. If you ever want to like, you
34:34
know, have some fun with scammers or see what other
34:36
people have fun with it. This Dark Trace report had a
34:39
couple other things that kind of jumped out at me, and one was QR
34:43
code fishing was up on this one. So, you know, I think everyone's
34:48
familiar with QR codes appearing on screens and I think we use
34:50
one sometimes on, you know, stuff that we do at conferences
34:54
or maybe, but that is also becoming an attack factor that
34:57
we have to look out for. And then to your point around,
35:01
you know, fishing and sort of goods that are too good to be
35:04
true, Black Friday was up big time in 2025.
35:08
It was like over six times as many in the previous year or so.
35:12
You know, lots of, lots of avenues to, to, to be exploited.
35:16
You know, both personally and professionally.
35:18
So I'm glad you talked for a minute there to give me a chance
35:21
to Google. This National Geographic show is
35:24
called Trafficked and it's with Marina Maria Marie Mariana van
35:31
Zeller. Anyway, hit up YouTube.
35:34
They're all on YouTube and they're really, really good.
35:39
All right. Traffic is what you call it.
35:41
Trafficked, Trafficked. National Geographic.
35:45
National Geographic So the first one that came up was crypto
35:48
scams because there's others on like drug trafficking and all
35:56
kinds of like bad stuff that happens in the world.
36:00
There are a lot of, there are a lot of them that are very
36:02
specific to, you know, the cybersecurity space.
36:09
Well, you know, there's the meme trafficking so hot right now.
36:14
Everybody wants to be in trafficking.
36:15
Right, all right, the last report on our list here is from
36:19
our friends at Hyper, the 2026 State of Password List Identity
36:23
Assurance report. This one just came out within
36:25
the last week. Couple highlights from this fine
36:28
this time again, generative AI and agentic AI have displaced
36:33
stolen credentials as the primary identity security
36:35
concern. So this report is claiming that
36:39
AI has basically taken over stolen credentials. 87% of
36:43
organizations, which I find the stat to be kind of staggering,
36:47
encountered a audio or video deep fake in an identity based
36:51
attack. So this, this thing that we've
36:53
been talking about for a while, 87%, I think they had like 900
36:58
people or 900 organizations that were part of their sample size,
37:03
87%. Double, yeah, that number sounds
37:05
high. It does sound high, but I mean,
37:08
even if it was 8%, I'd still be like, wow, we're really moving.
37:13
So if it's a high percentage like that, like over the
37:16
majority, I mean, that's just that change is a game.
37:19
That's almost everybody has to deal with some sort of deep
37:22
fake. Yeah.
37:24
Now, that could be something with, you know, Hyper's customer
37:26
base, you know, being on the fraud side of things makes
37:29
sense, right? That sort of thing.
37:30
But again, it's a real thing happening in the real world.
37:34
So here's some real world, real world advice that I got from
37:38
another podcast. So, you know, I listen to other
37:40
podcasts. Shout out to the another AI.
37:45
We're not an AI podcast, not yet officially anyway.
37:49
So the moon shots podcast and this thing is like way longer
37:55
than most people have to dedicate the podcast, but they
37:58
recommend having a a secret code word within your family or
38:05
people who you might get deepfaked by.
38:07
So your spouse, your kids, things like that, your parents,
38:11
if essentially you think they would be calling you and asking
38:14
you for money, the ideas, then yeah, some for what the code
38:17
word does and for code word does something like bananas or
38:21
something like that that wouldn't be guessed minds, not
38:24
bananas, by the way, So don't even try it.
38:28
But if you have a code word like that, So it's kind of like
38:31
having a, you know, I think we all learned this during 9/11,
38:36
which was to have a family plan like, hey, if the communication
38:39
networks go down, everybody do this thing.
38:43
You know, like, it was because while I lived in New Jersey and
38:46
a lot of the phone service stopped working and people
38:49
couldn't get in touch with folks.
38:51
But, you know, you kind of said, OK, well, what if this was even
38:54
a bigger disaster? What if like the whole telecom
38:57
system went down, we couldn't get in touch with each other?
39:01
What would our plan be well be to get back to the house and if
39:04
that so, but then you also need a Plan B.
39:06
It's kind of like just ask the recovery planning like we do for
39:09
IT but for our personal lives. Yeah, I, I mean, that sounds
39:14
cool. It sounds great idea, but I
39:16
just, I just immediately like, OK, cool, another password that
39:19
I have to remember. Like, I get it, it's a code
39:23
word. It, you know, it makes sense,
39:25
but you know, the the pessimist in me is like, oh cool, another
39:30
password that I have to remember.
39:31
The whole thing that I just, the whole thing that I've just
39:35
described sounds like, yeah, cool, but I'm not going to do
39:38
that. Well, we did a whole episode on
39:40
the death and the digital estate.
39:43
Like it's not important until it's important.
39:46
And it's like, damn, disputing that it's not important.
39:49
But now we're we're, we're, we're really going back to
39:52
another password, which I get it, it's probably the only thing
39:57
that actually works in this type of scenario.
39:59
But I just find it ironic that we've been trying to kill the
40:01
password on. We just keep finding new ways to
40:04
keep using them. The thing is, like, if you said
40:07
all right, well, rather than doing that, what we're going to
40:09
do is like, we'll ask what is my spouse's grandfather's middle
40:17
name? And it might have been like
40:19
Herbert or something, right? That was like most people
40:22
wouldn't have guessed. You know your spouse's
40:25
grandfather's middle name. I don't, I don't, but I'm trying
40:29
to go with a scenario right? A knowledge based question
40:32
wouldn't work because. AIA.
40:34
Could go and, you know, search the Internet.
40:36
Oh, give me a second. I'm trying to think about.
40:38
Oh, Herbert, I was like, OK, well, that's our yeah, yeah, you
40:44
pass. But if it's just like a
40:46
password, that you guys, you. Know, of course, except for the
40:50
emergency. Remember, I can't remember,
40:52
like, OK, we came up with this last night.
40:55
Yeah. And if you have a security
40:56
system and you have to call in, they make you set up a code word
40:59
that you have to say. And you know, here's your code
41:01
word for, you know, if it's a real emergency, here's one if
41:05
you're under duress, right? Again, these are all passwords
41:10
that you have to remember, you know in the in the heat of the
41:12
moment to to get through and authenticate whatever that
41:16
communication chain looks like. My bank still uses now I think
41:20
if dial in, I have to dial in from my phone that they have on
41:24
record, but my voice is my password and then it's all
41:28
knowledge based off and beyond that like oh, what's your e-mail
41:32
address that we have we would have on file.
41:34
Like anybody who's was able to get to that is going to pass
41:39
that one. Yeah.
41:41
Well, it's layers. And so you hope that one of
41:43
those layers trips something up at some point.
41:46
Yeah. Let's see, another thing that I
41:49
thought was interested in this report was pass keys and that
41:53
pass keys are still being adopted.
41:55
But it seems like enterprise password less adoption is kind
41:59
of stalled out somewhere in the mid 40s percentage wise, which
42:05
I, I guess I kind of understand. But I'm, I'm sure our friends
42:08
over at the Fido Alliance are working on ways to, to make that
42:11
better. But what are your thoughts on
42:14
stalled pass keys? You know, deployments?
42:17
I guess it's just not making as many inroads on the enterprise
42:20
side, at least according to to this report from Hyper.
42:22
Well, I think you have to be if they use web-based applications
42:31
for pass queues, right? That that shouldn't be a
42:34
problem. I, I don't know, like I, I kind
42:37
of feel like in my day-to-day experience within my enterprise,
42:44
it's mostly password less. The problem behoms with password
42:48
list is if it's not true password list, like there's
42:51
still a password there. It's like, oh, you shut down
42:54
your computer for three days in a row going on vacation, you get
42:58
to log in with your password, which you haven't used in three
43:01
months. Good luck.
43:03
And that's where you have to go through the whole reset process
43:06
and it's a nightmare. It's a lot of tough things to
43:13
solve for when it comes to this. I think ultimately like if
43:17
you're if you have wide adoption of your IDP and you have
43:22
password list to your IDP and your IDP handles your login to
43:27
your device or devices, then you're in good shape.
43:33
Or if you're authenticator can do it.
43:35
So that's why, you know, frankly, that's why like
43:38
Microsoft Azure is so popular or a lot of the other major ID PS
43:44
supplemented with something like hyper.
43:46
And I mean, face it, hyper is one of the O GS in this space.
43:51
They're not sponsoring this episode, but I was glad that
43:54
they wanted to sponsor us because, you know, I really
43:57
think they've been trying to solve this problem for a long
44:00
time. Or we were just like complaining
44:01
about passwords. They're actually doing something
44:04
about it and trying to get rid of them.
44:06
How dare they try to fix problems?
44:08
Can't they just complain like the rest of us?
44:10
Look, I think, I think they're, they're actually doing something
44:14
about it. But I think that we all know
44:17
that passwords have their problems and we yeah, like I sit
44:21
here and complain about passwords all the time.
44:22
And I I gave a solution to your point that was based on a
44:26
password. So it it is true all?
44:31
Right, we got a couple minutes left here.
44:33
What do we think about overall themes to all these reports,
44:37
other than the fact that, guess what, identity is still at the
44:39
center of everything? Well, I think the biggest theme
44:45
is AI speeding things up. I don't think there's a whole
44:50
lot we can do about that except to recognize that, you know,
44:55
building, like building a solution that's based on
45:00
something ending up on the dashboard and then some human
45:03
having to act on it is not going to be fess off and you're going
45:07
to lose that arms race. I think the other thing is, you
45:12
know, this is just that much more of a recognition that
45:18
machine identity is not just a fad.
45:21
It's not just something that, you know, people are trying to
45:24
build products on and make a quick buck.
45:27
It's, this is the future and it's probably the biggest threat
45:31
factor for organizations right now.
45:34
And then I think the last thing is that, you know, the, the
45:41
theft of credentials, whether it's through phishing or social
45:44
engineering, however, it's almost impossible.
45:48
It's impossible to get to 100% there.
45:51
So you almost have to assume you've, you've heard the, the
45:55
saying you've, there's those that know they've been hacked
45:58
and those have been hacked and those that don't know they've
46:01
been hacked. It's probably true.
46:05
And we have talked to people, you know, over time in our day
46:09
jobs who haven't been hacked. And I don't know.
46:13
No, I don't know. Well, I don't know if anything
46:16
was true when I talked to some of them like, but they're very
46:19
well could be some credential that's sitting on their network.
46:23
The question would be is whether or not that's true now, could
46:27
become true in the future. Would you know about it?
46:31
You might let somebody go and they say, screw that company,
46:35
I'm going to get them back. Or somebody might log into
46:39
something and someone sitting on that credential and has access
46:42
to it or they got in and they created their own credential.
46:46
Would you know it? Would you know it?
46:49
So if if you're not sure about that, you should be looking at
46:52
the solutions that are out there on the market today and you
46:55
should be thinking about things like continuous identity so that
46:59
even if your breach, the breach can be contained within your
47:03
walls. Yeah, the speed is the important
47:06
part here. Everything is getting faster,
47:07
which means you've got to get faster too, whatever that looks
47:10
like in the royal you I'll call it nothing too is third parties.
47:15
You know, I think a lot of companies do a good job of
47:17
managing their own employees and to some degree, some of their,
47:20
you know, first line kind of contracting and, and things like
47:23
that, you know, that are in their consultants.
47:25
But look, we're all leveraging third parties in our life now,
47:29
either personally or professionally in our
47:30
organizations, And each one of those is now an attack, an
47:34
attack Ave. right. If they get breached or if one
47:37
of their vendors get breached, It's it's a very difficult
47:39
spider web to try and and tackle and manage.
47:41
But, you know, start paying attention to more than just your
47:45
own, you know, workforce, start looking beyond that and and
47:49
thinking about how you're going to manage those accesses,
47:51
whether they're human or non human doesn't matter.
47:53
Absolutely. All right, I've got a couple
47:58
lighter note things for you today.
48:00
All right, we did not prep for this, so I'm going to put you on
48:02
the spot which you normally put me on the spot in the first, you
48:05
know, minute or two of every episode.
48:07
So Jim, are you a light mode or a dark mode person?
48:12
I'm a late mode person, but here's the thing with me is that
48:16
I've noticed my eyesight really has gotten worse over the last
48:22
couple years. Sometimes you'll actually see
48:25
episodes where I tried to wear glasses and I've tried the, what
48:30
do they call it, transitional lenses.
48:33
In other words, bifocal progressives.
48:36
I've tried regular reading glasses.
48:38
I saw something on TV actually on YouTube about they now have
48:44
glasses that can, they have a camera pointing at your eyeball
48:49
and they can see what you're looking at and they can turn the
48:54
LCD crystals within the glass to focus on that item.
49:00
And it all happened so quickly that it's quicker than the eye
49:04
can like adjust. I think when I got to when I get
49:10
to that, I could become a dark mode person.
49:13
I do. I used to be a dark mode person
49:15
but become a light mode person because my eyes are so bad.
49:19
And I think you're a Darkman person, right?
49:22
100% dark all the time and I'll wear the reading glasses.
49:25
This is the year of reading glasses for me.
49:27
So at some point they'll, they'll appear.
49:29
But yeah, still a darkman. I just can't stand the blast of
49:32
white that comes off the monitor or whatever you're looking at.
49:35
It's like, oh, turn that down. Like let's go easy on the eyes
49:38
and and try to keep it, keep it simple.
49:41
My iPhone I have cranked to maximum brightness at all times
49:45
and no matter how many times I reset things to stay there it
49:50
keeps like going down and I guess so the auto.
49:54
Brightness turned on, that's why.
49:57
Jeff, you can probably figure it out, but I'm obviously unable.
50:03
All right, I got one more thing for you.
50:05
If if we were to reboot this podcast into a different format,
50:11
so today it's very conversational, you know, we'll
50:13
have guests on kind of talk with, you know, really smart
50:15
people around identity. We're going to keep the same
50:19
focus, right? It'll be around identity.
50:20
But do you think so that, you know, if we try to do like a
50:24
true crime or, you know, you know, cooking show or sports
50:29
talk or something like that still kind of within the
50:31
identity themes? How do you what do you think
50:34
about that idea? I think I would do a different
50:37
kind of podcast with you, but I think it would have to be
50:40
something we both like. Like I feel like I could do a
50:43
baseball podcast. Oh, absolutely not with you
50:45
because you don't like baseball. You self-proclaimed and you said
50:50
you are liking it more, but you have to like, really start like
50:54
I. Don't like it more, I just watch
50:57
it more. Doesn't mean I like it.
50:58
Let's be clear, I'm still not a baseball fan and.
51:02
That's fair. And I couldn't do a football
51:04
podcast because I don't follow it enough.
51:07
But I think we should do an AI podcast.
51:10
Like AI at the center could be a thing, and it could be
51:15
cybersecurity for AI, but it feels like we already do that
51:19
here. I think just even like general
51:23
AI, like the different AI tools would be a cool podcast as well.
51:28
But there are so many people who do that.
51:30
That's the point you keep making.
51:33
Yeah, but I think the other thing I think that could be cool
51:38
is like more like a Brady Bunch style where you have a bunch of
51:44
different people, could be me and you and like two or three
51:48
other people, four other people, something like that.
51:51
And we just, you know, hear something in the news and
51:55
different people talk about it and they key off of each other
51:58
or have their hot day takes on it.
52:01
So they do that rather than the guest or once a while they'll do
52:04
a guest. They won't bring the guests into
52:07
the Brady Bunch because they want to like, you know, say it's
52:10
like, hey, we got Elon Musk and we want to pick his brain about,
52:14
you know, robots or something. They're not just going to stick
52:17
him in the Brady Bunch. They just give him an hour
52:22
anyway. So that, that, but a cooking
52:25
show like, I don't think I could do a cooking show like.
52:28
And I, I'm trying to think of like other interests that I
52:31
have. And you know, I feel like I
52:35
spend so much time focused on technology, but.
52:39
Man, it's definitely my interest that would be some sort of, you
52:42
know, technique, either reviewing things or or maybe
52:45
bags. I think my love of backpacks and
52:48
my quest for the perfect one bag is is still alive and well, you
52:52
know, So, you know, things like that would be interesting.
52:55
I don't know. I mean, I think there's look, we
52:57
all have different interests, you know, whether it's an
52:59
identity or technology or elsewhere.
53:01
And that's fine, right? Not everything has to be for
53:03
everyone all the time. Find your niche and get out
53:07
there. Yeah, absolutely.
53:08
To start your. Baseball Podcast.
53:10
I don't have to be on it. That's fine.
53:12
I can come on as the newbie and be like, I don't know, like what
53:14
does this mean? I know I think the World
53:17
Baseball Classic is, is ongoing right now.
53:19
And I don't know if the US are I, I think they won maybe last
53:22
night, I don't know. Yeah, I've watched every pitch
53:25
of it. It was.
53:27
It was a fascinating game. OK, why?
53:30
And so these two teams are probably like the best two teams
53:36
ever assembled, and they're put on the baseball diamond to Duke
53:42
it out for 9 innings and see who won.
53:45
I think if you put these two teams on the diamond at the same
53:48
time to play 100 games, it would be like roughly 50 to 50 by the
53:53
end. I mean, that's how they're
53:55
matched up. I mean, if you look at the
53:57
Dominican lineup is like Juan Soto and Vlad Guerrero and
54:02
Fernando Tatis and a bunch of other guys that are like
54:05
household names. Manny Machado, like these guys
54:09
don't need any introduction. And the USI was the same thing
54:12
as like Aaron Judge, Bobby Wood, Junior, you know, just a ton of
54:18
world class players. I think the US team had better
54:22
pitching than the Dominicans either way.
54:26
The other thing that makes the team is when your team wins.
54:29
When your team loses, it kind of stinks.
54:31
So no matter how good the game was, you just have like a sour
54:35
taste in your mouth at the end. The other thing is like, I'm
54:40
techie, but I don't always like all the new developments in
54:46
sports. Like I cannot stand, I'll give
54:49
you an NFL example when everybody goes into the end zone
54:54
and they all pose for a picture like, hey, we got to pick 6.
54:57
Like let's all run into the end zone and act like we're posing
55:01
for our fifth grade class picture.
55:04
Like, I just think that's so immature and it rubs the other
55:08
teams, the opponent's nose in it.
55:11
And that's the way the Dominican Republic acts.
55:14
And I don't know, I hopefully my offending people out there are
55:18
probably. But like after they hit a home
55:21
run, then they all group up and someone puts their arm up.
55:24
Like let's take a pretend selfie.
55:26
I'm like, like, I don't like that at all, man.
55:30
You don't have to rub the other pitcher's nose and it like, I
55:32
just hit a home run off you. I.
55:34
I don't know, that sounds entertaining to me.
55:37
I don't like want to show off and you know, I want to see, you
55:41
know, within the realms of sportsmanship, of course, but I
55:44
think it's fine to have fun at things like that.
55:46
I mean, whether whether or not you like the celebration is a
55:49
different aspect of should celebration be allowed?
55:53
I agree. I think like whenever the
55:55
defense does a pick six and they all run to the end.
55:57
So I'm like, OK, that's my but I really like it when they like
55:59
actually do something that's like coordinated, like they've
56:01
planned this out, like bowling or something like that.
56:04
Like, all right, that was kind of fun to watch because the
56:06
chances of them doing it are, you know, not likely.
56:10
I mean, even with as many other receptions as, you know, make it
56:13
thrown, you probably won't see as very, very many of those on
56:16
the whole. But I don't care, you know, have
56:20
fun, you know, just don't be a jerk about it.
56:21
But, you know, I want to see, I want to see teams that don't
56:25
like each other. Like those are the more
56:27
entertaining ones to me. Yeah, look, I mean, like I'm a
56:30
New York Yankees fan, which again, could lose this.
56:34
But the Boston Red Sox, I can't, I just can't stand them.
56:39
And they don't do that kind of stuff.
56:42
That's not why I dislike them. I just dislike them because of
56:45
the rivalry. And, you know, if they win and
56:48
we lose and it's, I think that's the one place where it's OK to
56:54
look at it. Look at the world as like them
56:56
and and us within sports, outside of sports.
57:01
You know, I don't think you should look at the world that
57:03
way. Well, yeah, I mean, look, for me
57:05
it's the Bears and Packers. And anytime the Bears wear
57:07
cheese graters on their head and beat the Packers is a great day.
57:10
And look, that's fun, you know, poking, you know, poking fun and
57:15
making fun of the situation. And look, the Bears have been
57:17
bad for a very long time. And so anytime the Bears get to
57:19
do it back to the Packers, absolutely, 100% I'm on board.
57:23
All. Right, let's go ahead and wrap
57:25
it up for this week. We covered a lot of reports.
57:28
Again, I'll have links in our show notes for all of these
57:30
people. Check out Draw Your Own
57:31
Conclusions, maybe posts, you know, when I post the
57:34
availability on this on, on LinkedIn, you know, what are
57:37
some of the things that jumped out of you?
57:39
And, you know, thanks to all these vendors, they, they didn't
57:41
sponsor this, but you know, they're taking time out of
57:44
their, you know, busy schedules to put these reports out.
57:47
And the fact they put it out in the public domain for people to
57:50
trade their e-mail address most likely for is still, you know,
57:53
worth, you know, probably taking a look at those reports and, and
57:56
using that knowledge to either make a business case or provide
57:59
justification or just awareness of, hey, these are the things
58:02
that are going on in the world and things to be aware of.
58:04
So, you know, anybody who wants to put our report is, I think
58:08
more information is a good thing.
58:10
Yeah, if you're putting out reports, if we forgot your
58:13
report or you put out a report in the future, send us the link.
58:17
We'd love to read it. And if and when we do another
58:21
report show, we'll, you know, consider including it.
58:25
All right, that's it. idacpodcast.com like and
58:29
subscribe, use our discount codes.
58:30
Hope to see people at EIC and Ideniverse kind of the next two
58:34
big conferences that you and I will be at.
58:35
And then I'm sure we've got, let's see Fido authenticate
58:38
later this year and then hopefully we'll be at Gardner
58:41
again like just like we were last year.
58:42
So connect with us on LinkedIn and subscribe.
58:47
So you know when these things come out.
58:48
And with that we're done. We'll talk with everyone later.
58:55
You've been listening to Identity at the Center.
58:58
We hope you've enjoyed the show. Make sure to like, rate and
59:02
review, and we'll be back soon. But in the meantime, hit the
59:06
website at identity@thecenter.com.
59:10
See you next time on Identity at the Center.