Latest / The Identity Blueprint / Identity Strategy and Target State Design

Transcript

Identity Strategy and Target State Design · The Identity Blueprint

• 0:00
  SPEAKER_01: Welcome back to the Identity Blueprint, the podcast where Enterprise IAM gets the depth it deserves.
• 0:06
  SPEAKER_01: I'm Ernie Prescott, Principal IAM Architect, and today Jose and I are moving from the autopsy table to the architect's desk.
• 0:14
  SPEAKER_01: In episode two, we ripped apart your current state and surfaced everything hiding in the dark.
• 0:20
  SPEAKER_01: The ghost accounts, the orphaned credentials, the 80-hour termination gaps.
• 0:25
  SPEAKER_01: Now in episode three, Identity Strategy and Target State Design, we take everything the autopsy uncovered and build something from it.
• 0:33
  SPEAKER_01: A zero trust capability map, an executive vision that actually gets funded, a business case designed to survive CFO scrutiny, and a closing paradox that will make you question everything you thought you knew about automation.
• 0:46
  SPEAKER_01: If you're an IAM architect, an IT director tired of fighting fires, or a security leader trying to get a transformation funded, this is the episode that hands you the blueprint.
• 0:57
  SPEAKER_01: Let's get into it.
• 0:59
  SPEAKER_01: You know, usually when we talk about a medical diagnosis, there's this um this expectation of clinical precision.
• 1:05
  SPEAKER_00: Right, like a clear-cut answer.
• 1:06
  SPEAKER_01: Yeah, exactly.
• 1:07
  SPEAKER_01: You break your arm, the x-ray shows a jagged white line, and the doctor just points to the film and says, Yeah, there's the problem.
• 1:14
  SPEAKER_00: It's binary, broken or not broken.
• 1:17
  SPEAKER_01: Exactly.
• 1:18
  SPEAKER_01: But then you step into the world of enterprise identity and access management, and suddenly that X-ray machine is, well, it's completely broken.
• 1:25
  SPEAKER_00: Oh, absolutely.
• 1:26
  SPEAKER_01: We're looking at a diagnostic landscape that is entirely murky.
• 1:30
  SPEAKER_01: I mean, you've got employees logging in from coffee shops, contractors using unmanaged devices.
• 1:35
  SPEAKER_01: Trevor Burrus, Jr.
• 1:36
  SPEAKER_00: Third-party supply chain vendors, too.
• 1:37
  SPEAKER_01: Aaron Ross Powell Right.
• 1:38
  SPEAKER_01: And now, you know, thousands of AI agents swimming around the network, all requesting access to your most sensitive corporate data.
• 1:45
  SPEAKER_00: Aaron Powell It is the absolute definition of diagnostic muddy waters because unlike a broken bone, you know, access isn't static, it's fluid.
• 1:53
  SPEAKER_01: Aaron Powell It changes minute by minute.
• 1:54
  SPEAKER_00: Aaron Powell Exactly.
• 1:55
  SPEAKER_00: And if you don't have a structured mathematical way to visualize and govern that fluidity, the entire security perimeter of an organization just well, it dissolves.
• 2:04
  SPEAKER_00: Aaron Powell Yeah.
• 2:05
  SPEAKER_01: And that muddy diagnostic water is exactly what we are fixing today.
• 2:08
  SPEAKER_00: Aaron Powell We've got a lot to cover.
• 2:10
  SPEAKER_01: We really do.
• 2:10
  SPEAKER_01: We're opening up a massive stack of source material for you today.
• 2:14
  SPEAKER_01: We've got the IAM program engagement blueprint, the 2025 and 2026 architectural blueprints for Microsoft Intra ID and SalePoint Identities Security Cloud, and uh the latest NIST digital identity guidelines.
• 2:28
  SPEAKER_00: Some heavy reading there.
• 2:29
  SPEAKER_01: Seriously.
• 2:30
  SPEAKER_01: Yeah.
• 2:30
  SPEAKER_01: But our mission for you today is singular.
• 2:34
  SPEAKER_01: We are going to master phase two of an enterprise identity and access management or IAM transformation.
• 2:41
  SPEAKER_00: Because phase one is always the discovery phase, right?
• 2:44
  SPEAKER_00: The audit.
• 2:44
  SPEAKER_01: The messy part.
• 2:45
  SPEAKER_00: Yeah.
• 2:45
  SPEAKER_00: That's where you look under the hood and realize wow, we have twice as many active accounts as we have human beings actually employed at this company.
• 2:51
  SPEAKER_01: The skeletons in the IT closet.
• 2:53
  SPEAKER_01: But phase two is the antidote.
• 2:55
  SPEAKER_01: Phase two is strategy and target state design.
• 2:57
  SPEAKER_00: Right.
• 2:58
  SPEAKER_01: If you are, say, an IT director tired of fighting fires or an architect trying to get a massive security overhaul funded, this deep dive is your blueprint.
• 3:05
  SPEAKER_00: It really is.
• 3:06
  SPEAKER_01: We are going to translate raw business needs into an identity strategy that a CFO will actually sign a check for.
• 3:14
  SPEAKER_00: Which is the hardest part, honestly.
• 3:15
  SPEAKER_01: Oh, totally.
• 3:16
  SPEAKER_01: We'll outline the core principles that guard the modern network and map out the specific capabilities that define enterprise security in 2026.
• 3:25
  SPEAKER_01: So let's unpack this shift in mindset because identity is no longer just, you know, the IT help desk resetting your password for the fifth time this month.
• 3:34
  SPEAKER_00: Thank goodness for that.
• 3:35
  SPEAKER_01: Right.
• 3:35
  SPEAKER_01: It is a high ROI strategic security platform.
• 3:38
  SPEAKER_00: Uh huh.
• 3:39
  SPEAKER_01: But the blueprint says you have to start at the top.
• 3:41
  SPEAKER_01: You have to start with the executive vision.
• 3:43
  SPEAKER_00: Yeah.
• 3:44
  SPEAKER_00: Phase two fundamentally asks where do we need to be and why?
• 3:47
  SPEAKER_01: Right.
• 3:48
  SPEAKER_00: The blueprint is really emphatic about this.
• 3:50
  SPEAKER_00: If you just start, you know, buying software licenses and plugging in tools, you will fail.
• 3:55
  SPEAKER_01: You need a map first.
• 3:56
  SPEAKER_00: Exactly.
• 3:57
  SPEAKER_00: The architect must translate the business context into an identity strategy that the executive team can literally take ownership of.
• 4:03
  SPEAKER_00: And that begins with the IMM vision statement.
• 4:06
  SPEAKER_01: So I actually pulled the target state vision statement right from the blueprint.
• 4:10
  SPEAKER_01: I'm going to read it, but I warn you, my initial reaction to this is pretty cynical.
• 4:15
  SPEAKER_00: Let's hear it.
• 4:15
  SPEAKER_01: Okay, here it is.
• 4:17
  SPEAKER_01: Every person, workload, and device accessing our systems will be continuously verified, appropriately authorized, and fully auditable, enabling the business to move fast without accepting unmanaged risk.
• 4:29
  SPEAKER_00: A bit of a mouthful.
• 4:31
  SPEAKER_01: I mean, I have to call a timeout here.
• 4:32
  SPEAKER_01: This sounds like corporate buzzword bingo.
• 4:35
  SPEAKER_00: It does.
• 4:35
  SPEAKER_00: I get that.
• 4:36
  SPEAKER_01: Why does a highly technical systems architect need to sit in a conference room spending weeks wordsmithing a vision statement for executives?
• 4:45
  SPEAKER_00: Well, engineers want to engineer.
• 4:46
  SPEAKER_00: I totally get that.
• 4:48
  SPEAKER_00: But let's look at the psychology of the C-suite.
• 4:50
  SPEAKER_00: If you don't agree on where you are going at the executive level, the downstream technology deployment will inevitably fragment.
• 4:56
  SPEAKER_01: Aaron Powell Because everyone has a different idea of what success looks like.
• 5:00
  SPEAKER_00: Exactly.
• 5:00
  SPEAKER_00: Let's say an architect walks into the CFO's office and says, um, we need$2 million to implement SIM 2.0 APIs, establish a new identity provider, and configure OOT flows across our Sauce application stack.
• 5:14
  SPEAKER_01: Aaron Powell The CFO just hears IT expense.
• 5:17
  SPEAKER_00: Right.
• 5:17
  SPEAKER_00: They hear a cost center asking for a bigger budget for like digital plumbing, they don't understand.
• 5:23
  SPEAKER_00: Aaron Powell They don't know what an OOuth flow is.
• 5:26
  SPEAKER_00: They don't care about the technical protocols passing identity tickets between servers.
• 5:31
  SPEAKER_00: But if that same architect walks in and says, we need to accelerate our AI enablement without taking on unmanaged risk.
• 5:39
  SPEAKER_00: We need to ensure that when our business units deploy new generative AI models, they can't accidentally exfiltrate our proprietary financial data and we can prove it to our auditors.
• 5:50
  SPEAKER_01: Oh wow.
• 5:51
  SPEAKER_01: Yeah.
• 5:52
  SPEAKER_01: That gets funding.
• 5:53
  SPEAKER_00: That gets funding immediately.
• 5:54
  SPEAKER_00: The vision statement is the translator.
• 5:56
  SPEAKER_01: It bridges the server room and the boardroom.
• 5:58
  SPEAKER_01: So let's look closer with the actual words in that statement, because I assume they aren't chosen at random.
• 6:03
  SPEAKER_01: It says every person, workload, and device.
• 6:06
  SPEAKER_00: Yeah.
• 6:06
  SPEAKER_00: And that immediately tells the business that we aren't just talking about human employees anymore.
• 6:11
  SPEAKER_00: Machines have identities now.
• 6:12
  SPEAKER_01: Aaron Powell Right.
• 6:13
  SPEAKER_01: And then continuously verified.
• 6:15
  SPEAKER_00: Aaron Powell Which signals the death of the old, you know, login once in the morning and you're good all day model.
• 6:22
  SPEAKER_01: Aaron Powell Gotcha.
• 6:23
  SPEAKER_01: And appropriately authorized implies least privilege.
• 6:28
  SPEAKER_01: Trevor Burrus, Jr.
• 6:28
  SPEAKER_00: Right.
• 6:28
  SPEAKER_00: You only get what you absolutely need.
• 6:30
  SPEAKER_00: And fully auditable is basically music to the chief risk officer's ears.
• 6:35
  SPEAKER_01: Aaron Powell Because when the regulators come knocking, we have the forensic evidence.
• 6:38
  SPEAKER_00: Exactly.
• 6:39
  SPEAKER_01: So the vision gets the executive head nod.
• 6:41
  SPEAKER_01: The CFO says, yes, I want to move fast without unmanaged risk.
• 6:45
  SPEAKER_01: Here is your budget.
• 6:47
  SPEAKER_01: But you can't just let the developers run wild at that point, right?
• 6:50
  SPEAKER_01: You need rules to keep the architecture on track.
• 6:52
  SPEAKER_00: Aaron Powell Right.
• 6:53
  SPEAKER_00: You need the guardrails of identity.
• 6:55
  SPEAKER_00: The blueprint defines these as the strategic guiding principles.
• 6:58
  SPEAKER_01: Which are what?
• 6:58
  SPEAKER_01: Exactly.
• 6:59
  SPEAKER_00: They're basically five to eight constraints for all future design decisions.
• 7:03
  SPEAKER_00: If a vendor pitches a new shiny software tool, or say an application owner demands a security bypass to launch a product faster, you hold that request up against these principles.
• 7:14
  SPEAKER_01: And if it violates them?
• 7:15
  SPEAKER_00: The answer is an immediate no.
• 7:17
  SPEAKER_01: Aaron Ross Powell Wow.
• 7:17
  SPEAKER_01: Okay.
• 7:18
  SPEAKER_01: So the first principle in the blueprint is uh it seems like the absolute foundation of the modern approach.
• 7:24
  SPEAKER_01: It says identity is the primary security perimeter.
• 7:28
  SPEAKER_00: Aaron Powell Yes.
• 7:28
  SPEAKER_01: This is the essence of zero trust.
• 7:30
  SPEAKER_01: But let's break down why the old perimeter failed.
• 7:32
  SPEAKER_00: Aaron Powell So historically, the perimeter was the physical corporate network, the castle and moat model.
• 7:38
  SPEAKER_01: Trevor Burrus Right.
• 7:38
  SPEAKER_00: If you were inside the building, plugged into the wall or dialed into the corporate VPN, the system assumed you were a trusted employee.
• 7:45
  SPEAKER_00: You were inside the castle walls.
• 7:47
  SPEAKER_01: Aaron Powell But the cloud completely blew up the castle.
• 7:50
  SPEAKER_00: Aaron Powell It leveled it.
• 7:51
  SPEAKER_00: I mean, with Sauce applications hosted all over the world, remote workforces, mobile devices, the network perimeter just evaporated.
• 7:58
  SPEAKER_01: Aaron Powell Yeah, you can't put a firewall around a sales rep working from an airport lounge who's accessing a database hosted in an Azure data center.
• 8:06
  SPEAKER_00: Aaron Powell Exactly.
• 8:08
  SPEAKER_00: The only thing you can reliably verify is the identity of the user or the machine trying to gain access.
• 8:14
  SPEAKER_00: Identity is the new firewall.
• 8:16
  SPEAKER_01: Aaron Ross Powell Which flows naturally into the second principle.
• 8:18
  SPEAKER_01: Access is context-based, meaning you aren't granted access just because you type the correct password.
• 8:24
  SPEAKER_00: Aaron Powell Context is everything.
• 8:26
  SPEAKER_00: Is the user logging in from their managed corporate-issued laptop?
• 8:31
  SPEAKER_00: Is the antivirus software on that laptop up to date?
• 8:34
  SPEAKER_00: Right.
• 8:35
  SPEAKER_00: What time of day is it?
• 8:36
  SPEAKER_00: What country are they in?
• 8:37
  SPEAKER_00: Is there any impossible travel detected?
• 8:40
  SPEAKER_01: Aaron Ross Powell, wait, impossible travel being like I logged in from New York at 9.0 a.m.
• 8:45
  SPEAKER_01: and then my account tries to log in from Eastern Europe at 9 15 AM.
• 8:49
  SPEAKER_00: Exactly.
• 8:50
  SPEAKER_00: Basic physics dictates you cannot travel that fast.
• 8:53
  SPEAKER_00: So the context has changed drastically.
• 8:56
  SPEAKER_00: Under this principle, even if the username and password are 100% correct, the access is blocked because the context indicates a compromised credential.
• 9:04
  SPEAKER_01: That makes a lot of sense.
• 9:05
  SPEAKER_01: Let's move to the third principle, and this is where I think a lot of legacy organizations really start to feel the pain of transformation.
• 9:11
  SPEAKER_00: Oh, yeah.
• 9:12
  SPEAKER_01: Least privileged by default.
• 9:13
  SPEAKER_01: This establishes that standing access is the exception, and just in time access or JIT is the norm.
• 9:20
  SPEAKER_00: Right.
• 9:21
  SPEAKER_01: Let me throw an analogy at you because standing access sounds very benign, almost supportive, but it's actually incredibly dangerous.
• 9:27
  SPEAKER_00: Let's hear the analogy.
• 9:29
  SPEAKER_01: Okay.
• 9:29
  SPEAKER_01: It's the difference between giving a plumber a master key to your house that works twenty-four hours a day, seven days a week, forever.
• 9:36
  SPEAKER_01: That's standing access.
• 9:38
  SPEAKER_00: A terrible idea.
• 9:39
  SPEAKER_01: Right.
• 9:39
  SPEAKER_01: Sure, you hired them to fix the sink on Tuesday, but they have the key on Saturday night, too.
• 9:44
  SPEAKER_01: If they lose that key at a bar, anyone could pick it up and walk into your house at any time.
• 9:48
  SPEAKER_00: Exactly.
• 9:48
  SPEAKER_01: Contrast that with just in time access.
• 9:51
  SPEAKER_01: JIT is like giving that plumber a digital smart lock code.
• 9:55
  SPEAKER_01: The code only works on Tuesday, strictly between 1 p.m.
• 9:58
  SPEAKER_01: and 3 p.m., and it only opens the front door and the basement where the pipes are.
• 10:02
  SPEAKER_01: And then the second the job is done or the clock strikes 3.01 PM, the code mathematically evaporates.
• 10:09
  SPEAKER_00: The plumber analogy is perfect.
• 10:11
  SPEAKER_00: And what's fascinating here is the technological mechanism that enforces that digital smart lock in the enterprise.
• 10:17
  SPEAKER_01: How does it work?
• 10:18
  SPEAKER_00: Well, legacy systems evaluated your access only at the point of login.
• 10:22
  SPEAKER_00: The bouncer checks your ID at the door, and once you are inside the club, you can stay as long as you want and do whatever you want.
• 10:28
  SPEAKER_01: But modern architectures, according to the 2026 NTRID materials, use continuous access evaluation or CAE.
• 10:36
  SPEAKER_01: Yes.
• 10:36
  SPEAKER_01: I need you to unpack the mechanics of CAE.
• 10:39
  SPEAKER_01: Yeah.
• 10:39
  SPEAKER_01: Because how does a system continuously evaluate someone without slowing the network to a crawl?
• 10:46
  SPEAKER_00: It requires a fundamental shift in how authentication tokens are handled.
• 10:50
  SPEAKER_00: Historically, a system would issue an access token that lived for, say, 12 hours.
• 10:54
  SPEAKER_00: Right.
• 10:55
  SPEAKER_00: During those 12 hours, the application never checked back with the central identity provider, but with continuous access evaluation, the identity provider and the application establish a real-time two-way communication channel.
• 11:07
  SPEAKER_00: They are constantly exchanging telemetry.
• 11:09
  SPEAKER_01: What kind of telemetry?
• 11:10
  SPEAKER_01: Like what are they looking for?
• 11:12
  SPEAKER_00: It's looking for critical event triggers.
• 11:14
  SPEAKER_00: If a risk signal suddenly changes mid-session, for instance, the telemetry shows the user's laptop just had its firewall disabled, or the user's IP address suddenly changed from a corporate subnet to an anonymous proxy server.
• 11:26
  SPEAKER_01: Oh wow.
• 11:27
  SPEAKER_00: Yeah, the policy engine reacts instantly.
• 11:29
  SPEAKER_00: It doesn't wait for the 12-hour token to expire.
• 11:32
  SPEAKER_00: It issues a revocation command in real time.
• 11:34
  SPEAKER_01: So it just cuts them off.
• 11:35
  SPEAKER_00: Exactly.
• 11:36
  SPEAKER_00: The application instantly kicks the user out, severing the connection mid-keystroke, or it forces them to reauthenticate with a stronger method, like a physical hardware security key.
• 11:47
  SPEAKER_01: So the smart lock doesn't just expire at 3 p.m.
• 11:50
  SPEAKER_01: It kicks the plumber out at 2.15 p.m.
• 11:53
  SPEAKER_01: if it detects them walking toward the master bedroom instead of the basement.
• 11:56
  SPEAKER_00: That's it, exactly.
• 11:57
  SPEAKER_00: The bouncer isn't just at the door anymore.
• 11:58
  SPEAKER_00: The bouncer is walking the floor with you, watching every single move.
• 12:02
  SPEAKER_01: That is wild.
• 12:03
  SPEAKER_01: And that leads us directly to the fourth principle Auditable access.
• 12:08
  SPEAKER_01: Every single access decision, every elevation of privilege, every GIT request must trace back to a documented business justification.
• 12:16
  SPEAKER_00: Aaron Powell Because when the forensic auditors arrive after a breach saying, I don't know why that account had access to the financial database is a failing answer.
• 12:24
  SPEAKER_01: Expensive, failing answer.
• 12:25
  SPEAKER_00: Very expensive.
• 12:26
  SPEAKER_00: Massive regulatory fines.
• 12:28
  SPEAKER_01: Right.
• 12:28
  SPEAKER_01: And the final two principles automation over manual process, meaning humans only handle exceptions, and one authoritative identity, which aims to eliminate the fragmentation, where you know John Smith exists as five disconnected user accounts across the enterprise.
• 12:44
  SPEAKER_00: Aaron Powell Which is so common.
• 12:46
  SPEAKER_00: But if you are relying on human beings in the IT department to manually create accounts, assign permissions, and delete accounts when people leave, you are guaranteeing human error.
• 12:56
  SPEAKER_01: Plus it's just slow.
• 12:57
  SPEAKER_00: You introduce delays, and you inflate your operational costs.
• 13:01
  SPEAKER_00: Automation is literally the only way to scale zero trust.
• 13:05
  SPEAKER_01: Okay, so we have the executive vision, we have the strategic principles, we have the destination and the rules of the road.
• 13:11
  SPEAKER_01: But what exactly are we building?
• 13:13
  SPEAKER_00: Now we need the map.
• 13:14
  SPEAKER_01: Right.
• 13:15
  SPEAKER_01: The blueprint translates these rules into something called the target state capability map, and it's an imposing document.
• 13:20
  SPEAKER_01: It looks like the architectural blueprints for a skyscraper.
• 13:23
  SPEAKER_00: It really does.
• 13:24
  SPEAKER_00: The capability map is where business capability modeling meets hardcore identity architecture.
• 13:29
  SPEAKER_00: It does not list specific products.
• 13:31
  SPEAKER_00: It doesn't say buy this Microsoft license or install this cell point server.
• 13:36
  SPEAKER_00: It defines the capabilities the business must possess to function securely.
• 13:40
  SPEAKER_01: Let's pull this map apart then.
• 13:42
  SPEAKER_01: The first major domain focuses on workforce identity and access governance, basically the human element.
• 13:48
  SPEAKER_00: Right.
• 13:49
  SPEAKER_00: Workforce identity manages the automated joiner, mover, lever lifecycle.
• 13:53
  SPEAKER_00: The industry calls this JML.
• 13:55
  SPEAKER_01: Joiner, mover, lever.
• 13:58
  SPEAKER_01: The three phases of an employee's life at a company.
• 14:01
  SPEAKER_01: Let's put a face to this to make it tangible.
• 14:03
  SPEAKER_01: Let's say we have an employee, Sarah.
• 14:05
  SPEAKER_01: She joins the marketing department.
• 14:06
  SPEAKER_00: So as a joiner, Sarah needs access to function on day one.
• 14:10
  SPEAKER_00: Historically, she would sit at an empty desk for a week waiting for IT tickets to clear.
• 14:15
  SPEAKER_01: We've all been there.
• 14:16
  SPEAKER_00: Exactly.
• 14:16
  SPEAKER_00: But under the capability map, the moment HR enters her into the system, the identity fabric triggers birthright access.
• 14:22
  SPEAKER_01: Birthright access, yeah.
• 14:23
  SPEAKER_00: She automatically receives an email account, access to the marketing Slack channels, and a license for design software.
• 14:29
  SPEAKER_00: It is zero touch provisioning.
• 14:31
  SPEAKER_01: That's amazing.
• 14:32
  SPEAKER_01: And as a part of that workforce identity pillar, the map mandates phishing resistant MFA.
• 14:37
  SPEAKER_01: This is a pretty big shift.
• 14:39
  SPEAKER_01: Yeah.
• 14:39
  SPEAKER_01: We are moving away from having like a six-digit code texted to your phone.
• 14:43
  SPEAKER_01: Why are SMS texts no longer considered secure?
• 14:47
  SPEAKER_00: SS texts are incredibly vulnerable to sim swapping attacks and basic man in the middle phishing.
• 14:53
  SPEAKER_01: How so?
• 14:54
  SPEAKER_00: Think about it.
• 14:54
  SPEAKER_00: If I build a fake login page that looks exactly like your corporate portal, you type in your password, and then the page asks for your text message code, you type that in too.
• 15:04
  SPEAKER_00: I capture both on my fake page and I log in as you on the real page.
• 15:08
  SPEAKER_01: Oh wow.
• 15:08
  SPEAKER_01: Yeah, that's scary.
• 15:18
  SPEAKER_01: But how does that stop the fake login page?
• 15:20
  SPEAKER_00: Aaron Powell The cryptographic key physically checks the domain name of the website it is interacting with.
• 15:24
  SPEAKER_00: Oh, I see.
• 15:25
  SPEAKER_00: So if the key sees that the website is um Microsoft dash login update.com instead of the actual authentic domain, the hardware key simply refuses to transmit the cryptographic challenge.
• 15:36
  SPEAKER_00: The human can be tricked by a fake web page, but the cryptography cannot.
• 15:40
  SPEAKER_01: I love that.
• 15:41
  SPEAKER_01: Taking the human gullibility completely out of the equation.
• 15:44
  SPEAKER_01: But let's go back to our employee Sarah.
• 15:47
  SPEAKER_01: She joined marketing, she has her hardware key.
• 15:50
  SPEAKER_01: Six months later, she gets promoted and transfers to the enterprise sales team.
• 15:54
  SPEAKER_00: The mover phase.
• 15:55
  SPEAKER_01: Right, the mover phase.
• 15:56
  SPEAKER_01: And based on historical breach data, the mover phase is where organizations accumulate massive amounts of hidden risk, right?
• 16:04
  SPEAKER_01: The permissions creep.
• 16:05
  SPEAKER_00: It is a systemic vulnerability.
• 16:07
  SPEAKER_00: When Sarah moves to sales, the IT department is very quick to grant her access to the Salesforce database because she needs it to do her new job.
• 16:14
  SPEAKER_01: Of course.
• 16:15
  SPEAKER_00: But IT rarely remembers to remove her access to the marketing of social media accounts.
• 16:20
  SPEAKER_00: Over five years, an employee might change roles three times.
• 16:23
  SPEAKER_00: They accumulate a toxic, overlapping combination of access rights.
• 16:27
  SPEAKER_01: And that introduces the governance domain of the capability map.
• 16:31
  SPEAKER_01: Periodic access reviews, entitlement management, and enforcing separation of duties.
• 16:36
  SPEAKER_00: Separation of duties, or SOD, is critical here.
• 16:40
  SPEAKER_00: The system must automatically ensure that the person who submits a massive purchase order to a vendor is never the exact same person who has the system authority to approve that payment.
• 16:50
  SPEAKER_01: Right.
• 16:50
  SPEAKER_01: That's basic fraud prevention.
• 16:52
  SPEAKER_00: Exactly.
• 16:52
  SPEAKER_00: If Sarah accumulated access from two different roles that allowed her to both submit and approve, that is a catastrophic compliance violation.
• 17:01
  SPEAKER_01: So to achieve this flawless JML lifecycle at an enterprise scale in 2026, the architectural blueprints advocate for a specific design pattern called strategic coexistence.
• 17:12
  SPEAKER_01: Yes.
• 17:13
  SPEAKER_01: It essentially states that one vendor cannot solve everything.
• 17:16
  SPEAKER_01: Many of the largest enterprises use Microsoft Intra ID as the primary identity provider, or IDP, alongside SailPoint Identity Security Cloud, serving as the identity governance and administration or IGA engine.
• 17:29
  SPEAKER_00: It's an acknowledgement of architectural reality, really.
• 17:32
  SPEAKER_00: IntraID is deeply embedded into the Microsoft and Azure ecosystem.
• 17:36
  SPEAKER_00: It excels at the real-time access enforcement, that continuous access evaluation we discussed earlier.
• 17:41
  SPEAKER_01: It is the intelligent front door.
• 17:42
  SPEAKER_00: Exactly.
• 17:43
  SPEAKER_00: CellPoint, conversely, manages the incredibly deep, complex compliance requirements.
• 17:49
  SPEAKER_00: It handles the cross-platform role mining, the automated SOD checks, and the vast compliance reporting required by federal regulators.
• 17:57
  SPEAKER_01: So they work together.
• 17:58
  SPEAKER_00: Right.
• 17:59
  SPEAKER_00: They coexist, constantly passing data back and forth to create a unified fabric.
• 18:03
  SPEAKER_01: Aaron Powell I want to stop here and look under the hood of how they actually pass that data, because the manual provisioning of these accounts is what causes the risk in the first place.
• 18:11
  SPEAKER_00: Absolutely.
• 18:12
  SPEAKER_01: The source documents detail that this coexistence relies heavily on enter ID's SACM 2.0 inbound provisioning APIs.
• 18:19
  SPEAKER_01: Yes.
• 18:19
  SPEAKER_01: I have to admit, SCM 2.0 inbound provisioning API is about as dense as technical jargon gets.
• 18:25
  SPEAKER_01: Walk me through the actual mechanism.
• 18:27
  SPEAKER_01: If the HR system changes Sarah's title from marketing to sales, how does the IT infrastructure know to revoke her old access without a human submitting a ticket?
• 18:36
  SPEAKER_00: Okay, so SCIN stands for the system for cross-domain identity management.
• 18:40
  SPEAKER_00: Think of it as a universal translator for identity data.
• 18:42
  SPEAKER_01: No universal translator.
• 18:44
  SPEAKER_00: When the HR system, let's say workday updates Sarah's profile, Workday generates a specific data package.
• 18:50
  SPEAKER_00: Because we are using the SPM protocol, SalePoint constantly listens for these standardized packages.
• 19:00
  SPEAKER_01: Okay, so SalePoint sees the change.
• 19:02
  SPEAKER_01: What does it do then?
• 19:03
  SPEAKER_00: Sale point has the master map of what a sales role requires versus a marketing role.
• 19:09
  SPEAKER_00: It recalculates her access instantaneously.
• 19:12
  SPEAKER_00: Wow.
• 19:12
  SPEAKER_00: It identifies that she needs Salesforce but must lose access to the Adobe Creative Cloud.
• 19:17
  SPEAKER_00: SalePoint then uses that same SEM protocol to send a direct machine-to-machine command to Intra ID.
• 19:24
  SPEAKER_01: Telling it what to do.
• 19:25
  SPEAKER_00: Right.
• 19:25
  SPEAKER_00: It says remove Sarah from the marketing security group, add Sarah to the sales security group.
• 19:30
  SPEAKER_00: Intra ID executes the change and the downstream applications update.
• 19:34
  SPEAKER_01: Just like that.
• 19:35
  SPEAKER_00: Groups are updated, old access is revoked, new access is granted, the help desk didn't get a single ticket, central IT didn't lift a finger, it happens in milliseconds.
• 19:44
  SPEAKER_01: That automation closes the window of vulnerability so fast.
• 19:48
  SPEAKER_01: I mean, if it takes three weeks for a help desk ticket to be processed to remove her marketing access, that is three weeks where her account, if compromised, has a massive blast radius.
• 19:59
  SPEAKER_00: Exactly.
• 19:59
  SPEAKER_00: Automation shrinks that window to zero.
• 20:02
  SPEAKER_01: So we've spent all this time locking down the human employees.
• 20:06
  SPEAKER_01: But if a sophisticated hacker realizes that human accounts are now protected by phishing resistant hardware keys and continuous evaluation, where do they go next?
• 20:16
  SPEAKER_00: They follow the path of least resistance.
• 20:18
  SPEAKER_01: Which brings us to the second domain of the capability map: external, privileged, and non-human identities.
• 20:23
  SPEAKER_00: Because the fastest growing attack surface in the modern enterprise isn't human at all.
• 20:28
  SPEAKER_01: Let's break these down.
• 20:29
  SPEAKER_01: First, external identity, often called CIM customer identity and access management.
• 20:33
  SPEAKER_01: This is like B2B partners, external supply chain vendors, logistics contractors.
• 20:38
  SPEAKER_00: Right.
• 20:38
  SPEAKER_00: You absolutely do not want a third-party vendor sitting inside your internal employee active directory.
• 20:43
  SPEAKER_01: That mixes your core trusted users with external variables.
• 20:47
  SPEAKER_00: Exactly.
• 20:48
  SPEAKER_00: But you still need to govern their access strictly.
• 20:51
  SPEAKER_00: CIM platforms allow organizations to securely collaborate with outsiders while maintaining a strict logical boundary.
• 20:59
  SPEAKER_01: Basically, keep the guests in the guest house, but still make sure the smart locks on the guest house doors work perfectly.
• 21:06
  SPEAKER_00: That's a good way to look at it.
• 21:07
  SPEAKER_01: Then we have privileged access management or PAM, the keys to the kingdom.
• 21:12
  SPEAKER_00: We use the term blast radius a lot in architecture.
• 21:14
  SPEAKER_00: If a standard marketing employee gets hacked, the attacker might be able to read some emails or access a departmental file share.
• 21:21
  SPEAKER_00: The blast radius is contained.
• 21:23
  SPEAKER_01: But if an admin gets hacked.
• 21:24
  SPEAKER_00: If a global administrator or a cloud infrastructure engineer gets hacked, the attacker can literally delete the entire company's cloud hosting environment.
• 21:33
  SPEAKER_00: The blast radius is apocalyptic.
• 21:36
  SPEAKER_01: So how does the capability map govern these superusers?
• 21:39
  SPEAKER_01: You can't just revoke their access.
• 21:41
  SPEAKER_01: They literally need it to keep the servers running.
• 21:43
  SPEAKER_00: You eliminate standing administrative privileges.
• 21:45
  SPEAKER_01: Okay.
• 21:46
  SPEAKER_00: Using PAM solutions like CyberArc or UNTRA PM, the architect designs a system where the admin logs in every day as a standard unprivileged user.
• 21:56
  SPEAKER_01: Just like everyone else.
• 21:57
  SPEAKER_00: Exactly.
• 21:57
  SPEAKER_00: If they need to restart a critical server.
• 22:00
  SPEAKER_00: They must request temporary elevation.
• 22:02
  SPEAKER_00: That request is verified, often requiring a secondary approval from another human.
• 22:07
  SPEAKER_00: Okay.
• 22:07
  SPEAKER_00: Once approved, the system grants them admin rights for a strictly time-bound window, say 60 minutes.
• 22:14
  SPEAKER_00: Furthermore, that entire 60-minute session is actively recorded.
• 22:18
  SPEAKER_01: Wait, recorded?
• 22:19
  SPEAKER_00: Literally, a video screen capture of every mouse click and keystroke.
• 22:24
  SPEAKER_00: When the 60 minutes expire, the privilege is automatically stripped away.
• 22:28
  SPEAKER_01: So a hacker who steals that admin's daily password only gets standard user access.
• 22:32
  SPEAKER_01: They can't access the server without triggering the elevation request, which requires hardware MFA and approvals.
• 22:38
  SPEAKER_00: It's a brilliant choke point.
• 22:39
  SPEAKER_01: It really is.
• 22:40
  SPEAKER_01: But external vendors and IT admins are still humans.
• 22:43
  SPEAKER_01: The third pillar here, workload identity.
• 22:46
  SPEAKER_01: This feels like the wild west of enterprise architecture.
• 22:48
  SPEAKER_01: We're talking about managing machine identities.
• 22:51
  SPEAKER_00: This is the most urgent challenge facing the industry right now.
• 22:54
  SPEAKER_00: In a mature enterprise, for every one human employee, you might have 40 or 50 machine identities.
• 23:02
  SPEAKER_01: That many.
• 23:02
  SPEAKER_00: Oh, yeah.
• 23:03
  SPEAKER_00: These are automated scripts talking to SQL databases, microservices authenticating against APIs, and background cron jobs running financial calculations.
• 23:13
  SPEAKER_01: How are these governed in the past?
• 23:15
  SPEAKER_00: Terribly.
• 23:16
  SPEAKER_00: Honestly.
• 23:17
  SPEAKER_00: Developers would simply hard-code passwords or static API keys directly into the software code to make the systems talk to each other.
• 23:24
  SPEAKER_00: Nikes.
• 23:25
  SPEAKER_00: If a hacker breached a server and found that plain text API key, they had permanent unmonitored access to the database.
• 23:32
  SPEAKER_01: A total security nightmare.
• 23:33
  SPEAKER_01: And now the source documents indicate we are injecting generative AI into this already chaotic mix.
• 23:39
  SPEAKER_01: The blueprint calls this the era of shadow AI.
• 23:42
  SPEAKER_00: Do you remember Shadow IT?
• 23:44
  SPEAKER_01: Yeah, that was the era when business units got frustrated with how slow IT was, so a marketing director would just put a new SAUS application on their corporate credit card.
• 23:51
  SPEAKER_00: Exactly.
• 23:52
  SPEAKER_00: Security had no idea it existed, but corporate data was flowing into it.
• 23:55
  SPEAKER_01: Right.
• 23:56
  SPEAKER_01: And shadow AI is the 2026 equivalent.
• 23:59
  SPEAKER_00: Completely.
• 23:59
  SPEAKER_00: Business units are rapidly deploying autonomous AI agents to parse unstructured data, summarize meetings, call external web services, and automate complex workflows.
• 24:10
  SPEAKER_01: Aaron Powell They're basically little digital employees.
• 24:13
  SPEAKER_00: Right.
• 24:13
  SPEAKER_00: These agents are acting autonomously on behalf of the human users.
• 24:17
  SPEAKER_00: They have identities, they require access rates to function, but if the security architecture doesn't officially register them, they are unmanaged, ungoverned vulnerabilities operating at machine speed.
• 24:29
  SPEAKER_01: So if an AI agent has access to the finance directory to summarize reports, and a hacker injects a prompt into that AI, the AI could instantly exfiltrate the entire directory.
• 24:40
  SPEAKER_00: In seconds.
• 24:40
  SPEAKER_01: How are the major platforms responded to this?
• 24:42
  SPEAKER_00: Microsoft's architecture is attacking this via the Agent 365 ecosystem, specifically utilizing something called agent ID.
• 24:49
  SPEAKER_01: Agent ID.
• 24:50
  SPEAKER_00: The paradigm shift is that an AI agent must be treated as a first class identity.
• 24:54
  SPEAKER_00: It gets an agent ID and it is brought under the exact same rigorous governance, conditional access policies, and lifecycle management as Sarah in the marketing department.
• 25:03
  SPEAKER_01: Wait, I have to push back here.
• 25:04
  SPEAKER_01: How do you actually govern a piece of code?
• 25:06
  SPEAKER_01: What do you mean?
• 25:07
  SPEAKER_01: Let's go back to the human example.
• 25:08
  SPEAKER_01: If Sarah needs access to a restricted financial folder, she clicks a button.
• 25:13
  SPEAKER_01: The system routes the request to our manager.
• 25:16
  SPEAKER_01: The manager looks at it and says, Yes, Sarah needs this for the Q3 campaign and clicks approve.
• 25:21
  SPEAKER_01: Right.
• 25:22
  SPEAKER_01: But an AI agent doesn't have a human manager in the traditional sense.
• 25:26
  SPEAKER_01: It's code.
• 25:28
  SPEAKER_01: How do you govern an access request from an autonomous bot operating at thousands of actions per second?
• 25:33
  SPEAKER_01: Doesn't that just create a massive flood of false positives with human managers clicking approve all day long until they just ignore the alerts?
• 25:42
  SPEAKER_00: That is the exact trap legacy systems fall into.
• 25:45
  SPEAKER_00: You cannot use human speed governance for machine speed identities.
• 25:49
  SPEAKER_00: Alert fatigue will destroy the security posture.
• 25:52
  SPEAKER_01: Aaron Powell So what's the solution?
• 25:54
  SPEAKER_00: The answer, according to the architecture, lies in systems like the SailPoint Adaptive Identity Framework.
• 25:59
  SPEAKER_01: Aaron Powell Unpack that framework for me.
• 26:01
  SPEAKER_01: What is the mechanism behind it?
• 26:02
  SPEAKER_00: SalePoint recognized that static manual rules fail against AI.
• 26:07
  SPEAKER_00: So their adaptive identity framework relies on its own AI services and machine learning to establish a behavioral baseline.
• 26:14
  SPEAKER_01: Okay, so it watches the bot.
• 26:16
  SPEAKER_00: It performs continuous anomaly detection by ingesting massive amounts of telemetry.
• 26:21
  SPEAKER_00: It monitors the volume of API calls the agent makes, the specific subnets it originates from, the time of day it usually operates, and the exact classifications of data it normally touches.
• 26:31
  SPEAKER_01: Aaron Powell for that specific bot.
• 26:35
  SPEAKER_00: Precisely.
• 26:35
  SPEAKER_00: Let's say our financial summary AI agent normally accesses 20 PDF documents a day from a specific internal SharePoint site.
• 26:43
  SPEAKER_01: Aaron Powell That's its normal day.
• 26:44
  SPEAKER_00: Right.
• 26:44
  SPEAKER_00: One day, that exact same AI agent suddenly requests access to a massive trove of European customer privacy data stored in a different cloud environment, and it requests it at 3.am.
• 26:56
  SPEAKER_01: A massive deviation from the baseline.
• 26:57
  SPEAKER_00: Huge.
• 26:58
  SPEAKER_00: The AI governance framework flags the anomaly instantaneously.
• 27:01
  SPEAKER_00: Using dynamic workflow infrastructure, it doesn't just blindly grant the access because the bot has the right API key.
• 27:07
  SPEAKER_01: It blocks it.
• 27:08
  SPEAKER_00: It automatically blocks the request.
• 27:10
  SPEAKER_00: Or if the confidence level is ambiguous, maybe it's quarter-end and behavior patterns naturally shift.
• 27:16
  SPEAKER_00: It routes the request along a dynamic approval path.
• 27:19
  SPEAKER_01: So it does escalate it sometimes.
• 27:21
  SPEAKER_00: Yes.
• 27:21
  SPEAKER_00: It sends a highly contextualized alert to a human security officer.
• 27:26
  SPEAKER_00: Agent X is exhibiting a 92% deviation from its baseline behavior and is requesting restricted PII data.
• 27:33
  SPEAKER_00: Approve or deny.
• 27:35
  SPEAKER_01: So the AI governance platform acts as the highly intelligent manager for the AI agents, filtering out the noise and only escalating to human oversight when the machine mathematically detects an anomaly it can't resolve.
• 27:47
  SPEAKER_01: You are literally fighting AI with AI.
• 27:49
  SPEAKER_00: Machine speed threats require machine speed defense and governance.
• 27:53
  SPEAKER_00: Humans simply cannot calculate the risk matrix fast enough.
• 27:56
  SPEAKER_01: Which is mind-bending, but it perfectly transitions us into the final domain of the target state capability map.
• 28:01
  SPEAKER_01: This level of advanced oversight requires incredible visibility.
• 28:05
  SPEAKER_01: You can't govern what you can't see.
• 28:07
  SPEAKER_00: Absolutely not.
• 28:07
  SPEAKER_01: And that brings us to the brain of the operation: identity analytics and the underlying NIST risk frameworks.
• 28:13
  SPEAKER_00: We've talked about the doors, the locks, and the bouncers.
• 28:16
  SPEAKER_00: Now we are talking about the security cameras, the analytics engines, and the architectural standards that tie them all together.
• 28:23
  SPEAKER_01: Aaron Powell The map highlights identity analytics.
• 28:26
  SPEAKER_01: Yeah.
• 28:26
  SPEAKER_01: And specifically the concept of a permissions creep index.
• 28:30
  SPEAKER_01: I want to know exactly how this is calculated, because in the past, an auditor would look at a spreadsheet and ask a department head, does this user have too much access?
• 28:38
  SPEAKER_01: And the department head would just, you know, guess.
• 28:40
  SPEAKER_00: It was entirely subjective.
• 28:42
  SPEAKER_00: The permissions creep index removes the guesswork.
• 28:45
  SPEAKER_00: It is a quantifiable algorithmic metric.
• 28:48
  SPEAKER_01: Aaron Powell How does it calculate it?
• 28:49
  SPEAKER_00: The system analyzes every single digital entitlement a user holds across the entire enterprise.
• 28:56
  SPEAKER_00: It then cross-references those entitlements against the user's actual verified usage logs over a rolling window, usually the last 90 days.
• 29:04
  SPEAKER_01: It compares what you can do with what you actually do.
• 29:07
  SPEAKER_00: Yes.
• 29:07
  SPEAKER_00: But it goes a step further through peer group analysis.
• 29:10
  SPEAKER_00: The algorithm looks at the other 50 employees in the exact same role.
• 29:14
  SPEAKER_00: If Sarah has 500 discrete permissions, but the telemetry shows she only actively uses 12 of them, and her peers only have 15 permissions total, her index score spikes into the critical zone.
• 29:26
  SPEAKER_01: Because she has way too much access compared to what she needs.
• 29:28
  SPEAKER_00: Exactly.
• 29:29
  SPEAKER_00: It is a mathematical, data-driven mechanism to enforce the principle of least privilege.
• 29:35
  SPEAKER_00: The system can then automatically suggest revoking the 488 unused permissions.
• 29:45
  SPEAKER_01: How does a graph database differ from what administrators used to look at?
• 29:49
  SPEAKER_00: Traditionally, administrators looked at a flat list view.
• 29:52
  SPEAKER_00: Think of a standard SQL database or an Excel spreadsheet.
• 29:55
  SPEAKER_01: Just rows and columns.
• 29:56
  SPEAKER_00: Right.
• 29:56
  SPEAKER_00: It's linear.
• 29:57
  SPEAKER_00: User A is a member of group B.
• 29:59
  SPEAKER_00: Group B has access to folder C.
• 30:01
  SPEAKER_00: That's easy to read.
• 30:02
  SPEAKER_00: But modern enterprise architecture is not linear.
• 30:05
  SPEAKER_00: It's messy.
• 30:06
  SPEAKER_00: It is a massive tangled web of nested groups, inherited permissions, localized administrative roles, and overlapping trust relationships.
• 30:14
  SPEAKER_01: Right.
• 30:14
  SPEAKER_01: A flat list doesn't show you the chain reactions.
• 30:17
  SPEAKER_01: If I look at a flat list, I'm going to see that user A only has basic access to a testing server.
• 30:21
  SPEAKER_00: But what the flat list hides is that user A is a member of a nested group, which is granted localized admin rights to that testing server.
• 30:31
  SPEAKER_01: Oh, I see where this is going.
• 30:32
  SPEAKER_00: And that testing server inadvertently shares an active trust relationship with the primary production database.
• 30:39
  SPEAKER_00: Therefore, user A effectively has administrative rights to the production database through a hidden multi-hop pathway.
• 30:47
  SPEAKER_01: It's like the six degrees of Kevin Bacon, but for cyber vulnerabilities.
• 30:51
  SPEAKER_00: That is an excellent analogy.
• 30:52
  SPEAKER_00: The Sailpoint identity graph uses graphical database technology nodes and edges to visually map all of those hidden multi-hop privilege pathways.
• 31:03
  SPEAKER_00: They can literally see the blast radius.
• 31:05
  SPEAKER_00: They can identify a toxic access path that spans six different nested groups and remediate it instantly.
• 31:11
  SPEAKER_00: In a standard spreadsheet, that vulnerability is completely invisible until a hacker exploits it.
• 31:16
  SPEAKER_01: That visual observability is crucial.
• 31:19
  SPEAKER_01: Running parallel to all this technology, the architect must ensure the system complies with federal standards.
• 31:25
  SPEAKER_00: Right.
• 31:25
  SPEAKER_00: Compliance is non-negotiable.
• 31:26
  SPEAKER_01: The blueprint leans heavily on the NIST SP 863 Digital Identity Guidelines.
• 31:32
  SPEAKER_01: And the recent revisions to this framework fundamentally change how architects evaluate risk.
• 31:37
  SPEAKER_00: NIST 800 T63 is the gold standard for digital identity risk management.
• 31:42
  SPEAKER_00: And you're right, the recent unbundling of assurance levels was a massive paradigm shift.
• 31:47
  SPEAKER_01: Let's explore that.
• 31:48
  SPEAKER_01: In the older versions, there was a single concept called level of assurance, or LA.
• 31:53
  SPEAKER_01: It was just a scale from LOA1 to LOA4.
• 31:56
  SPEAKER_01: If a system was high risk, it was LOA4.
• 31:59
  SPEAKER_01: Why did NIST dismantle that?
• 32:01
  SPEAKER_00: Because a single monolithic number was too rigid.
• 32:04
  SPEAKER_00: It forced organizations to implement terrible user experiences in the name of blanket security.
• 32:10
  SPEAKER_00: Let's imagine a federal agency that needs extremely high confidence in who someone is before they open a case file.
• 32:15
  SPEAKER_00: But the actual daily transaction of checking the status of that file is low risk.
• 32:20
  SPEAKER_01: Okay, that makes sense.
• 32:20
  SPEAKER_00: Under the old LOA model, if the overall system was rated high, the agency was forced to make the user login with a complex cryptographic smart card every single time they wanted to check a web page.
• 32:31
  SPEAKER_01: Just to check a status.
• 32:32
  SPEAKER_00: Right.
• 32:32
  SPEAKER_00: It was massive overkill, incredibly expensive, and users hated it.
• 32:36
  SPEAKER_01: So NIST unbundled the risk into three separate independent components.
• 32:40
  SPEAKER_01: IAL, AAL, and FAL.
• 32:43
  SPEAKER_01: Let's define these.
• 32:44
  SPEAKER_00: First is IAL, identity assurance level.
• 32:47
  SPEAKER_00: This strictly refers to the proofing process, the onboarding.
• 32:50
  SPEAKER_01: Like proving who you are.
• 32:52
  SPEAKER_00: Exactly.
• 32:52
  SPEAKER_00: How confident are we that the human being creating the account is who they claim to be in the physical world?
• 32:58
  SPEAKER_00: IAL 1 is entirely self-asserted.
• 33:00
  SPEAKER_00: You type in a name, we believe you.
• 33:02
  SPEAKER_01: And IAL 2.
• 33:03
  SPEAKER_00: IAL2 requires remote evidence like uploading a scan of a driver's license and a selfie, which software compares.
• 33:10
  SPEAKER_00: IAL 3 is the highest.
• 33:12
  SPEAKER_00: It requires strict in-person physical presence, handing a biometric passport to a highly trained verification officer.
• 33:18
  SPEAKER_01: Okay, so IAL is just about proving who you are on day one.
• 33:20
  SPEAKER_01: What is the second component?
• 33:22
  SPEAKER_00: ALL Authenticator Assurance Level.
• 33:24
  SPEAKER_00: This is the daily login process.
• 33:25
  SPEAKER_00: AL1 might be a standard password or a PIN.
• 33:28
  SPEAKER_00: AL2 requires multi-factor authentication, something you know and something you have, like a time-based code on your phone.
• 33:34
  SPEAKER_00: AL3 requires a physical cryptographic hardware token bound to the device.
• 33:38
  SPEAKER_01: And the final piece.
• 33:42
  SPEAKER_00: This evaluates the cryptographic strength of the assertion protocol, like SAML or OpenID Connect, that passes the authentication ticket between the identity provider and the downstream application.
• 33:55
  SPEAKER_01: Just making sure it's secure in transit.
• 33:57
  SPEAKER_00: Right.
• 33:57
  SPEAKER_00: It ensures the ticket can't be intercepted or manipulated.
• 34:00
  SPEAKER_01: So if you're an IT director listening to this, why does this unbundling actually matter to your daily life?
• 34:06
  SPEAKER_00: I think it matters because it allows you to mix and match the security controls based on the specific, nuanced risk of the transaction rather than applying a blunt instrument to everything.
• 34:17
  SPEAKER_01: Exactly.
• 34:18
  SPEAKER_01: And we give you a really powerful privacy-enhancing scenario.
• 34:21
  SPEAKER_00: Let's hear it.
• 34:21
  SPEAKER_01: Imagine an organization that runs a highly sensitive whistleblower portal.
• 34:26
  SPEAKER_01: The organization must absolutely guarantee that the person submitting the data is an active, verified federal employee.
• 34:33
  SPEAKER_01: They require IAL 3 strict, in-person physical proof of your identity at a central office.
• 34:38
  SPEAKER_00: But if they tie your real verified name to your login every time you access the portal, you aren't anonymous anymore.
• 34:44
  SPEAKER_00: The whistleblowing is compromised.
• 34:46
  SPEAKER_00: Right.
• 34:47
  SPEAKER_00: By unbundling the standards, the architect can solve this.
• 34:50
  SPEAKER_00: They verify the human at IAL3.
• 34:53
  SPEAKER_00: But once verified, the system issues a pseudonymous digital credential.
• 34:57
  SPEAKER_00: Oh, that's clutter.
• 34:58
  SPEAKER_00: When the user logs into the online forum from home, they don't broadcast their real name.
• 35:03
  SPEAKER_00: They just broadcast that they are a verified entity.
• 35:05
  SPEAKER_00: And the architect can protect that daily login with standard MFAA.
• 35:11
  SPEAKER_01: So you separate the proof from the daily login.
• 35:14
  SPEAKER_00: You have completely separated the heavy physical proof of identity from the daily authentication mechanism.
• 35:20
  SPEAKER_00: You protect the user's anonymity and privacy while mathematically maintaining the integrity of the system.
• 35:25
  SPEAKER_01: It's elegant.
• 35:26
  SPEAKER_01: It's really nuanced risk management.
• 35:28
  SPEAKER_01: So we've mapped out a beautiful, airtight, AI-powered future state.
• 35:32
  SPEAKER_01: We have the executive vision, the zero trust principles, the capability map governing humans and machines, the deep analytics, and the NIST frameworks guiding the risk.
• 35:41
  SPEAKER_01: It is an enterprise architect's absolute dream.
• 35:43
  SPEAKER_00: It is a phenomenal blueprint.
• 35:45
  SPEAKER_01: But there is a massive reality check waiting at the end of phase two.
• 35:49
  SPEAKER_01: None of this.
• 35:50
  SPEAKER_01: Not the hardware keys, not the SCM 2.0 provisioning, not the AI anomaly detection.
• 35:56
  SPEAKER_01: None of it happens if the business won't write the check.
• 35:59
  SPEAKER_00: That is a harsh reality.
• 36:01
  SPEAKER_00: You can design the most sophisticated identity graph in the world, but if the software licensing and implementation costs are$5 million, and you cannot articulate the financial return on that investment, the project is dead in the water.
• 36:15
  SPEAKER_01: Which brings us to the final hurdle: the business case and the decision gate.
• 36:20
  SPEAKER_01: Surviving CFO scrutiny.
• 36:22
  SPEAKER_01: The blueprint outlines how to build the business case around four specific value levers: risk reduction, operational efficiency, compliance cost avoidance, and business enablement.
• 36:32
  SPEAKER_00: Those are the four pillars of ROI here.
• 36:34
  SPEAKER_01: Let's break those down.
• 36:35
  SPEAKER_01: How do you quantify risk reduction?
• 36:37
  SPEAKER_01: That always feels like trying to prove a negative to an executive.
• 36:39
  SPEAKER_01: Like, hey, we didn't suffer a ransomware attack this year, so my expensive software worked.
• 36:43
  SPEAKER_00: It requires an actuarial mindset.
• 36:45
  SPEAKER_00: You don't deal in hypotheticals, you deal in probabilities and historical data.
• 36:48
  SPEAKER_01: Okay, how so?
• 36:49
  SPEAKER_00: You calculate the average cost of a credential compromise in your specific industry.
• 36:54
  SPEAKER_00: You factor in legal fees, regulatory fines, lost operational revenue during downtime, customer churn, and potential ransomware payouts.
• 37:02
  SPEAKER_00: Let's say, based on industry reports, the average cost of a breach for your sector is$6 million, and your historical data shows your company faces a high probability incident every three years.
• 37:14
  SPEAKER_01: So you have a baseline risk cost of$2 million a year.
• 37:17
  SPEAKER_00: Correct.
• 37:18
  SPEAKER_00: If your proposed target state architecture, specifically implementing fishing resistant MFA and the continuous access evaluation we discussed, reduces the mathematical probability of successful account takeover by 90%, you can assign a hard dollar value to that risk reduction.
• 37:33
  SPEAKER_01: Oh, I see.
• 37:34
  SPEAKER_00: You are buying a highly effective insurance policy.
• 37:36
  SPEAKER_01: That makes us to a CFO, it's risk math.
• 37:38
  SPEAKER_01: What about the second lever, operational efficiency?
• 37:41
  SPEAKER_01: That feels much easier to calculate because it's tangible labor.
• 37:43
  SPEAKER_00: It is entirely tangible.
• 37:45
  SPEAKER_00: You look at the current labor costs within the IT department.
• 37:48
  SPEAKER_00: How many hours a week does the help desk spend manually verifying users over the phone and resetting passwords?
• 37:54
  SPEAKER_01: Probably hundreds.
• 37:55
  SPEAKER_00: How many hours are spent manually provisioning accounts for the 200 new employees hired every month?
• 38:01
  SPEAKER_00: You multiply those hours by the fully burdened hourly labor rate of the IT staff.
• 38:05
  SPEAKER_01: And then compare it.
• 38:06
  SPEAKER_00: When you implement sale point and entra ID to automate the entire joiner move reliever process via SEMM 2.0, those labor costs plimit to near zero.
• 38:17
  SPEAKER_00: You reclaim thousands of hours of highly paid engineering time.
• 38:21
  SPEAKER_00: That is direct, measurable operational savings.
• 38:24
  SPEAKER_01: And the third lever, compliance cost avoidance.
• 38:28
  SPEAKER_00: Preparing for a federal audit like SOX or HIPAA manually is agonizing.
• 38:33
  SPEAKER_00: It takes cross-functional teams of people, weeks, sometimes months, to pull spreadsheets, verify access logs, and prove to auditors that separation of duties was maintained.
• 38:42
  SPEAKER_01: It's a huge drain on resources.
• 38:44
  SPEAKER_00: Furthermore, if the auditors find gaps, if they find that toxic combination of access we discussed earlier, the remediation costs and regulatory fines can be staggering.
• 38:52
  SPEAKER_01: So automation fixes that.
• 38:54
  SPEAKER_00: By deploying automated SOD checks and continuous compliance reporting, you avoid the fines entirely and you drastically reduce the internal labor required to facilitate the audit itself.
• 39:02
  SPEAKER_01: And finally, business enablement.
• 39:05
  SPEAKER_01: This is the one lever that actually accelerates the business making money rather than just protecting it or saving it.
• 39:11
  SPEAKER_00: Exactly.
• 39:11
  SPEAKER_00: Time is money.
• 39:13
  SPEAKER_00: If a highly specialized software engineer is hired at$180,000 a year and the legacy IT process takes three weeks to grant them the necessary access to the code base and development servers, the company just wasted over$10,000 of raw productivity.
• 39:27
  SPEAKER_01: They're just sitting there.
• 39:28
  SPEAKER_00: If your automated IAM architecture gets them fully provisioned and coding on day one, you are actively enabling the business to hit its product deadlines faster.
• 39:37
  SPEAKER_00: Similarly, if your external identity CIM solution makes it frictionless for a supply chain partner to log in, onboard themselves, and place bulk orders, you are directly accelerating revenue.
• 39:48
  SPEAKER_01: And the data backs up this financial narrative.
• 39:50
  SPEAKER_01: The SalePoint 2025 report cited in our sources provide some phenomenal empirical statistics on this.
• 39:56
  SPEAKER_01: They found that IMM consistently delivers twice the return on investment of other generalized security domains.
• 40:02
  SPEAKER_00: And it goes even further for mature organizations.
• 40:05
  SPEAKER_00: For enterprises that treat identity strategically, meaning they have progressed beyond basic password management and integrated the advanced AI governance and adaptive trust frameworks we mapped out today, they report ROI multiples of up to 10x.
• 40:23
  SPEAKER_01: When you put that multiple in front of a CFO, alongside the actuarial risk reduction, the funding gets approved.
• 40:29
  SPEAKER_00: But you must package it correctly.
• 40:31
  SPEAKER_00: Which brings us to the formal deliverables that close out phase two.
• 40:35
  SPEAKER_00: The architect cannot just walk in with a slide deck.
• 40:39
  SPEAKER_00: They must present the formal IAM strategy document, the comprehensive business case we just modeled, the conceptual target state architecture blueprints, and a granular gap analysis showing exactly where the organization's technical debt is today versus the 2026 standard.
• 40:54
  SPEAKER_01: All this culminates in what the Blueprint calls the decision gate.
• 40:57
  SPEAKER_00: The decision gate is the ultimate test of the architect's ability to align deeply complex technology with cold, hard business reality.
• 41:05
  SPEAKER_00: You present the strategy, the capability map, and the financial case to the executive steering committee.
• 41:11
  SPEAKER_01: And if they say no.
• 41:12
  SPEAKER_00: If executive sign-off and most importantly budget commitment are not achieved at this exact point, the architect must stop the project.
• 41:20
  SPEAKER_01: Wait, stop entirely.
• 41:22
  SPEAKER_01: You don't just proceed with a smaller pilot program to prove the concept.
• 41:26
  SPEAKER_00: No.
• 41:26
  SPEAKER_00: The blueprint is emphatic and uncompromising on this point.
• 41:29
  SPEAKER_00: You cannot build a downstream enterprise-wide architecture on an unfunded or unapproved strategy.
• 41:36
  SPEAKER_00: Why not?
• 41:36
  SPEAKER_00: If you try to hack together a solution using only half the budget, you will deploy a fragmented system that introduces more vulnerabilities than it solves.
• 41:45
  SPEAKER_00: If you don't pass the decision gate, you must go back to the drawing board, rescope the strategy, and align it with the reality of what the business is willing to support.
• 41:53
  SPEAKER_00: Moving to phase three without passing this gate guarantees a failed program.
• 41:58
  SPEAKER_01: That is a stark, almost brutal discipline, but it makes perfect sense.
• 42:02
  SPEAKER_01: You cannot build a massive skyscraper if the client only funded a residential foundation.
• 42:07
  SPEAKER_01: Well, we have covered an immense amount of ground today.
• 42:09
  SPEAKER_01: We started in the rookie, diagnostic, muddy waters of phase one, looking at a shattered perimeter.
• 42:15
  SPEAKER_01: We mapped out the path to absolute clarity.
• 42:17
  SPEAKER_01: We explored the necessity of translating technical protocols into an executive vision statement that bridges the server room and the boardroom.
• 42:25
  SPEAKER_01: We established the strategic guardrails, recognizing that identity is the new firewall, and the continuous access evaluation must replace the static bouncer at the door.
• 42:34
  SPEAKER_00: We unpacked a massive interconnected target state capability map, too.
• 42:39
  SPEAKER_01: Yes, we explored how Enter ID and SailPoint coexist using protocols like SEIM 2.0 to automate the human lifecycle, shrinking the window vulnerability to zero.
• 42:48
  SPEAKER_01: And we tackled the explosive new frontier of workload identities, detailing how adaptive AI frameworks provide machine speed governance over autonomous AI agents.
• 42:56
  SPEAKER_00: It's a whole new world.
• 42:58
  SPEAKER_01: It really is.
• 42:58
  SPEAKER_01: We looked at the intelligence engine, the mathematical rigor of the permissions creep index, the visual observability of the identity graph, and the nuanced privacy-enhancing unbundling of NIST's ILL, AAL, and FAL frameworks.
• 43:12
  SPEAKER_01: And we wrapped it all up in a rock solid, mathematically defensible business case designed to survive the ultimate test of the CFO's decision gate.
• 43:22
  SPEAKER_01: It really is a masterclass in modern enterprise architecture.
• 43:25
  SPEAKER_00: It's the blueprint for the future.
• 43:26
  SPEAKER_01: But before we sign off, I want to leave you with a final provocative pubble to mull over.
• 43:30
  SPEAKER_01: Something that builds on the very foundation of everything we've discussed today.
• 43:34
  SPEAKER_01: We spent a significant amount of time praising automation, specifically automating the entire identity lifecycle based on an authoritative source, usually the HR system like Workday or SAP.
• 43:45
  SPEAKER_00: Right, the zero touch engine.
• 44:00
  SPEAKER_01: Zero touch engine.
• 44:01
  SPEAKER_00: It is the absolute pinnacle of operational efficiency and risk mitigation.
• 44:05
  SPEAKER_01: But consider this scenario.
• 44:07
  SPEAKER_01: What happens to this beautiful, mathematically perfect, zero trust architecture if the HR system itself is compromised by a malicious insider?
• 44:15
  SPEAKER_00: Oh wow.
• 44:16
  SPEAKER_01: What if a disgruntled HR administrator or a sophisticated attacker who hijacked an HR account simply logs into workday and changes a user's department code from janitorial staff to executive finance manager?
• 44:29
  SPEAKER_01: The system would just execute it.
• 44:31
  SPEAKER_01: Exactly.
• 44:32
  SPEAKER_01: If the ultimate authoritative source of truth tells a lie, your perfectly designed automation engine won't catch it.
• 44:38
  SPEAKER_01: It will simply execute that lie at enterprise scale.
• 44:41
  SPEAKER_01: It will obediently and flawlessly grant toxic administrative access across every downstream financial application in milliseconds.
• 44:49
  SPEAKER_00: That is the ultimate paradox of identity automation.
• 44:52
  SPEAKER_00: The faster and more efficiently you can provision access, the faster you can provision a catastrophic breach if the root source of trust is poisoned.
• 44:58
  SPEAKER_01: Remember our opening metaphor.
• 45:00
  SPEAKER_01: We wanted to build a high-resolution X-ray machine for identity to replace the muddy waters.
• 45:06
  SPEAKER_01: We succeeded.
• 45:07
  SPEAKER_01: But if the actual film inside the X-ray machine is corrupted at the source, the clear diagnosis you get is worse than useless.
• 45:14
  SPEAKER_01: It's actively misleading.
• 45:15
  SPEAKER_01: It forces us to ask a terrifying question in a fully automated machine speed world, who is guarding the ultimate source of truth.
• 45:23
  SPEAKER_01: Thank you for joining us on this deep dive.
• 45:25
  SPEAKER_01: Keep questioning your digital perimeters, keep exploring the architecture, and we'll see you next time.
• 45:31
  SPEAKER_01: That's a wrap on identity strategy and target state design.
• 45:35
  SPEAKER_01: But before you go, sit with the question we left you with.
• 45:39
  SPEAKER_01: In a fully automated, machine speed identity architecture, who is actually guarding the source of truth?
• 45:46
  SPEAKER_01: Because in episode four, that question gets darker.
• 45:50
  SPEAKER_01: We're going to show you exactly what happens when an organization buys a world-class identity platform, deploys it flawlessly, and still fails catastrophically.
• 46:00
  SPEAKER_01: Not because the technology was wrong, because the governance wasn't there first.
• 46:05
  SPEAKER_01: If you think IAM is a procurement exercise, episode four will change how you see this discipline permanently.
• 46:12
  SPEAKER_01: Connect with me on LinkedIn at LinkedIn.com forward slash IN forward slash Ernie Prescott, and subscribe now so you don't miss it.
• 46:19
  SPEAKER_01: Until next time.