Latest / The Identity Blueprint / Identity Program Operations and Metrics

Transcript

Identity Program Operations and Metrics · The Identity Blueprint

• 0:00
  SPEAKER_02: Welcome back to the Identity Blueprint, where enterprise identity and access management gets the depth it deserves.
• 0:07
  SPEAKER_02: I'm Ernie Prescott, Principal IAM Architect, and in episodes one through seven, Jose and I took you from strategy through architecture, governance, lifecycle design, and implementation.
• 0:19
  SPEAKER_02: Today we tackle the question most programs never get around to asking.
• 0:23
  SPEAKER_02: How do you actually know if any of it is working?
• 0:26
  SPEAKER_02: Episode eight.
• 0:31
  SPEAKER_02: Phase seven of the IAM engagement blueprint, the operating model, the KPI dashboard, and the telemetry that separates organizations that believe they are secure from those that can mathematically prove it.
• 0:44
  SPEAKER_02: We're drawing from SailPoint, CyberArc, Ping Identity, Okta, NIST, and CISA to break down the four-tier human architecture, JML velocity metrics, the psychology of the Access Review rubber stamp, and what a living IAM operating model actually looks like in production.
• 1:03
  SPEAKER_02: If you've ever presented a compliance report and secretly wondered whether the numbers were telling the real story, this episode is for you.
• 1:11
  SPEAKER_02: Let's get into it.
• 1:13
  SPEAKER_01: You know, usually when we talk about a medical diagnosis, there's um there's this expectation of clinical precision.
• 1:19
  SPEAKER_02: Right, absolutely.
• 1:20
  SPEAKER_01: Like you fall, your arm sells up, you go to the hospital, and the X-ray shows that stark, jagged white line across the bone.
• 1:26
  SPEAKER_01: The doctor points to it, and you both know exactly what's wrong.
• 1:29
  SPEAKER_01: It's binary.
• 1:30
  SPEAKER_02: Broken or not broken.
• 1:32
  SPEAKER_01: Exactly.
• 1:32
  SPEAKER_01: It's visible, it's categorized, and honestly, even if it hurts, it's comforting because you know the exact state of the system.
• 1:41
  SPEAKER_02: We really crave that visibility.
• 1:43
  SPEAKER_02: Yeah.
• 1:43
  SPEAKER_02: You know, we want a dashboard that says healthy or failing in bright, undeniable colors.
• 1:49
  SPEAKER_01: Aaron Powell But then you step into the world of enterprise security, specifically identity governance, and suddenly that X-ray machine is just printing static.
• 1:57
  SPEAKER_01: We're looking at a diagnostic landscape that is incredibly murky.
• 2:01
  SPEAKER_01: I mean, you've got tens of thousands of employees, hundreds of applications, non-human service accounts, overlapping permission structures, trying to diagnose the health of an identity and access management program, what we in the industry call IAM, is just a massive ongoing undertaking.
• 2:16
  SPEAKER_02: It really is.
• 2:17
  SPEAKER_02: It's never finished.
• 2:18
  SPEAKER_01: So today we are going to completely demystify phase seven of the IAM program engagement blueprint, which covers operationalization and metrics.
• 2:28
  SPEAKER_01: And we aren't just reading one manual for this deep dive.
• 2:31
  SPEAKER_01: We are synthesizing the core blueprint with tactical telemetry from Sailpoint, CyberArc, Ping Identity, and Okta while, you know, mapping it all against the government frameworks from NIST and CISA.
• 2:44
  SPEAKER_02: Phase seven is really where the rubber meets the road.
• 2:46
  SPEAKER_02: If you don't have this phase locked down, I mean you don't have a security program, you have a very expensive illusion of security.
• 2:52
  SPEAKER_01: Yeah.
• 2:52
  SPEAKER_01: Think about it like designing a state-of-the-art nuclear submarine, going through phases one through six of this blueprint, the strategy, the policy framework, the technology architecture, the deployment that's building the vessel.
• 3:03
  SPEAKER_02: Right, the construction phase.
• 3:04
  SPEAKER_01: Yeah.
• 3:04
  SPEAKER_01: You buy the finest steel, you integrate the best nuclear reactor, you wire up the command center, and you can step back and admire this multi-million dollar feat of engineering sitting safely in dry dock.
• 3:14
  SPEAKER_01: But phase seven is what happens when you actually put a human crew inside, seal the hatch, submerge under a crushing ocean of daily cyber threats, and run the thing.
• 3:23
  SPEAKER_02: And if your crew doesn't know how to read the pressure dials, or even worse, if the dials are lying to them, that submarine isn't just going to drift, it's going to implode.
• 3:32
  SPEAKER_01: The pressure is entirely unforgiving.
• 3:34
  SPEAKER_02: It is.
• 3:35
  SPEAKER_02: And to put hard numbers on the cost of that submarine sinking, the latest strategic intelligence reports from the Identity Management Institute show the average cost of a data breach has hit$4.45 million.
• 3:46
  SPEAKER_01: Wow.
• 3:47
  SPEAKER_01: Over four million.
• 3:48
  SPEAKER_02: Yeah.
• 3:49
  SPEAKER_02: But the crucial data point for us here is that nearly a third of those breaches involve stolen credentials.
• 3:54
  SPEAKER_02: They don't hack in, they log in.
• 3:56
  SPEAKER_01: They just walk right through the front door.
• 3:57
  SPEAKER_02: Exactly.
• 3:58
  SPEAKER_02: So phase seven is the operational shield against that exact disaster.
• 4:03
  SPEAKER_02: It's the transition from a perfectly designed static architecture to a living, breathing, continuously validating defense system.
• 4:10
  SPEAKER_01: Aaron Powell Okay, so before we can even begin to measure the health of the system, before we look at the dials, we need to know who is actually sitting at the controls.
• 4:18
  SPEAKER_01: The blueprint explicitly outlines an IAM operating model to manage this transition from build to run, and it structures the human element into a four-tier hierarchy.
• 4:27
  SPEAKER_02: Aaron Powell Right.
• 4:28
  SPEAKER_02: And this four-tier support model is designed to isolate specific types of operational friction so that they don't drag down the entire security apparatus.
• 4:37
  SPEAKER_01: Aaron Powell Let's unpack this.
• 4:39
  SPEAKER_01: Tier one is the service desk.
• 4:41
  SPEAKER_01: Now we all know they handle the immediate high-volume issues like password resets and MFA enrollments.
• 4:46
  SPEAKER_02: The frontline stuff.
• 4:47
  SPEAKER_01: Yeah.
• 4:48
  SPEAKER_01: But the blueprint highlights a massive governance risk here.
• 4:52
  SPEAKER_01: If tier one lacks strict identity-proofing protocols, they become the soft underbelly of the organization.
• 4:59
  SPEAKER_01: They are the absolute prime target for social engineering.
• 5:02
  SPEAKER_02: Oh, absolutely.
• 5:03
  SPEAKER_02: I mean, attackers aren't always trying to brute force a password anymore.
• 5:06
  SPEAKER_02: That's too hard.
• 5:07
  SPEAKER_02: They're calling the service desk at 2.0 AM on a Friday, sounding panicked.
• 5:12
  SPEAKER_01: Right, claiming they have a huge deadline.
• 5:14
  SPEAKER_02: Exactly.
• 5:14
  SPEAKER_02: And maybe they're even using AI-generated deepfake audio of an executive claiming they lost their phone and need their MFA token reset to a new device.
• 5:22
  SPEAKER_01: Aaron Powell, which is terrifying.
• 5:24
  SPEAKER_02: It is, because if Tier 1 doesn't have a rigid, mathematically verifiable way to prove the person on the phone is who they claim to be like, sending a push notification to a pre-registered secondary device or requiring verification from a direct manager, the attacker bypasses your entire multimillion dollar infrastructure with a five-minute phone call.
• 5:45
  SPEAKER_01: Yeah, all that fancy crypto just bypassed by a polite IT guy trying to be helpful.
• 5:50
  SPEAKER_02: Precisely.
• 5:51
  SPEAKER_01: Which brings us to tier two, IAM operations.
• 5:54
  SPEAKER_01: These are the specialists managing the deviations from the standard process.
• 5:58
  SPEAKER_01: They handle provisioning exceptions, manage the sprawl of active directory groups, and you know, troubleshoot the integrations when your HR system refuses to sync with your downstream cloud apps.
• 6:09
  SPEAKER_02: Yeah, they are basically the containment field for technical debt.
• 6:12
  SPEAKER_02: When an automated workflow breaks, tier two steps in so the business doesn't grind to a halt.
• 6:17
  SPEAKER_02: But their real job is to fix the immediate issue within the bounds of governance, document the failure, and pass the systemic issue up the chain.
• 6:24
  SPEAKER_01: Up to tier three, IAM engineering.
• 6:27
  SPEAKER_01: These are the builders maintaining the engine while it's running at a thousand RPM.
• 6:31
  SPEAKER_02: Right, the heavy lifters.
• 6:32
  SPEAKER_01: They manage the complex conditional access policies, tune the lifecycle workflows, and build the actual API integrations.
• 6:39
  SPEAKER_01: And then sitting above them is tier four, IAM architecture.
• 6:43
  SPEAKER_01: The visionary is ensuring the technology aligns with the multi-year business strategy, overseen governance, and assessing the overall risk posture against frameworks like CISA's zero trust model.
• 6:54
  SPEAKER_02: That's the ideal structure, yes.
• 6:55
  SPEAKER_01: Okay, but hold on.
• 6:56
  SPEAKER_01: Let me play devil's advocate here.
• 6:57
  SPEAKER_01: Looking at this four-tier structure, it just screams corporate bureaucracy to me.
• 7:01
  SPEAKER_02: I hear that a lot.
• 7:02
  SPEAKER_01: Right, because we're layering management on top of management, siloing tasks into these rigid buckets.
• 7:08
  SPEAKER_01: Isn't this like a hospital triage system gone wrong?
• 7:12
  SPEAKER_01: Like if your organization is burning down because of a massive access failure and your top brain surgeon, your tier four architect, is barred from jumping into the ER to fix a routing issue because it's a tier two responsibility, doesn't the whole hospital fail?
• 7:25
  SPEAKER_01: Why do we need to force engineers into these rigid tiers?
• 7:28
  SPEAKER_02: It seems counterintuitive when you're in a crisis.
• 7:31
  SPEAKER_02: I'll give you that.
• 7:31
  SPEAKER_02: Yeah.
• 7:32
  SPEAKER_02: But what's fascinating here is that without this specific tiered model, programs inevitably experience what the blueprint terms a decay back to ad hoc operations.
• 7:43
  SPEAKER_01: Ad hoc operations in chaos.
• 7:46
  SPEAKER_02: Complete chaos.
• 7:47
  SPEAKER_02: It is incredibly dangerous to collapse these tiers.
• 7:50
  SPEAKER_02: And um here is the exact mechanism of why.
• 7:54
  SPEAKER_02: If your tier three engineer, the person whose sole job is to write the automation scripts that govern thousands of access points, is constantly pulled away to manually provision an account for a frustrated vice president, they aren't just losing productivity.
• 8:09
  SPEAKER_01: Introducing vulnerabilities.
• 8:10
  SPEAKER_02: Exactly.
• 8:11
  SPEAKER_02: Because they take shortcuts.
• 8:12
  SPEAKER_01: Walk me through what that shortcut actually looks like.
• 8:14
  SPEAKER_01: Paint that picture for me.
• 8:15
  SPEAKER_02: Okay, let's say a senior marketing director complains they can't access a new cloud-based analytics platform.
• 8:21
  SPEAKER_02: They need it for a board meeting in 10 minutes.
• 8:22
  SPEAKER_02: They're panicking.
• 8:23
  SPEAKER_01: They've all been there.
• 8:24
  SPEAKER_02: Right.
• 8:24
  SPEAKER_02: So the ticket bypasses tier one and two, landing directly on the desk of a tier three engineer.
• 8:30
  SPEAKER_02: Now the engineer knows the proper way is to add the user to the correct role in the identity governance platform, wait for the approval workflow to trigger, let the system generate the audit log, and then automatically provision the account via the API.
• 8:42
  SPEAKER_01: Which is safe and auditable.
• 8:44
  SPEAKER_02: Yes.
• 8:44
  SPEAKER_02: But that takes 20 minutes, and the meeting isn't 10.
• 8:48
  SPEAKER_02: The engineer wants to be helpful and fast.
• 8:51
  SPEAKER_02: So they open up the back-end database or they go directly into the administrative console of the analytics app and they manually flip the user's access switch to true.
• 9:00
  SPEAKER_01: Oh wow.
• 9:00
  SPEAKER_01: They bypass the governor entirely.
• 9:02
  SPEAKER_02: They bypass the entire governance framework.
• 9:04
  SPEAKER_02: The user is happy, the board meeting goes well, and the engineer closes the ticket.
• 9:09
  SPEAKER_02: But they have just created undocumented shadow IT access.
• 9:12
  SPEAKER_01: Because the main system doesn't know about it.
• 9:15
  SPEAKER_02: Exactly.
• 9:16
  SPEAKER_02: The central identity system, the brain of your submarine, thinks that user does not have access to the analytics platform.
• 9:23
  SPEAKER_02: But in reality, they have native administrative rights.
• 9:26
  SPEAKER_02: When the auditors arrive and demand a report of everyone who can access customer data, that user will not be on a list.
• 9:33
  SPEAKER_01: That's a huge compliance violation right there.
• 9:35
  SPEAKER_02: It gets worse.
• 9:37
  SPEAKER_02: When that user leaves the company, the automated deprovisioning system will delete their core accounts, like their email, but it won't touch the analytics app because it doesn't know the connection exists.
• 9:48
  SPEAKER_01: Oh man.
• 9:49
  SPEAKER_02: You now have an active, highly privileged account floating in the wild tied to a former employee.
• 9:54
  SPEAKER_01: That is terrifying.
• 9:55
  SPEAKER_01: So the bureaucracy isn't there to slow the business down.
• 9:58
  SPEAKER_01: It's there to prevent invisible doors from being hard-coded into the hull of the submarine.
• 10:03
  SPEAKER_02: Precisely.
• 10:04
  SPEAKER_01: The sources actually give a name to the operational breakdown when this deprovisioning fails.
• 10:09
  SPEAKER_01: They call it lever latency in the phase one discovery sources, and it's heavily monitored in phase seven.
• 10:14
  SPEAKER_02: Yeah, the deprovisioning gap is arguably the most critical metric on any auditor's clipboard.
• 10:19
  SPEAKER_01: Let's trace the anatomy of this failure for you, the listener.
• 10:23
  SPEAKER_01: Imagine your HR department terminates an employee at 9 near 0 a.m.
• 10:27
  SPEAKER_01: on a Monday for misconduct.
• 10:29
  SPEAKER_02: The high risk termination.
• 10:30
  SPEAKER_01: Yeah.
• 10:31
  SPEAKER_01: In a mature phase seven environment, the HR information systems say workday updates their status to terminated.
• 10:38
  SPEAKER_01: That status change triggers an API call to the identity platform, which instantly reaches out to every connected application and revokes the session tokens.
• 10:46
  SPEAKER_01: Access is gone by 9.01 AM.
• 10:49
  SPEAKER_02: That's the ideal state.
• 10:50
  SPEAKER_01: But if your operating model is decayed, let's look at what happens.
• 10:54
  SPEAKER_01: HR sends an email to the IT service desk to disable the account.
• 10:57
  SPEAKER_01: Tier 1 gets the email, but maybe the employee has specialized access to a legacy mainframe that tier one doesn't have the rights to touch.
• 11:05
  SPEAKER_02: So they escalate it.
• 11:06
  SPEAKER_01: Right, they escalate the ticket to tier three.
• 11:08
  SPEAKER_01: But tier three is currently fighting a server outage, so the ticket just sits in the queue.
• 11:12
  SPEAKER_01: It takes until Friday afternoon for an engineer to manually go into the mainframe and kill the access.
• 11:17
  SPEAKER_01: You now have a four-day window of catastrophic exposure.
• 11:21
  SPEAKER_02: A four-day window where a hostile former employee who already knows the internal network topology, who knows where the sensitive data is stored, and who possesses valid credentials can log in remotely.
• 11:32
  SPEAKER_02: They can exfiltrate intellectual property, sabotage systems, or deploy ransomware.
• 11:37
  SPEAKER_00: And all of it looks legitimate.
• 11:39
  SPEAKER_02: That's the scariest part.
• 11:40
  SPEAKER_02: Because they are using valid credentials, your standard threat detection tools might not even flag it as an anomaly.
• 11:47
  SPEAKER_02: To the system, it just looks like an authorized user doing their job.
• 11:52
  SPEAKER_02: This is why orphaned accounts and delayed revocations are the absolute holy grail for threat actors.
• 11:57
  SPEAKER_02: They don't have to break your cryptography, they just walk through a door you forgot to lock.
• 12:02
  SPEAKER_00: That is such a chilling thought.
• 12:03
  SPEAKER_01: Okay, so moving from the human element, the crew managing the tiers, we need to look at the actual telemetry.
• 12:09
  SPEAKER_01: What are the specific dials on the dashboard that tell us if the submarine is structurally sound?
• 12:14
  SPEAKER_02: The metrics.
• 12:15
  SPEAKER_01: Right.
• 12:15
  SPEAKER_01: This transitions us deeply into the core lifecycle KPIs.
• 12:19
  SPEAKER_01: We are shifting from the people running the program to the data tracking the flow of every single identity in the ecosystem.
• 12:26
  SPEAKER_01: The sources refer to this as the JML life cycle.
• 12:30
  SPEAKER_01: Joiner, mover, lever.
• 12:32
  SPEAKER_02: He is the absolute heartbeat of identity security.
• 12:35
  SPEAKER_02: If your JML telemetry is irregular, your organization is suffering from a massive operational arrhythmia.
• 12:42
  SPEAKER_01: I love that comparison.
• 12:42
  SPEAKER_01: The blueprint doesn't just offer suggestions here, it dictates very specific service level agreements or SLAs for this life cycle.
• 12:50
  SPEAKER_01: Let's start with the joiner process.
• 12:52
  SPEAKER_01: The target metric here is brutal.
• 12:54
  SPEAKER_01: It should take less than four hours from the authoritative HR event to an active, fully provisioned account.
• 12:59
  SPEAKER_02: Under four hours.
• 13:00
  SPEAKER_01: The document literally mandates that day one access must be a reality, not an aspirational goal.
• 13:06
  SPEAKER_01: But why is speed so critical here from a security perspective?
• 13:09
  SPEAKER_01: We usually think of speed as a business enabler, not a security control.
• 13:12
  SPEAKER_02: Aaron Powell Well, think about human nature.
• 13:14
  SPEAKER_02: If it takes two weeks for a new hire to get their official corporate email, access to the CRM, and entry to the code repositories, the business doesn't stop.
• 13:22
  SPEAKER_01: People still have to do their jobs.
• 13:24
  SPEAKER_02: Exactly.
• 13:24
  SPEAKER_02: Employees want to be productive, so they work around you.
• 13:27
  SPEAKER_02: The manager will say, hey, just use your personal Gmail account to view these documents for now.
• 13:32
  SPEAKER_02: Or here, just log in using my credentials so you can get started.
• 13:36
  SPEAKER_01: Ah, the classic copy user anti-pattern.
• 13:39
  SPEAKER_02: Precisely.
• 13:40
  SPEAKER_02: You immediately fracture your security perimeter because IT failed to deliver the service.
• 13:45
  SPEAKER_02: By enforcing a strict four-hour SLA on joiner provisioning, you eliminate the operational desperation that drives employees toward insecure workarounds.
• 13:54
  SPEAKER_02: You keep them inside the governed environment from minute one.
• 13:57
  SPEAKER_01: That makes total sense.
• 13:58
  SPEAKER_01: Then we have the lever process, which we touched on with the 900 AM termination scenario.
• 14:04
  SPEAKER_01: The KPIs here are completely unforgiving.
• 14:07
  SPEAKER_01: Deprovisioning time must be less than one hour for an involuntary termination.
• 14:11
  SPEAKER_02: 60 minutes, max.
• 14:12
  SPEAKER_01: If someone is fired, their access must evaporate before they are even escorted out of the building.
• 14:17
  SPEAKER_01: Now, for a voluntary resignation, say someone giving two weeks' notice, you have slightly more breathing room with a target of less than eight hours.
• 14:25
  SPEAKER_01: The ultimate goal is to get your orphaned account count to absolute zero.
• 14:29
  SPEAKER_02: Or as close as mathematically possible.
• 14:31
  SPEAKER_01: Right.
• 14:32
  SPEAKER_01: The blueprint allows a tolerance of strictly less than 0.5% of total accounts, purely to account for highly complex technical edge cases, but zero is the mandate.
• 14:42
  SPEAKER_01: But what about the middle of the life cycle?
• 14:44
  SPEAKER_02: The movers.
• 14:45
  SPEAKER_01: Yes.
• 14:45
  SPEAKER_01: We covered joiners coming in and levers going out.
• 14:49
  SPEAKER_01: But what about the movers?
• 14:50
  SPEAKER_01: The people who get promoted or shift from one department to another or take on temporary cross-functional projects.
• 14:57
  SPEAKER_01: Here's where it gets really interesting.
• 14:59
  SPEAKER_01: The blueprint sources explicitly state that mover is where organizations fail the most spectacularly.
• 15:06
  SPEAKER_02: It's the biggest blind spot.
• 15:07
  SPEAKER_01: Why is an internal transfer fundamentally more dangerous than just bringing someone in or kicking them out?
• 15:12
  SPEAKER_02: Because of privilege creep.
• 15:13
  SPEAKER_01: Privilege creep.
• 15:13
  SPEAKER_02: Yes.
• 15:14
  SPEAKER_02: The industry also calls it access accumulation.
• 15:16
  SPEAKER_02: It is a silent systemic rot within enterprise security.
• 15:20
  SPEAKER_02: Let's build a scenario.
• 15:22
  SPEAKER_02: You have an employee who starts in the finance department as a junior analyst.
• 15:25
  SPEAKER_02: The joiner process provisions them perfectly.
• 15:28
  SPEAKER_02: They get access to the general ledger, payroll databases, and financial forecasting tools.
• 15:32
  SPEAKER_01: Everything they need.
• 15:33
  SPEAKER_02: Right.
• 15:34
  SPEAKER_02: They spend three years in finance doing a fantastic job.
• 15:37
  SPEAKER_01: Yeah.
• 15:37
  SPEAKER_02: Then they get promoted and transferred to lead a new product marketing initiative.
• 15:42
  SPEAKER_02: The joiner aspect of that move kicks in nicely.
• 15:45
  SPEAKER_02: The system sees their new title and provisions access to the marketing automation platforms, the social media management tools, and the public relations shared drives.
• 15:53
  SPEAKER_00: So they can do their new job.
• 15:55
  SPEAKER_02: But now nobody remembers to trigger the lever process for their old role.
• 16:00
  SPEAKER_02: Nobody takes away the finance access.
• 16:02
  SPEAKER_01: Because subtracting access requires someone to make a definitive decision that the access is no longer needed, and people are terrified of breaking a workflow.
• 16:11
  SPEAKER_01: It's infinitely easier to just stack new permissions on top.
• 16:14
  SPEAKER_02: Exactly.
• 16:15
  SPEAKER_02: Fast forward another five years, maybe they move to IT or operations.
• 16:19
  SPEAKER_02: They're dragging a massive, invisible tail of accumulated privileges behind them.
• 16:23
  SPEAKER_02: They now possess an entirely toxic combination of access.
• 16:26
  SPEAKER_01: Toxic combination, meaning they have too much power across too many silos.
• 16:30
  SPEAKER_02: Exactly.
• 16:31
  SPEAKER_02: They can view the raw financial data, they have the keys to the public-facing marketing channels, and maybe they have administrative rights to certain IT systems.
• 16:39
  SPEAKER_02: If that one single account is compromised via a phishing attack, the blast radius is exponential.
• 16:46
  SPEAKER_02: The attacker doesn't just get access to a marketing director's inbox, they get the keys to the kingdom.
• 16:52
  SPEAKER_01: Okay, so how do we fix this?
• 16:53
  SPEAKER_01: Because the blueprint demands a very specific operational mitigation for this, utilizing a mover workflow driven by something called delta analysis.
• 17:02
  SPEAKER_01: How does the delta analysis mechanically solve the privilege creep problem?
• 17:06
  SPEAKER_02: Well, it removes human hesitation from the equation.
• 17:09
  SPEAKER_02: When the HR system registers the job change, say moving from cost center A to cost center B, it sends a webhook to the identity governance and administration platform, like SalePoint's identity IQ.
• 17:20
  SPEAKER_01: Okay.
• 17:20
  SPEAKER_02: SalePoint looks at the user's new role and calculates the delta.
• 17:23
  SPEAKER_02: It mathematically compares what permissions the user needs for the new marketing role against the inventory of permissions they currently hold from the finance role.
• 17:30
  SPEAKER_01: Ah, so it identifies the overlap and more importantly, the excess.
• 17:34
  SPEAKER_02: Yes.
• 17:36
  SPEAKER_02: It isolates the excess, but it doesn't always cut the excess off instantly because sometimes transitions take a few weeks.
• 17:44
  SPEAKER_02: You have to hand over projects to your replacement.
• 17:46
  SPEAKER_01: Sure, you don't want to completely cut someone off while they're training their backfill.
• 17:49
  SPEAKER_02: Right.
• 17:49
  SPEAKER_02: So the blueprint suggests implementing a 30-day grace period for the Delta.
• 17:54
  SPEAKER_02: The system automatically flags the old finance access for removal and alludes the new marketing manager and the old finance manager.
• 18:02
  SPEAKER_02: We are automatically revoking this legacy access in 30 days unless you explicitly provide a business justification for why it must be retained.
• 18:11
  SPEAKER_01: Well, that's brilliant.
• 18:12
  SPEAKER_01: That shifts the burden of proof.
• 18:13
  SPEAKER_01: You don't have to ask permission to remove it, you have to fight to keep it.
• 18:16
  SPEAKER_02: And if nobody responds to the alert, the system executes an auto-revocation.
• 18:21
  SPEAKER_02: The access is severed.
• 18:22
  SPEAKER_02: This entirely neutralizes privilege creep, but and this is a big bud, it requires extreme operational maturity.
• 18:30
  SPEAKER_02: The sources emphasize that this delta analysis cannot rely on an email from a manager saying, hey, Bob moved to my team today.
• 18:36
  SPEAKER_02: It must be triggered by an authoritative source.
• 18:39
  SPEAKER_01: Meaning the HR platform, systems like workday or SAP success factors.
• 18:43
  SPEAKER_02: The HR system is the single source of truth for the human being's status.
• 18:48
  SPEAKER_02: When the record changes in workday, it must cascade automatically via API into the IGA platform, which then acts as the central brain, orchestrating the exact provisioning and deprovisioning commands across all the downstream applications: Salesforce, AWS, Active Directory.
• 19:05
  SPEAKER_01: So no more IT tickets for job changes.
• 19:08
  SPEAKER_02: If your organization relies on human communication, a JIRA ticket, or an email to trigger a mover process, your phase seven operationalization has already failed.
• 19:16
  SPEAKER_01: Wow.
• 19:17
  SPEAKER_01: Okay, so speed and accuracy in the JML lifecycle are fantastic for productivity.
• 19:21
  SPEAKER_01: It makes the business agile, but speed is the enemy of security if it isn't continuously validated.
• 19:27
  SPEAKER_01: Exactly.
• 19:27
  SPEAKER_01: Like if we are granting day one access in under four hours, how do we mathematically prove that access isn't being abused six months later?
• 19:34
  SPEAKER_01: We have to transition from operational velocity to security depth.
• 19:38
  SPEAKER_01: And this brings us to the security and governance metrics outlined in the blueprint.
• 19:41
  SPEAKER_01: We need to confront the reality of how human psychology actually undermines security controls.
• 19:46
  SPEAKER_02: We are moving from the logistics of managing accounts to the actual governance of risk.
• 19:51
  SPEAKER_01: Let's dissect the primary security KPIs.
• 19:53
  SPEAKER_01: First is multi-factor authentication.
• 19:56
  SPEAKER_01: Now the dashboard target is greater than 99% adoption across all employees.
• 20:00
  SPEAKER_01: But the blueprint and the specialized Okto white papers are very clear.
• 20:05
  SPEAKER_01: Simply having MFA turned on is no longer sufficient.
• 20:08
  SPEAKER_02: Not anymore, no.
• 20:09
  SPEAKER_01: You cannot just check a compliance box.
• 20:11
  SPEAKER_01: The actual metric you must track in phase seven is the adoption rate of phishing resistant MFA.
• 20:16
  SPEAKER_01: The goal is to hit over 80% initially and aggressively scale to over 95%.
• 20:22
  SPEAKER_01: Why is the blueprint essentially deprecating traditional MFA?
• 20:25
  SPEAKER_01: I feel like we've been told for a decade that any MFA is good in MFA.
• 20:29
  SPEAKER_02: We were told that, but the threat landscape evolved and traditional MFA didn't.
• 20:33
  SPEAKER_02: Not all factors are created equal.
• 20:35
  SPEAKER_02: If your organization relies on SMS text messages for the second factor, or even simple push notifications where a user just taps approve on their smartphone screen, you are highly vulnerable to modern adversary tactics.
• 20:47
  SPEAKER_01: We're talking about MFA fatigue attacks and adversary in the middle attacks, right?
• 20:51
  SPEAKER_02: Precisely.
• 20:51
  SPEAKER_02: Let's look at MFA fatigue, or MFA bombing as some call it.
• 20:56
  SPEAKER_02: An attacker buys valid username and password credentials off the dark web.
• 21:00
  SPEAKER_02: They try to log in at 3.m.
• 21:03
  SPEAKER_02: Okay.
• 21:03
  SPEAKER_02: The system sends a push notification to the sleeping employee's phone.
• 21:07
  SPEAKER_02: The phone buzzes, the employee wakes up, looks at it, and ignores it.
• 21:11
  SPEAKER_02: But the attacker sends another one and another.
• 21:14
  SPEAKER_02: They send 50 push notifications in 10 minutes.
• 21:16
  SPEAKER_01: Just relentlessly buzzing.
• 21:18
  SPEAKER_02: Right.
• 21:18
  SPEAKER_02: Eventually the employee, half asleep and frustrated by the constant buzzing, taps approve just to make it stop so they can go back to sleep.
• 21:26
  SPEAKER_02: The attacker is in.
• 21:27
  SPEAKER_01: That's so simple but so effective.
• 21:29
  SPEAKER_01: And what about adversary in the middle?
• 21:31
  SPEAKER_02: ATM attacks using tools like EvilJinks.
• 21:33
  SPEAKER_02: The attacker sends a highly convincing phishing email with a link to a fake login page that looks exactly like your corporate Microsoft 365 portal.
• 21:42
  SPEAKER_02: The user enters their password.
• 21:43
  SPEAKER_01: And the proxy captures it.
• 21:45
  SPEAKER_02: Yes.
• 21:46
  SPEAKER_02: It forwards the password to the real Microsoft site, which triggers the real SMS code to the user's phone.
• 21:52
  SPEAKER_02: The user types the code into the fake site.
• 21:55
  SPEAKER_02: The proxy captures that too, logs into the real site, and steals the session cookie.
• 22:00
  SPEAKER_02: They bypass your SMS MFA entirely because the user willingly handed over the code.
• 22:05
  SPEAKER_01: Unbelievable.
• 22:06
  SPEAKER_01: So how does phishing resistant MFA actually stop a user from being tricked?
• 22:10
  SPEAKER_02: It removes the human's ability to give away the secret.
• 22:13
  SPEAKER_01: What do you mean?
• 22:14
  SPEAKER_02: Phishing resistant MFA relies on asymmetric cryptography and specific protocols like WebAuthan and FIDO2.
• 22:21
  SPEAKER_02: This usually takes the form of hardware security keys like a YubiKey or platform authenticators like Windows Hello or OctaFastPass, which integrate biometric device context.
• 22:30
  SPEAKER_01: So no codes to type in.
• 22:32
  SPEAKER_02: Right.
• 22:32
  SPEAKER_02: When you use a Phyto II key, the authentication is cryptographically bound to the specific domain you are visiting.
• 22:37
  SPEAKER_02: If a user is tricked into visiting Microsoft-login-secure.com instead of the real Microsoft.com, the hardware key mathematically verifies the domain mismatch and simply refuses to authenticate.
• 22:48
  SPEAKER_02: The user couldn't give the attacker the code even if they wanted to, because there is no code to give.
• 22:53
  SPEAKER_02: Tracking the deployment of use cryptographic factors is the only way to measure true authentication resilience in phase seven.
• 23:00
  SPEAKER_01: That is a massive paradigm shift.
• 23:02
  SPEAKER_01: Next up on the security dashboard is standing privilege access.
• 23:06
  SPEAKER_01: The target here is trending toward absolute zero.
• 23:10
  SPEAKER_01: The blueprint mandates that all administrative access should be just in time or JIT.
• 23:16
  SPEAKER_02: This connects deeply to the cyber arc architecture documentation we are pulling from.
• 23:20
  SPEAKER_02: The historical model of IT administration is built on standing privileges.
• 23:24
  SPEAKER_02: You have an IT engineer and they have an account called domain admin.
• 23:28
  SPEAKER_01: The Godmode account.
• 23:29
  SPEAKER_02: Exactly.
• 23:30
  SPEAKER_02: That account possesses the power to create, delete, or modify anything on the network.
• 23:34
  SPEAKER_02: And it holds that power 24 hours a day, seven days a week, 365 days a year.
• 23:38
  SPEAKER_01: It's an always-on skeleton key.
• 23:40
  SPEAKER_02: And if an attacker compromises that specific account, maybe the admin logged into a compromise server or fell for a spear phishing attack, the attacker instantly inherits that always-on power.
• 23:50
  SPEAKER_02: It's game over.
• 23:51
  SPEAKER_01: So how does just in time access fix that?
• 23:54
  SPEAKER_02: Just in time access?
• 23:55
  SPEAKER_02: Utilizing privileged access management tools like CyberArc or Microsoft intra-privileged identity management fundamentally changes the architecture.
• 24:04
  SPEAKER_02: It means the admin account has zero standing power.
• 24:06
  SPEAKER_02: No.
• 24:07
  SPEAKER_00: Right.
• 24:07
  SPEAKER_00: None at all.
• 24:08
  SPEAKER_02: None.
• 24:08
  SPEAKER_02: When the engineer logs in on Tuesday morning, they have the same baseline privileges as a marketing intern.
• 24:14
  SPEAKER_01: Okay, but they still need to do their jobs.
• 24:17
  SPEAKER_02: Right.
• 24:17
  SPEAKER_02: When they actually need to perform an administrative task, say patching a production database, they must request temporary elevation.
• 24:25
  SPEAKER_02: They log into the PAM vault, select the system they need to access, provide a ticketing system justification, and check out the privilege.
• 24:32
  SPEAKER_02: The PAM system dynamically provisions the necessary administrative rights to their account, or injects a set of managed credentials into their session for a strictly defined time window, say two hours.
• 24:43
  SPEAKER_01: And when the two hours are up.
• 24:45
  SPEAKER_02: The PAM system revokes the rights, rotates the underlying passwords in the vault, and severs the connection.
• 24:50
  SPEAKER_02: The admin returns to being a standard user.
• 24:53
  SPEAKER_01: That's incredible.
• 24:54
  SPEAKER_02: Even if an attacker steals the admin session token after the window closes, it's useless.
• 25:00
  SPEAKER_02: The privilege simply doesn't exist anymore.
• 25:02
  SPEAKER_02: You shrink the attack surface from 22040 Sevic exposure to a tiny, tightly monitored two-hour window.
• 25:09
  SPEAKER_01: This brings us to a metric I really want to dig into because it highlights the friction between governance theory and human reality perfectly.
• 25:15
  SPEAKER_01: The access review completion rate.
• 25:18
  SPEAKER_01: The blueprint target is greater than 95% completion within the defined SLA.
• 25:23
  SPEAKER_02: A controversial metric for sure.
• 25:25
  SPEAKER_01: Look, I've lived through these and I know exactly what happens.
• 25:27
  SPEAKER_01: Access reviews are the enterprise equivalent of clicking agree on the terms and conditions of a new software update.
• 25:33
  SPEAKER_01: Nobody reads them.
• 25:34
  SPEAKER_02: Oh, absolutely not.
• 25:35
  SPEAKER_01: An engineering manager gets an automated email saying it's time for the quarterly access review.
• 25:39
  SPEAKER_01: They log into the portal and are confronted with a spreadsheet containing 500 rows of cryptic IT jargon.
• 25:45
  SPEAKER_01: Things like uh CN AppFind B, B prod RW, OU groups, DC Corp, DC Comm.
• 25:53
  SPEAKER_02: Complete alphabet suit.
• 25:54
  SPEAKER_01: Exactly.
• 25:54
  SPEAKER_01: They have 10 other urgent projects competing for their attention.
• 25:58
  SPEAKER_01: They don't know what that string of text means.
• 26:00
  SPEAKER_01: They know their team is currently working fine, and they don't want to accidentally break anything.
• 26:04
  SPEAKER_01: So they just highlight all 500 rows, click approve, and get back to their real job.
• 26:09
  SPEAKER_02: The classic rubber stamp.
• 26:11
  SPEAKER_01: Yes.
• 26:11
  SPEAKER_01: So how on earth does slapping a KPI target of 95% completion on a dashboard actually fix human nature?
• 26:20
  SPEAKER_01: You aren't measuring security, you're just measuring how fast managers can rubber stamp a form.
• 26:25
  SPEAKER_02: You're entirely right.
• 26:26
  SPEAKER_02: A 95% completion rate of bad, unverified reviews is completely worthless.
• 26:31
  SPEAKER_01: Right.
• 26:32
  SPEAKER_02: It is the definition of compliance theater.
• 26:34
  SPEAKER_02: You look great to the auditors, but your actual risk posture hasn't improved an inch.
• 26:38
  SPEAKER_00: So what's the solution?
• 26:39
  SPEAKER_02: The blueprint heavily anticipates this exact failure mode, which is why the operationalization phase demands two massive structural changes to how reviews are conducted.
• 26:48
  SPEAKER_02: First, you must implement non-response auto-revocation.
• 26:50
  SPEAKER_01: Auto-revocation.
• 26:51
  SPEAKER_02: Yes.
• 26:52
  SPEAKER_02: Historically, if a manager ignored the review campaign, the IT department would just assume the access was still needed to avoid causing disruptions, and they would manually extend it.
• 27:02
  SPEAKER_02: The blueprint flips that.
• 27:11
  SPEAKER_01: Wow.
• 27:12
  SPEAKER_01: That is going to cause immense pain the first time it happens.
• 27:14
  SPEAKER_02: Oh, there will be screaming.
• 27:16
  SPEAKER_02: But pain is an incredibly effective operational motivator.
• 27:19
  SPEAKER_02: The moment an entire team loses access to Salesforce because their director ignored the compliance emails, that director will never ignore an access review again.
• 27:29
  SPEAKER_02: You force engagement through operational consequence.
• 27:32
  SPEAKER_01: That's a tough love approach.
• 27:33
  SPEAKER_01: What's the second structural change?
• 27:35
  SPEAKER_02: You have to fix the data you are presenting to the reviewer.
• 27:38
  SPEAKER_02: You cannot hold a manager accountable for rubber stamping a decision they literally do not understand.
• 27:43
  SPEAKER_02: You pointed out the Active Directory jargon earlier.
• 27:50
  SPEAKER_01: How does the system translate the technical debt into plain English?
• 27:53
  SPEAKER_02: Through aggressive metadata tagging and business context mapping within the IGA platform.
• 27:59
  SPEAKER_02: Instead of presenting that raw CN string to the manager, SailPoint correlates that group back to the application owner, the data classification, and the plain text description.
• 28:09
  SPEAKER_01: So it looks like a real sentence.
• 28:11
  SPEAKER_02: Exactly.
• 28:12
  SPEAKER_02: The manager sees a clean, business readable prompt.
• 28:15
  SPEAKER_02: Does Sarah still require read-write access to the production financial database, which contains highly confidential Tier 1 data?
• 28:22
  SPEAKER_01: That makes it so much easier to evaluate.
• 28:25
  SPEAKER_02: Furthermore, the blueprint requires shifting the burden of review away from just direct line managers.
• 28:31
  SPEAKER_02: Direct managers only know what their employees are doing generally.
• 28:34
  SPEAKER_02: The blueprint mandates holding the application owners accountable.
• 28:38
  SPEAKER_02: The executive who owns the financial database should be certifying who has access to it because they understand the inherent risk of the data much better than a mid-level manager in a different department.
• 28:47
  SPEAKER_01: That contextualization is brilliant.
• 28:49
  SPEAKER_01: It turns an IT chore into an actual business risk decision.
• 28:53
  SPEAKER_01: And speaking of risk decisions, you mentioned exceptions earlier.
• 28:57
  SPEAKER_01: The blueprint has a specific KPI for policy exceptions.
• 29:01
  SPEAKER_01: The target is to maintain exceptions at less than 5% of all total access, with a hard rule that absolutely no exception can be older than 90 days.
• 29:10
  SPEAKER_02: Yeah.
• 29:10
  SPEAKER_02: Exceptions are basically the technical debt of the identity world.
• 29:14
  SPEAKER_02: In a complex enterprise, you will inevitably encounter a legacy application, maybe a 15-year-old inventory system, that simply cannot integrate with modern SSO or MFA.
• 29:24
  SPEAKER_02: It requires a hard-coded shared password.
• 29:27
  SPEAKER_01: And you can't just turn it off.
• 29:28
  SPEAKER_02: Right.
• 29:29
  SPEAKER_02: The business needs the application to survive, so you have to grant an exception to your security policy.
• 29:33
  SPEAKER_01: But if you just document it and walk away, it becomes permanent.
• 29:36
  SPEAKER_02: Exactly.
• 29:36
  SPEAKER_02: An exception that persists indefinitely isn't an exception.
• 29:39
  SPEAKER_02: It's a permanent, ungoverned workaround.
• 29:41
  SPEAKER_02: It's a gaping hole in the submarine.
• 29:43
  SPEAKER_02: The 90-day clock forces accountability.
• 29:45
  SPEAKER_02: You document the shared password risk, but the system alerts the application owner at day 60 and day 80.
• 29:50
  SPEAKER_01: Ticking clock.
• 29:51
  SPEAKER_02: When the clock runs out at day 90, the exception expires.
• 29:55
  SPEAKER_02: The business must either present a funded, actionable plan to modernize or replace that legacy app, or the security team revokes the access and shuts it down.
• 30:04
  SPEAKER_02: The KPI ensures that exceptions are painful.
• 30:07
  SPEAKER_02: Temporary life support, not a lifestyle choice.
• 30:10
  SPEAKER_01: I love that.
• 30:10
  SPEAKER_01: Temporary life support, not a lifestyle choice.
• 30:13
  SPEAKER_01: So if we step back, these metrics, the joiner lever times, the MFA quality, the JIT adoption, the exception aging, they give us a highly detailed point-in-time snapshot.
• 30:23
  SPEAKER_01: We know exactly what the dials say today.
• 30:25
  SPEAKER_01: But a true phase seven operational program isn't a photograph, it is a motion picture.
• 30:30
  SPEAKER_02: It's constantly moving.
• 30:31
  SPEAKER_01: Right.
• 30:32
  SPEAKER_01: How does an organization use these metrics to continuously evolve, especially when the technological landscape is being completely disrupted underneath them?
• 30:40
  SPEAKER_01: We can't just operationalize for the threats of 2024.
• 30:43
  SPEAKER_01: We have to govern the chaos of what's coming.
• 30:45
  SPEAKER_01: This leads us into the final frontier of the blueprint, the continuous improvement cycle and future-proofing.
• 30:50
  SPEAKER_01: We have to talk about zero trust architecture and the absolute tidal wave of agentic AI.
• 30:55
  SPEAKER_02: You cannot submerge a submarine, sail it for five years, and never upgrade the sonar.
• 31:01
  SPEAKER_02: The threat actors are evolving their tactics daily, so your operational model must iterate to survive.
• 31:06
  SPEAKER_00: And the blueprint dictates a very specific, relentless cadence for this evolution, right?
• 31:12
  SPEAKER_02: Yes.
• 31:13
  SPEAKER_02: Monthly, the tactile working groups meet to review the granular KPIs and triage the 90-day exceptions.
• 31:20
  SPEAKER_02: Quarterly, the Executive Steering Committee reviews the aggregated program metrics to assess the macro risk posture.
• 31:27
  SPEAKER_02: Semi-annually, the organization must run a brutally honest reassessment of the program's maturity against a one-to-five capability scale.
• 31:35
  SPEAKER_02: And annually, there's a full strategy and budget refresh to align with new business goals.
• 31:39
  SPEAKER_01: And what is the ultimate North Star they are steering toward?
• 31:42
  SPEAKER_01: The CISA Zero Trust Maturity Model.
• 31:45
  SPEAKER_02: The Cybersecurity and Infrastructure Security Agency maps this transition out beautifully.
• 31:50
  SPEAKER_02: The industry is moving from a traditional state to an optimal state of zero trust.
• 31:54
  SPEAKER_01: Give me a quick breakdown of the traditional state.
• 31:56
  SPEAKER_02: In the traditional state, identity is static.
• 31:58
  SPEAKER_02: You present your username, password, and MFA token at the front door of the VPN.
• 32:03
  SPEAKER_02: The system checks the list, says you are authenticated, and lets you in.
• 32:08
  SPEAKER_02: Once you are inside the network perimeter, you are implicitly trusted.
• 32:13
  SPEAKER_02: You can roam around for the next 12 hours and the system never questions you again.
• 32:17
  SPEAKER_01: It's the Castle and Moat architecture.
• 32:19
  SPEAKER_01: Once you cross the drawbridge, you have the run of the courtyard.
• 32:22
  SPEAKER_02: Exactly.
• 32:22
  SPEAKER_02: And attackers love that.
• 32:23
  SPEAKER_02: If they hijack your session token after you cross the moat, they have free reign.
• 32:28
  SPEAKER_02: But in the optimal state of zero trust, identity is continuously validated.
• 32:33
  SPEAKER_02: It is never static.
• 32:34
  SPEAKER_02: The perimeter isn't a firewall, the perimeter is the identity itself.
• 32:38
  SPEAKER_01: So it's constantly checking you.
• 32:40
  SPEAKER_02: Every single time a user requests a piece of data, not just when they log in, but every time they click a link, open a file, or query a database, the policy engine evaluates a massive array of telemetry.
• 32:51
  SPEAKER_02: It looks at the user's current behavioral risk score, it looks at the health of the device.
• 32:55
  SPEAKER_02: Is the endpoint running the latest patched OS?
• 32:58
  SPEAKER_02: Is the firewall active?
• 32:59
  SPEAKER_01: That's a lot of checks.
• 33:01
  SPEAKER_02: It even evaluates the network context.
• 33:04
  SPEAKER_02: Is this request coming from a known corporate IP or an anonymous VPN exit node in a high-risk country?
• 33:11
  SPEAKER_02: If any of those signals drop below the required threshold, the session is instantly severed, or the user is prompted to step up their authentication with a biometric scan.
• 33:20
  SPEAKER_01: It's exhausting just thinking about the computational power required to validate every single action, but I guess it's the only way to contain a breach locally.
• 33:28
  SPEAKER_02: It's the only way.
• 33:29
  SPEAKER_01: But then, and here's where things get wild.
• 33:31
  SPEAKER_01: We throw a massive wrench into this carefully governed human ecosystem, agentic AI readiness.
• 33:38
  SPEAKER_01: We are pulling heavily from the ping identity framework for securing AI agents here, and honestly, this completely breaks my mental model of IAM.
• 33:45
  SPEAKER_02: It's breaking everyone's model right now.
• 33:47
  SPEAKER_01: We just spent 50 minutes detailing how to govern human employees, the JML life cycles, the HR triggers, the access reviews.
• 33:55
  SPEAKER_01: How on earth do you govern a digital worker?
• 33:59
  SPEAKER_01: Like if I deploy an autonomous AI agent to work on my behalf, an agent that reads my emails, parses incoming vendor invoices, and autonomously negotiates and executes contracts in the CRM, how do these human metrics apply?
• 34:12
  SPEAKER_01: Does an algorithm have a lever process?
• 34:14
  SPEAKER_01: Do you fire an AI?
• 34:16
  SPEAKER_02: That is the exact frontier the industry is violently grappling with right now.
• 34:20
  SPEAKER_02: Organizations are rushing to deploy these autonomous agents to gain a competitive edge, completely bypassing the governance models.
• 34:27
  SPEAKER_02: Ping identity outlines a critical 90-day plan to scale AI security because right now most companies are treating these highly capable AI agents like simple static service accounts.
• 34:37
  SPEAKER_01: What's the danger in treating them like a service account?
• 34:39
  SPEAKER_02: Well, a traditional service account, you say the account a web server uses to talk to a database, does exactly one predictable thing millions of times a day.
• 34:47
  SPEAKER_02: You give it a long-lived credential, lock it down to a single IP address, and it's fine.
• 34:51
  SPEAKER_01: It's deterministic.
• 34:53
  SPEAKER_02: Yes.
• 34:53
  SPEAKER_02: But an agentic AI is non-deterministic.
• 34:56
  SPEAKER_02: It reasons, it makes decisions, it interacts with unpredictable external data.
• 35:01
  SPEAKER_02: If you give an AI agent a static, highly privileged token to access your CRM, and that AI suffers a prompt injection attack from a malicious email it reads, it can be hijacked to autonomously exfiltrate your entire customer database.
• 35:15
  SPEAKER_01: And because it's a non-human identity, there is no HR department to fire it.
• 35:19
  SPEAKER_01: The traditional JML lifecycle doesn't exist.
• 35:21
  SPEAKER_01: There's no workday record for the marketing bot.
• 35:23
  SPEAKER_02: Exactly.
• 35:24
  SPEAKER_01: So how do the phase seven metrics evolve to capture this?
• 35:27
  SPEAKER_02: Ping's framework insists on two major structural shifts.
• 35:30
  SPEAKER_02: First, high-risk agent actions must be gated by human in the loop approvals or HITL.
• 35:35
  SPEAKER_01: Human in the loop.
• 35:36
  SPEAKER_02: Right.
• 35:36
  SPEAKER_02: If your AI agent decides, based on this analysis, to execute a$50,000 add by or bulk delete 500 records in the CRM, it shouldn't possess the autonomy to just execute that API call.
• 35:47
  SPEAKER_02: The AI must be forced to trigger an out-of-band flow.
• 35:50
  SPEAKER_02: Ping refers to this utilizing SIBA client-initiated back channel authentication.
• 35:55
  SPEAKER_01: Okay, unpack the mechanics of a SIBA flow for me.
• 35:58
  SPEAKER_01: What does that actually look like for the human supleiser?
• 36:00
  SPEAKER_02: The AI agent initiates the high-risk action.
• 36:03
  SPEAKER_02: The IAM policy engine intercepts the request and pauses the AI's workflow.
• 36:08
  SPEAKER_02: It then opens a completely separate out-of-band communication channel to the human owner of that agent.
• 36:14
  SPEAKER_02: Your phone buzzes.
• 36:16
  SPEAKER_00: Another push notification.
• 36:17
  SPEAKER_02: But a very specific one.
• 36:18
  SPEAKER_02: You receive a rich context push notification that says Agent MarketingBot Zero O is attempting to execute a$50K ad buy via the Google Ads API.
• 36:29
  SPEAKER_02: Do you authorize this?
• 36:31
  SPEAKER_02: You review the context, authenticate with your face it or fingerprint to prove you are present, and hit approve.
• 36:37
  SPEAKER_02: The policy engine receives the cryptographically signed approval and releases a single use token to the AI to complete that specific transaction.
• 36:44
  SPEAKER_01: Your phase 7 dashboard now has to track an entirely new metric, HITL approval quality.
• 36:48
  SPEAKER_01: Are the human supervisors actually reviewing these AI actions, or are they just rubber stamping the bot prompts exactly like they rubber stamp their quarterly access reviews?
• 36:56
  SPEAKER_02: It's the exact same human behavioral flaw ported over to a hyperspeed technology.
• 37:00
  SPEAKER_02: If humans rubber stamp AI actions, the governance fails.
• 37:04
  SPEAKER_00: Right.
• 37:04
  SPEAKER_00: And what about firing the AI?
• 37:06
  SPEAKER_02: Right.
• 37:06
  SPEAKER_02: To address your question about how you fire an AI, you rely on machine speed automated threat detection.
• 37:12
  SPEAKER_02: You cannot give these agents static passwords.
• 37:14
  SPEAKER_02: You scope incredibly short-lived just-in-time tokens for them.
• 37:18
  SPEAKER_02: If an AI goes rogue, whether it's hallucinating or it's been hijacked via an adversary in the middle attack, you need telemetry to catch it.
• 37:26
  SPEAKER_00: How fast are we talking?
• 37:27
  SPEAKER_02: Milliseconds.
• 37:27
  SPEAKER_02: Okta's behavioral analytics engine, for example, baselines the normal operating behavior of the agent.
• 37:33
  SPEAKER_02: If the AI normally processes five vendor invoices an hour and suddenly attempts to download 50,000 sensitive employee records in two minutes, the analytics engine detects the massive deviation in velocity and volume.
• 37:45
  SPEAKER_01: And it triggers the lever process.
• 37:47
  SPEAKER_02: Instantly, the system executes a global token revocation.
• 37:50
  SPEAKER_02: It doesn't wait for a human to review a ticket.
• 37:52
  SPEAKER_02: The AI is immediately stripped of all access rights across every single connected platform.
• 37:57
  SPEAKER_02: It is a machine speed termination triggered by behavioral anomaly detection, not a human manager.
• 38:02
  SPEAKER_01: That paints an incredible, almost intimidating picture of where this discipline is heading.
• 38:07
  SPEAKER_01: The ultimate phase seven deliverables, the living IAM operating model document detailing the human tiers, the real-time KPI dashboard tracking JML velocity, the continuous improvement plan plotting the course to zero trust, and the annual program report.
• 38:24
  SPEAKER_01: The sources make it undeniably clear.
• 38:30
  SPEAKER_02: No, not at all.
• 38:30
  SPEAKER_01: They are the literal pulse of the organization.
• 38:33
  SPEAKER_01: They are the sonar pinging in the dark water.
• 38:35
  SPEAKER_02: And if you aren't obsessively watching those dials and constantly recalibrating them against new threats, you are sailing blind in incredibly hostile territory.
• 38:44
  SPEAKER_01: Let's bring this all the way back to the surface and recap this massive journey for you.
• 38:48
  SPEAKER_01: Phase seven isn't an administrative afterthought.
• 38:51
  SPEAKER_01: It is the central operating system of the entire enterprise security apparatus.
• 38:55
  SPEAKER_02: The engine of the whole thing.
• 38:56
  SPEAKER_01: We unpack the friction within the four-tier human architecture, realizing that you need the rigid governance of the service desk and operations just as much as the architects to prevent engineers from building shadow IT shortcuts.
• 39:08
  SPEAKER_01: We dissected the critical JML joiner, mover, lever telemetry, discovering that the mover process, with its terrifying potential for privilege creep, is the most dangerous transition of all, requiring automated delta analysis to neutralize.
• 39:23
  SPEAKER_02: It's all connected.
• 39:24
  SPEAKER_01: We tackled the psychological fight against the access review rubber stamp, proving that you need business readable contextual data and the pain of auto-revocation to change how managers behave.
• 39:34
  SPEAKER_01: And finally, we looked at how this entire massive apparatus must scale up to handle the continuous behavioral validation of zero trust and the wild west of autonomous agentic AI.
• 39:44
  SPEAKER_02: It's a lot to monitor, but it's essential.
• 39:46
  SPEAKER_01: So, my call to action for you, the listener, is this when you log back into your corporate network tomorrow, take a hard look at your own organization's reality.
• 39:56
  SPEAKER_01: Do you actually know your joiner and lever times, or are you relying on anecdotal guesswork?
• 40:01
  SPEAKER_01: Are you tracking the true cryptographic quality of your MFA, or are you resting on the false comfort of compliance boxes while your users get spammed with fishable push notifications?
• 40:11
  SPEAKER_02: It really is the stark difference between believing you are secure and mathematically knowing you are secure.
• 40:17
  SPEAKER_02: And as we look toward the immediate future, I want to leave you with this final thought to dissect.
• 40:22
  SPEAKER_02: We discussed how rapidly the perimeter is dissolving into identity.
• 40:25
  SPEAKER_02: Imagine if your company deployed a highly capable autonomous AI agent tomorrow morning, an agent programmed to optimize workflows, capable of independently requesting its own elevated access to your core customer database in order to do its job better.
• 40:39
  SPEAKER_01: A scary thought.
• 41:30
  SPEAKER_02: That's a wrap on season one of the identity blueprint.
• 41:34
  SPEAKER_02: Thank you for joining us on this journey through the full IAM engagement blueprint, from discovery and strategy all the way through to operations and metrics.
• 41:43
  SPEAKER_02: We hope it changed how you see this discipline.
• 41:45
  SPEAKER_02: Season two is coming.
• 41:46
  SPEAKER_02: Stay tuned.
• 41:47
  SPEAKER_02: It's going to be worth the wait.
• 41:49
  SPEAKER_02: Connect with me on LinkedIn at LinkedIn.com forward slash IN slash Ernie Prescott.
• 41:55
  SPEAKER_02: And subscribe now so you're first to know when we're back.
• 41:58
  SPEAKER_02: Until next time.