Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Identity Security Is Becoming the New Perimeter
Transcript
- Lucas: Luna, I want to talk about something that's quietly become the most important category in enterprise security — and it's not firewalls, it's not endpoint detection, it's identity. Luna: Identity? As in, usernames and passwords? That feels like it's been around forever. Lucas: It has — but the way we think about identity is completely changing. For decades, the network perimeter was the castle wall. If you were inside the network, you were trusted. But after breaches like SolarWinds in 2020, where attackers used compromised credentials to move laterally for months, the industry realized that the perimeter is now the user's identity itself. Luna: Right — if the attacker can impersonate a legitimate user, they don't need to break through any firewall. They just log in. Lucas: Exactly. And the numbers are staggering. Microsoft tracks identity-related attacks — they reported that in 2024, they detected over 600 million identity attacks per month. That's up over 200 percent year-over-year. The vast majority are password spray, phishing, MFA fatigue attacks — where attackers bombard users with push notifications until they accidentally approve. Luna: MFA fatigue — that's become a huge problem. I've seen studies showing that users accept up to 40 percent of those fake prompts after enough repetition. Lucas: Which is why the market is pivoting hard. Identity security — also called Identity and Access Management, or IAM — is projected to grow from about 17 billion dollars in 2025 to over 30 billion by 2029. And the real action is in what's called 'continuous identity verification' — not just checking credentials at login, but monitoring user behavior throughout the session. Luna: So not just 'are you who you say you are?' but 'are you acting like yourself?' Lucas: Precisely. There's a case I dug into — a Fortune 500 insurance company that deployed a platform from a company called SecurID, part of RSA. They combined multi-factor authentication with risk-based scoring that looked at device, location, time of day, typing speed, even mouse movements. If something seemed off, the system would step up authentication or block the session. Luna: What were the results? Lucas: Within twelve months, they reduced credential-based breaches by 72 percent. And their help desk calls related to password resets dropped by about 40 percent — which actually saved them more money than the breach prevention did, in terms of operational efficiency. Luna: That's a nice double win: security and cost savings. But I imagine the bigger players — Okta, Microsoft, Ping Identity — are all fighting for that space. Lucas: They are. Okta's Identity Cloud is probably the most well-known independent platform. They handle authentication for tens of thousands of organizations. But Microsoft is embedding identity deeply into Azure Active Directory — now called Entra ID — and bundling it with Microsoft 365. For companies already in the Microsoft ecosystem, it's a very sticky proposition. Luna: And Ping Identity focuses more on large enterprise and government, right? I know they have a big presence in federal. Lucas: Yes — Ping has strong credentials in zero-trust frameworks for the U.S. government. They also do a lot in CIAM — customer identity and access management — which is a different beast. That's managing logins for millions of external users, not just employees. Luna: So the question becomes: for a typical mid-size company, what should they prioritize? They can't afford all the tools. Lucas: Here's what I hear from CISOs: first, enable multi-factor authentication everywhere — but use phishing-resistant MFA, like FIDO2 security keys or biometrics, not just SMS codes which are easily intercepted. Second, implement conditional access policies — say, 'if you're logging in from a new device or a new country, require step-up auth.' And third, start logging and monitoring identity events. You can't improve what you don't measure. Luna: That sounds like the 'identity-first' approach. But does that mean the old network security is dead? Like, do we still need VPNs? Lucas: VPNs are on the way out for most use cases. They were designed for a world where you had a fixed office and a fixed data center. Now, with cloud apps and remote work, the model has shifted to zero-trust network access — ZTNA. Products like Cloudflare Access or Zscaler don't put you on the network; they just connect you to the specific application you need, after verifying your identity and device health. Luna: So the network itself becomes invisible. You never actually 'enter' the corporate network. Lucas: Right. And that's a huge philosophical shift. The perimeter is now the user's identity, combined with device posture and context. That's why identity security is the new moat. Luna: It does raise a question though — if identity is the new perimeter, what happens when the identity provider itself gets hacked? That puts everything at risk. Lucas: That's the single biggest fear in this space. And it's happened. In 2022, Okta disclosed a breach where an attacker accessed a customer support system and could view some customers' sessions. The stock dropped sharply. So there's a huge emphasis now on securing the identity infrastructure itself — things like hardware security modules, multi-party authorization for critical changes, and rigorous auditing. Luna: It's almost like the identity layer needs its own security layer. Lucas: Exactly. Some people call that 'identity security for identity security.' And that's where you see startups like Descope or WorkOS coming in, offering developer-friendly auth that's built on more modern architectures. Luna: So where does this all go? In five years, do we still talk about 'identity security' as a separate category, or does it just get absorbed into the broader zero-trust platform? Lucas: I think it becomes the centerpiece. The firewall market is shrinking. Endpoint protection is becoming commodity. But identity — because it's so tied to human behavior — is inherently harder to automate away. That makes it the most interesting problem in cybersecurity right now. Luna: And speaking of interesting problems, a quick thought: we're able to dive into these topics because of listeners who support the show. A couple of dollars a month at buy me a coffee dot com slash fexingo — that genuinely makes a difference. Keeps us independently curious. Lucas: Yeah, and no ads, no sponsors pulling strings. It's just us and the research. So if these conversations are useful for what you're building or running, that's the link. Luna: Back to identity — one more thing: do you think small businesses can actually implement this stuff, or is it only for enterprises with big budgets? Lucas: They can start simple. Turn on MFA in Microsoft 365 or Google Workspace — that's free. Use a password manager. Set up basic conditional access policies. That alone blocks about 99 percent of automated attacks. You don't need the 30-billion-dollar platform. You need the fundamentals. And that's where identity security starts. Luna: Good advice. And a good place to leave it for today. Lucas: Next time, we're going to look at how companies are using AI to automate incident response — and whether that's a blessing or a new attack surface. See you then.