ISACA Podcast
--% time saved
Loading episode data...
Original episode
PodcastISACA Podcast
Publisher/creatorISACA Podcast
Published
Shortcast updated
Listen to the original episode
About this episode
As threats have evolved, so too has the approach to modern identity security. A privilege-centric approach must be adopted to address this evolution. Identity management for all accounts within an organization must mature to meet the demands of the cloud, nonhuman identities (NHIs), agentic AI, and modern attack vectors. Your strategy must now manage and mitigate not only traditional privileged access (root and administrator accounts), but also attacks targeting modern identities with paths to privileged access.
These paths to privilege remain one of the most valuable targets for cybercriminals because many organizations continue to defend their environments with fragmented or siloed security strategies and solutions. Security gaps and risks exist across endpoints, cloud environments, SaaS applications, third-party access, and now agentic AI and NHIs, making today's threat landscape more complex than ever.
In this episode, ISACA's Donnie Carpenter, Principal, Information Security and Professional Practices Research Development, speaks with Christopher Hills, Chief Security Strategist at BeyondTrust, about the evolution of identity security and why organizations must rethink how they protect privileged access in today's rapidly changing technology landscape.
Related Resources & Stay ConnectedLearn more about BeyondTrust: Discover how BeyondTrust helps organizations protect identities, manage privileged access, and reduce cyber risk across cloud, endpoint, SaaS, and hybrid environments. BeyondTrust
Additional Resources from BeyondTrust:
- Shadow AI Governance: How to Detect Shadow AI Governance
- Microsoft Vulnerability Report: Microsoft Vulnerability Report
Explore More ISACA Podcast Episodes: Dive deeper into cybersecurity, governance, risk, and emerging technology insights. ISACA Podcast Library
Subscribe to ISACA on YouTube: Stay ahead with expert interviews, industry analysis, and cybersecurity leadership insights. ISACA YouTube Channel
Don't forget to like, comment, and subscribe for more conversations shaping the future of IT, cybersecurity, governance, and risk.
Episode summary
This AI-generated Shortcast summary may omit nuance. Use the original episode when context or exact wording matters.
I’m Donny, joined by Chris Hill from BeyondTrust to discuss modern identity security. As AI and automation accelerate, identity is a front-line defense for digital assets.
First off, Donny—not Don, not Donovan—Donny. I’ve worked in privileged access management since 2011, and the market makes it more confusing than it needs to be. Ask five people what PAM means, especially now that everybody has slapped “AI” on the billboard.
For me, the core issue is privilege, not identity alone. Human, service, and AI identities need permissions; breaches nearly always involve compromised access. It’s the access tied to identity that creates danger.
So beyond credential vaulting and password rotation, what does a privilege-centered approach look like in practice?
Threat actors often sign in with exposed or reused credentials. Give identities only needed access, when needed, with controls on elevation and movement. Start with visibility. Shadow AI can inherit a developer’s high-level access, unseen by security; we’ve found hundreds. Migration tools can leave service principals, OAuth connections, and permissions behind. Use an MCP gateway to control what an agent can reach and do. AI and non-human identities don’t use MFA or SSO, so use certificate lifecycle management, short-lived access, and escalation protection. Human, non-human, and agent layers matter. Don’t get hypnotized by AI: keep foundational controls and post-quantum readiness. Don’t block AI outright; teach users what data is private, and keep agents from exposing personal or intellectual-property data.
That’s a great place to leave it, Chris. AI needs practical guardrails, and post-quantum may be the wake-up call people aren’t watching for. Thanks for joining me; listeners can find resources and episodes through ISACA.
Ready to save time?
Download Shortcast and get started today