Jeff and Jim are joined by Rob Ainscough, Chief Identity Security Advisor at Silverfort and host of the Identity Decoded podcast, to look at what happens when an autonomous AI attacker goes after identity. Rob shares how a decade running a 400,000-person IAM program at a UK retailer, and one identity-driven incident, moved him from compliance-led to threat-led identity. He walks through the AI Attack Lab, where an AI red agent called Cypher went from a network foothold to domain dominance in under four minutes by chaining familiar identity weaknesses in parallel. The conversation covers why governance alone can't stop machine-speed attacks, identity as a drawbridge that rises with the threat level, why agents favor non-human identities, and giving every account a protection plan. Plus podcasting lessons, community building, and the return of the Identity Mullet.
This episode is made possible with support from Silverfort. Learn more at silverfort.com/idac
Connect with Rob: https://www.linkedin.com/in/rob-ainscough/
Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/
Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/
Visit the show on the web at idacpodcast.com
00:00 Intro, and an apology to Mark
01:33 Meet Rob Ainscough
01:53 Falling into identity at a UK retailer
03:43 The incident that changed everything
05:48 Orphaned account war stories
07:59 Account correlation in the age of agents
09:23 The Identity Decoded podcast
11:11 What Silverfort has been focused on
13:21 Black October: hype vs. reality
15:51 Familiar techniques, new speed and scale
18:52 What is the AI Attack Lab?
23:23 Watching Cypher compromise a domain
27:58 What identity programs left behind
29:25 Building the attacker and keeping it contained
32:16 Controls that stay transparent to the model
34:08 What surprised Rob most
35:27 Goal-oriented to a fault
37:23 Was the lab environment rigged?
39:16 How security teams react
43:16 Why good governance isn't enough
47:19 Where to start: every account has a plan
49:31 Why AI attackers target NHIs
51:19 Lessons from a first season of podcasting
56:38 Nerves before hitting record
58:27 The Identity Mullet
01:02:38 Wrap-up
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Rob Ainscough, Silverfort, Sponsor Spotlight, Identity Decoded, AI Attack Lab, Cypher, AI agents, agentic AI, autonomous attacker, Black October, threat-led identity, identity threat detection and response, ITDR, Active Directory, Kerberoasting, AS-REP roasting, golden ticket, lateral movement, credential harvesting, domain compromise, non-human identities, NHI, service accounts, PAM, IGA, identity debt, runtime enforcement, identity security, CISO, red team, Mythos
50:51