Bojan Simic, co-founder and CEO of HYPR, returns to Identity at the Center for a Sponsor Spotlight conversation with Jim McDonald. Bojan traces HYPR's path from passwordless authentication to a broader set of identity assurance controls and explains how assurance differs from verification across the full employee lifecycle. He describes what organizations find when they look for worker impersonators, from remote employees outsourcing their jobs to North Korean operatives, and why verification has to continue past day one. The conversation then turns to AI agents: why IAM teams are becoming the HR of AI, how agent identity differs from human identity, why humans can't manually govern agents at scale, and why securing MCP alone misses the full context of an agent's session. Bojan also covers what is slowing passwordless adoption, adaptive risk, alert fatigue, and how identity teams and the SOC can work together. This episode was made possible with support from HYPR.
Connect with Bojan: https://www.linkedin.com/in/bojansimic
Learn more about HYPR: https://www.hypr.com/idac
Connect with us on LinkedIn:
Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/
Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/
Visit the show on the web at idacpodcast.com
00:10 Sponsor Spotlight intro and welcome back Bojan Simic
02:36 HYPR's evolution from passwordless to identity assurance
04:44 How the pace of identity projects has changed
06:01 Agentic AI moves from theory to reality
08:19 Identity assurance vs. identity verification
10:02 Why workforce identity verification is on the rise
13:01 AI-powered social engineering crosses language barriers
14:30 Continuous verification beyond onboarding
17:06 Balancing verification with user experience
18:36 The business problem behind AI agent governance
22:42 How agent identity differs from human identity
24:50 Who owns agent identity? IAM as the HR of AI
27:00 Governing agents at scale and keeping humans in the loop
29:23 Why endpoint control matters for AI agents
31:48 What securing MCP alone can miss
33:20 Deterministic and probabilistic controls
35:00 What is holding passwordless back
37:26 Pilots and letting perfect be the enemy of good
39:25 Advice for leaders on adaptive risk
42:02 Signals that matter and avoiding alert fatigue
43:36 Identity teams and the SOC
45:53 Lighter note: early mornings in New York, family, and the Yankees
50:36 Wrap-up
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Bojan Simic, HYPR, Sponsor Spotlight, identity assurance, identity verification, workforce identity verification, continuous verification, worker impersonation, North Korean IT workers, deepfakes, social engineering, help desk security, AI agents, agentic AI, agent identity, AI agent governance, non-human identity, NHI, MCP, Model Context Protocol, endpoint security, blast radius, least privilege, access reviews, passwordless, MFA, FIDO, adaptive risk, adaptive authentication, alert fatigue, SOC, identity threat detection, IAM
1:03:10