Recorded live from the expo hall at InfoSec World 2026, Jeff and Jim welcome back Joseph Carson, host of the Security by Default podcast, for his third appearance on the show. Joseph explains how his thinking has moved from "AI vs AI" to "AI vs reality" after talking with CISOs at roughly 40 events this year, including stories of agents breaking into systems they were never meant to touch and a CFO vibe coding a family scheduler on a corporate laptop. He walks through his three-tier framework for agent risk (task, operational, and legally binding agents), makes the case that agents need identifiers and audit trails rather than human-style treatment, and describes Identity Under Attack, a Dungeons and Dragons style tabletop exercise he ran at NATO CyCon with identity coins, chaos cards, and dice. The conversation also covers why identity resiliency keeps landing last on the shopping list, what Locked Shields teaches about communication and identity strategy, a sobering prediction for 2027, and what identity practitioners can do today with ephemeral, auditable access. The episode closes with a podcaster gear chat and the difference between AI slop and AI enabled work.
Connect with Joe: https://www.linkedin.com/in/josephcarson/
Security by Default podcast: https://www.youtube.com/@SecuritybyDefaultPodcast
Connect with us on LinkedIn:
Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/
Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/
Visit the show on the web at http://idacpodcast.com00:00 Intro from InfoSec World 2026 and Jeff's broken finger
02:33 Welcome back Joseph Carson
03:18 From AI vs AI to AI vs reality
05:02 CISO stories: rogue agents and the vibe-coding CFO
06:46 The rise of consumer agents
07:50 A three-tier framework for agent risk
10:52 Onboarding digital workers with a code of conduct
12:39 Identities or identifiers? Estonia's agent identity debate
15:34 Identity Under Attack: a Dungeons and Dragons style tabletop exercise
22:32 Bringing the exercise to conferences
24:49 What surprised Joseph: collaboration across roles
26:52 Common choices and why MFA comes first
28:16 Designing a budget that forces hard choices
29:29 Identity resiliency as an afterthought
31:24 AI as the Mario Kart mushroom
32:53 Lessons from NATO Locked Shields
35:49 Supply chain and third-party risk
37:18 Predictions for 2027
38:59 What identity practitioners can do now
40:23 Vibe coding and governance at AI speed
42:04 Podcast gear and AI-assisted production
48:02 AI slop vs AI enabled
52:17 About the Security by Default podcast
53:45 Wrap-up
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Joseph Carson, Security by Default, InfoSec World 2026, Cyber Risk Alliance, agentic AI, AI agents, non-human identity, agent identity, digital workers, AI governance, vibe coding, tabletop exercise, Identity Under Attack, gamification, NATO CyCon, Locked Shields, MITRE ATT&CK, incident response, identity resiliency, MFA, privileged access, just-in-time access, ephemeral access, least privilege, supply chain risk, third-party risk, AI slop, podcasting
1:07:56