What happens when a well-intentioned AI agent goes rogue ft. Susanne Senoff
Identity Decoded | The Identity Security PodcastShow Notes
Is “identity is the new perimeter” more of a marketing slogan than a real security strategy? In this episode, Roy Akerman and Rob Ainscough sit down with Susanne Senoff from Conga to discuss how AI agents are starting to behave more like threat actors, and why traditional ideas like “perimeter” and “zero trust” are becoming harder to define. Susanne shares firsthand experience, including an AI agent that wrote reverse proxy scripts and triggered a high-severity cloud alert, showing why security hygiene, understanding critical assets, and monitoring behavior matter more than static privileges or tier-zero boundaries. Together, they explore how IAM needs to evolve from slow administrative processes to real-time, context-aware security, and why CISOs need teams and partners that can keep up with an AI-driven world.
Key Topics 1. Debunking "Identity is the new perimeter" 2.AI Agents as both business enablers and threat actors 3. Evolving IAM: From administrative controls to real-time, behavioral security 4. Shifting identity from static, admin-time governance to behavior-, intent-, and context-aware controls that operate at AI speed
🎧 Episode Highlights [01:53]: The moment when an AI agent behaves like a threat actor
[03:14]: Why “identity is the new perimeter” falls short in an AI-driven world
[07:13]: Why managing AI agents is like parenting a rule-bending 15-year-old
[12:37]: Reinventing controls around agents
[14:57]: Evolving IAM from static governance to real-time, intent-aware controls
🔑 Key Takeaways: Identity security must shift from static perimeters to behavior- and intent-aware controls. The old idea of “identity as the new perimeter” and flat concepts like users vs. non-humans can’t keep up with AI agents that behave like threat actors, move across cloud surfaces, and exploit basic privileges in unexpected ways. Modern IAM has to operate at runtime, continuously understanding assets, context, ownership, and behavior so security teams can make millisecond decisions about what to allow, challenge, or shut down.
AI agents are forcing security teams to rethink risk, resilience, and incident response. As the time from vulnerability discovery to exploitation collapses from months to hours (and soon minutes), defenders can’t rely on ticket-driven processes or slow business validation to decide if something is “okay.” SOCs will increasingly need predefined, business-aware guardrails that justify blocking first and asking questions later on systems that truly matter, supported by AI-driven context, stronger hygiene, and a “minimum viable enterprise” mindset focused on critical processes, data, and apps rather than just tier-zero infrastructure.
IAM is becoming a core part of the CISO’s security stack, not an adjacent function. Susanne shares that CISOs must own identity security architecture, embedding identity security engineers, redefining skills around AI, and partnering with vendors based on vision rather than feature checklists. The next generation of identity teams will be judged not just on joiner/mover/leaver workflows, but on their ability to run real-time, AI-assisted identity defenses that understand intent, adjust access dynamically, and help the business adopt AI safely instead of trying (and failing) to slow it down.
👤 Guest Spotlight:Susanne Senoff Susanne Senoff is the Chief Information Security Officer at Conga, where she leads the company’s cybersecurity strategy and helps drive secure innovation in an AI-driven world. With more than 20 years of experience in cybersecurity and risk management, she has held leadership roles at companies including McAfee, Microsoft, and Morgan Stanley. Susanne is known for her practical, people-first approach to security leadership and for helping organizations adapt to emerging AI and identity threats.
Stay Connected: https://www.silverfort.com https://linkedin.com/in/rob-ainscough https://www.linkedin.com/in/roy-akerman https://www.linkedin.com/in/susanne-elizer-s
More from Identity Decoded | The Identity Security Podcast
Recorded live at Identiverse in Las Vegas, this episode of Identity Decoded brings co-hosts Roy Akerman and Rob Ainscough together with Dr. Rogerio Rondini, Head of Innovation at PwC Netherlands, who has spent 16 years working in identity. Rogerio argues that identity has grown from workforce access into federation, customer identity, non-human identity, and AI agents, yet most organizations still run it with the same siloed operating model: separate teams, separate tools, and separate budgets for workforce, customer identity, and privileged access. Tune in to hear what it takes to bring those pieces together, from why identity verification is no longer just a customer concern in the age of deepfake job candidates to how his team is exploring AI agents to help organizations see what good Zero Trust looks like, plus why bringing identity and cybersecurity closer may be one of the most powerful and important moves a security team can make.
In this episode of Identity Decoded, recorded at Identiverse, hosts Roy Akerman and Rob Ainscough flip the usual format with Simon Moffat, founder of analyst firm The Cyber Hut and a 20-plus year veteran of identity vendors including ForgeRock and Oracle. Simon argues that identity's traditional pillars — IGA, PAM, access management — were built for a linear, on-premises world, and they're now colliding under pressure from AI, non-human identity, and agentic systems. The conversation covers why category definitions provide clarity but should never be considered unshakeable, Simon's vision for a composable "identity operating system" built around horizontal capabilities instead of vertical products, and a practical framework for actually measuring whether identity controls are working.
In this episode of Identity Decoded, recorded live at Identiverse, hosts Roy Akerman and Rob Ainscough sit down with George Roberts, Principal Architect for Identity and Access at McDonald's, to talk about Identity Security at a scale few practitioners ever encounter. George manages 2.2 million workforce identities across 95 markets worldwide. The conversation covers how McDonald's built a single source of truth without 1,500 separate HR integrations, why frontline workers get a printed, paper-based MFA sheet as their "least common denominator" security factor, and George's long-term vision for verifiable credentials and distributed identity. They also dig into why identity teams get looped into new technology initiatives too late, and why George doesn't think AI or continuous identity are overhyped, just under-answered.
In episode two of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough continue their conversation with Aaron Turner — this time tracing a surprising parallel between drug cartels and ransomware groups. Aaron was assigned to the US Department of Justice after 9/11 and spent 18 months working with DEA Special Operations Division under Steve Murphy and Javier Peña — the real-life figures behind Netflix's Narcos. He breaks down why both types of criminal organizations are, at their core, transnational, economically rational actors that rely on stolen or assumed identities to operate. The conversation moves from Pablo Escobar's "plata o plomo" model of corrupting trust, to franchise-style scaling that lets sophisticated attackers hide inside the noise of less-skilled affiliates, to Aaron's later work at Idaho National Lab building some of the first cyber-physical attack simulators — and what that taught him about identity segmentation across IT and OT environments.
In episode one of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough sit down with Aaron Turner, who spent eight years at Microsoft during the founding of Active Directory — starting as a support engineer and later working on Active Directory, SQL Server, Windows Mobile, and Xbox Live. Aaron takes listeners back to the mid-'90s mindset that shaped Active Directory's design: a mission to "kill Novell" and sell more Windows and Office licenses, not to build a security boundary. The conversation traces how that original trade-off — deployment speed over security — led to decades of "identity debt," why LSASS (designed in 1998) has become a favorite target in modern ransomware-as-a-service kill chains, and what the NSA's declassified account of removing Russian actors from the US Treasury reveals about identity segmentation done right (and wrong).