Start here
What identity is, and why it deserves the seat
Every person, service account, workload, and AI agent in your organization acts on the strength of an identity. That makes identity a security discipline, not a back-office function.
Five minutes, written for the security leader who has to make the case and for the executive who has to hear it.
This page extends the Introduction and Chapters 1, 3, and 21 of The Modern Identity Operating Model.
Where I learned it
Nobody broke through a firewall
I worked in security at a large retailer during one of the most studied vendor-credential breaches in retail history. Attackers reportedly phished an HVAC vendor’s employees, stole their login for the company’s vendor portal, and found that the network behind it was not segmented from everything else. From there they moved laterally to the point-of-sale systems. Forty million card numbers, seventy million customer records, over two hundred million dollars in eventual cost.
Nobody broke through a firewall. They walked in on a third-party identity nobody was watching closely enough.
That pattern has not gone away. In Verizon’s 2025 Data Breach Investigations Report, credential abuse was the most common way attackers got in, at 22 percent of breaches, and the share of breaches involving a third party doubled, to 30 percent. Attackers increasingly log in rather than break in. What they log in with is an identity.
The definition
What identity actually is
Identity is the representation of a person, system, or agent that lets an organization decide who or what is allowed to act.
It is easy to mistake identity for the things that carry it: the directory account, the badge, the password, the tool that provisions access. Those are artifacts. Identity is what ties them together into something the organization can understand, decide about, and govern. Every access decision after that, what something may do, what stage it is in, who approves it, depends on getting that first answer right.
And it is no longer only people. Service accounts, workloads, API clients, bots, and now AI agents all hold credentials and act on the organization’s behalf. Many were created for one project and never looked at again. A migration account that outlives the migration is still an identity, still able to act, and often answerable to no one.
Why it is a security discipline
Every control you trust assumes identity is right
Look at the controls a security program leans on: least privilege, separation of duties, strong authentication, privileged access management, Zero Trust. Each one starts from the same assumption, that the organization already knows who or what is acting and what it should be allowed to do.
When that assumption is wrong, the controls do not fail loudly. They enforce the wrong thing, confidently. Multifactor authentication protects an account that should have been removed months ago. A review approves access nobody can explain because the reviewer was given nothing to judge it by. A firewall rule trusts a vendor connection that still works because no one owned ending it.
That is why identity belongs inside security, not beside it. It is the layer that makes the rest of the program mean what it says.
Why it gets overlooked
When identity works, nobody sees it
A new hire can work on day one. Access ends on the last day. The audit closes without a finding. None of that makes a headline, so identity is usually funded like plumbing and treated as urgent only after something breaks: a contractor still active months after leaving, a certificate that expired and took a system down with it, a role nobody can explain to an auditor.
The work that prevents those moments is unglamorous and constant. It is also exactly the work that decides whether the next incident is a contained event or a breach.
Why now
AI does not change the rule. It speeds it up.
AI does not fix identity. AI exposes identity.
An AI agent acts with delegated authority, at machine speed, and sometimes creates access of its own. Every weakness that used to take years to surface, unclear ownership, standing privilege, accounts that never end, now surfaces in days. Organizations that already know who and what can act will adopt AI with confidence. The ones that do not will find out what they are missing from the agent.
The seat
What deserving the seat looks like
A seat at the table is not a title. It is being in the room before the decision instead of after the incident. In practice that means:
- Identity is part of the architecture conversation for every new platform, cloud account, acquisition, and AI initiative, not a ticket raised after go-live.
- Identity is in incident response from the first call, not paged in later. The first questions in almost every serious incident are identity questions: who or what acted, on whose authority, which credentials and sessions to revoke, which agents to stop, and how far the privilege chain reaches. The identity work is what makes response possible.
- Identity owns the standards for who and what may act, and the business owns the decisions inside them, with the lines between the two written down.
- Identity reports measures leaders can act on, such as how quickly access really ends and how much privilege is standing rather than granted when needed, alongside the rest of security.
- Identity is funded as a capability the organization runs every day, not as a project that finishes.
None of that requires a bigger tool. It requires treating identity as the discipline it already is.
Go further
Where to go from here
The Modern Identity Operating Model makes the full case and then shows how to build it: five pillars that hold identity steady across people, systems, and AI, and the practical steps to start where you actually are.
- Coming soon: get notified
- Take the predictability assessment, a quick and honest read of where your environment stands.
- Explore the free toolkit, templates, and guides.
Source for the breach figures: Verizon, 2025 Data Breach Investigations Report. The retailer story is from Chapter 3 of the book.
Updates
New templates and guides, when they are ready
A short email when something new is published, a template is updated, or the book is out. No more than once a month.
Kit, the email service I use, stores only your email address. You will get one email to confirm, and every email has an unsubscribe link.
Go deeper in the book
The Introduction and Chapters 1, 3, and 21 make the full argument for identity's seat, with the stories behind it.
Coming soon: get notified