#446 - Rethinking Identity for AI Agents with Rick Scot
Source: YouTube · Identity at the Center · published Sep 7, 2026 · 1:10:07
BLUF: Rick Scott, CIO/CISO at Elevate Textiles, argues that identity management must evolve to include AI agents as distinct entities requiring rigorous governance, ownership, and lifecycle management to balance innovation with security risks 17:55 27:56.
Key Takeaways:
• Identity Expansion: Identity programs must move beyond just human and non-human (service) accounts to explicitly manage AI agents, which Scott views as a unique third category requiring its own protections 18:50.
• Governance & Ownership: Effective AI governance requires clear ownership; assigning accountability to the human who built the agent ensures they monitor its behavior and costs, preventing "rogue" agents from operating unchecked 27:56 59:02.
• Shadow AI Risks: Organizations face significant risks from shadow AI, where employees build unauthorized agents or use unvetted models, potentially exposing intellectual property or incurring massive token costs 36:35 44:14.
• Balancing CIO/CISO Roles: Holding both CIO and CISO roles forces a balance between enabling business productivity and enforcing security controls, shifting security from a "no" function to an enabler of safe innovation 13:31 40:43.
• Future Outlook: While AI offers immense automation potential, Scott warns that in 3-5 years, many organizations will be managing abandoned or poorly monitored agents, highlighting the need for proactive identity hygiene 59:02.
Closing Statement:
As AI agents become integral to operations, identity practitioners must redefine their frameworks to encompass these new digital workers, ensuring that accountability and visibility keep pace with technological advancement.
Sources:
- 17:55 Discussion on rethinking identity to include AI agents as a distinct category.
- 27:56 Importance of assigning specific ownership to AI agents for accountability.
- 36:35 Challenges and risks associated with shadow AI and unauthorized tool usage.
- 44:14 The impact of token costs and the need for financial governance in AI adoption.
- 59:02 Future concerns regarding abandoned or unmonitored AI agents in 3-5 years.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] This is Identity at the Center. >> Welcome to the Identity at the Center podcast. I'm Jeff and that's Jim. Hey Jim. >> Hey Jeff. How are you? >> Oh, not so bad. Yourself? >> Doing great, man. Um, I, you know, I wanted to start off this episode just by thanking all of our listeners. Our number of downloads and streams has been off the charts lately. I checked. We're in the top 3% of podcasts in the world. Not just identity, not just cyber, just any kind of podcast. And that's all because of our listeners who, you know, are consistently listening to us. And one thing I'd like to say is that some of our most popular podcast episodes are ones like we have today where we have real world practitioners, people who are doing real identity stuff in the field. um which I would imagine most o…