#453 - Treating Identity Like a Product with Eve Maler
Source: YouTube · Identity at the Center · published Oct 12, 2026 · 1:03:11
Eve Maler argues that organizations must treat digital identity as a strategic product to secure board-level buy-in, emphasizing that identity is no longer just infrastructure but a core component of business models and customer trust 2:15.
Key Takeaways:
• Identity as a Product: Applying a product management lens—user experience, metrics, and business value—helps overcome silos, since identity's function-specific metrics doom it to fail 9:18.
• Organizational Challenges: Many companies suffer from "identity homelessness," with identity scattered across marketing, fraud, or IT, creating inconsistent governance and security gaps 9:53.
• The AI Threat: AI enables sophisticated phishing and consent fishing attacks, making legacy authentication obsolete and accelerating the need for phishing-resistant solutions like passkeys 30:20.
• UMA for Agents (U4A): Maler's U4A project lets resource owners set precise permissions for third-party AI agents accessing their data, focusing governance on valuable resources rather than tracking every agent 44:22.
• Intent and Trust: Defining agent "intent" resembles privacy's purpose-of-use; contractual frameworks like "My Terms" can set boundaries and permissions agents must follow 33:24.
By rethinking identity as an accountable product and adopting new protocols for AI agents, organizations can better balance security with user experience.
Sources:
- 2:15 Introduction of Eve Maler and her book Mastering Digital Identity.
- 9:18 Treating identity as a product and metrics that fail.
- 9:53 "Identity homelessness" and scattered ownership.
- 30:20 AI-driven phishing and phishing-resistant auth.
- 44:22 UMA for Agents and third-party AI access.
- 33:24 Intent, "My Terms," and contractual boundaries.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] This is Identity at the Center. >> Welcome to the Identity at the Center podcast. I'm Jeff and that's Jim. Hey Jim. >> Hey Jeff. How are you? >> Oh, not so bad. Yourself? >> Doing great man. I'm so excited about today's episode. We have the author of a great book. For those who are not watching this on YouTube, uh it's called Mastering Digital Identity. Um, it's a great book. I mean, really check it out. And if you're not watching us on YouTube, you might want to check out our YouTube channel. You go to idacodcast.tv bring you right there. And feel free to subscribe. Feel free to like a video. That always helps the show. But even if you're listening by by audio, uh I did want to say like I went back through the book uh as I was preparing kind of show notes and some of our questions…