#446 - Rethinking Identity for AI Agents with Rick Scot
Source: YouTube · Identity at the Center · published Sep 7, 2026 · 1:10:05
BLUF: Rick Scott, CIO and CISO at Elevate Textiles, discusses the critical shift in identity governance required to manage AI agents, emphasizing the need for clear ownership, visibility into shadow AI, and balancing innovation with security controls 17:53.
Key Takeaways:
• Rick’s career pivot to security was triggered by a major insider threat breach and a desire to move from data leadership into a dedicated security role, highlighting the importance of community and mentorship in Charlotte’s cyber scene 08:00.
• Balancing the CIO and CISO roles requires shifting from a "security is no" mindset to one that empowers business success while managing risk, focusing on resilience, availability, and trust 13:31.
• AI agents represent a new class of identity that is neither strictly human nor non-human, requiring new approaches to entitlements, lifecycle management, and accountability, particularly regarding who owns the agent and what happens if they leave 18:30.
• Shadow AI and unauthorized agent creation pose significant risks; Rick advocates for formal project charters, technical specifications, and understanding token costs to prevent uncontrolled spending and security gaps 20:10.
• Effective governance involves training users on AI risks and costs, similar to traditional security awareness, while selecting technology solutions that offer reliability and transparency rather than just flashy features 48:20.
Closing Statement:
As AI agents become more prevalent, identity professionals must evolve their frameworks to include these new actors, ensuring clear ownership and visibility to mitigate risks associated with shadow AI and unmanaged automation.
Sources:
- 08:00 Rick Scott discusses his transition into cybersecurity and the importance of community.
- 13:31 The challenge of balancing productivity and security as a dual CIO/CISO.
- 18:30 Defining the identity of AI agents and the need for new governance models.
- 20:10 Strategies for managing shadow AI and controlling token costs.
- 48:20 The importance of user training and understanding AI risks.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This is Identity at the Center. [music] >> Welcome to the Identity at the Center podcast. I'm Jeff and that's Jim. Hey Jim. >> Hey Jeff. How are you? >> Oh, not so bad. Yourself? >> Doing great, man. Um, I, you know, I wanted to start off this episode just by thanking all of our listeners. Our number of downloads and streams has been off the charts lately. I checked. We're in the top 3% of podcasts in the world. Not just identity, not just cyber, just any kind of podcast. And that's all because of our listeners who, you know, are consistently listening to us. And one thing I'd like to say is that some of our most popular podcast episodes are ones like we have today where we have real world practitioners, people who are doing real identity stuff in the field. um which I would imagine most o…