Title: Keys Without People" — John Heasman on Cleaning Up Non-Human Access

Summary: John breaks today's non-human identity mess into three buckets: core tools your business runs on, old/one-off integrations that linger, and engineer tokens left behind. His playbook is simple: decide what's truly critical, assign a clear owner, keep access minimal, and review it on a schedule. With AI spawning even more "non-human users," basics done well—prioritize, tighten, rotate, repeat—win the day.

This segment is sponsored by Saviynt. Visit https://cisostoriespodcast.com/saviynt to learn more about them!

Visit https://cisostoriespodcast.com for all the latest episodes!

Show Notes: https://cisostoriespodcast.com/csp-220

This episode was about agentic IAM—what it is and the risks that come with letting non-human agents act for customers. We defined external IAM, then traced how the industry moved from basic login and MFA to consent, delegation, and now agent-to-agent interactions. Along the way we unpacked key risks for CISOs and practitioners to consider.

Segment Resources:

https://www.loginradius.com/

https://customeriambook.com/

Visit https://cisostoriespodcast.com for all the latest episodes!

Show Notes: https://cisostoriespodcast.com/csp-219

CISO Sandy Dunn breaks down her blueprint for AI-ready defense—pairing MITRE ATT&CK v18 with MITRE ATLAS to move from policy to behavior-based detections. We hit practical AI governance, her early focus on defending and understanding AI, and how OWASP GenAI tools turn checklists into action.

Segment Resources: Article: https://www.linkedin.com/pulse/attck-v18-atlas-blueprint-ai-ready-defense-sandy-dunn-mafoc
AI Cheat Sheet: https://www.linkedin.com/feed/update/urn:li:activity:7388688396166238208/ OWASP LLM Governance Checklist: https://genai.owasp.org/resource/llm-applications-cybersecurity-and-governance-checklist-english/
OWASP Threat Defense COMPASS: https://genai.owasp.org/resource/owasp-genai-security-project-threat-defense-compass-1-0/

Visit https://cisostoriespodcast.com for all the latest episodes!

Show Notes: https://cisostoriespodcast.com/csp-218