#456 - AI vs Reality with Joseph Carson

Recorded live from the expo hall at InfoSec World 2026, Jeff and Jim welcome back Joseph Carson, host of the Security by Default podcast, for his third appearance on the show. Joseph explains how his thinking has moved from "AI vs AI" to "AI vs reality" after talking with CISOs at roughly 40 events this year, including stories of agents breaking into systems they were never meant to touch and a CFO vibe coding a family scheduler on a corporate laptop. He walks through his three-tier framework for agent risk (task, operational, and legally binding agents), makes the case that agents need identifiers and audit trails rather than human-style treatment, and describes Identity Under Attack, a Dungeons and Dragons style tabletop exercise he ran at NATO CyCon with identity coins, chaos cards, and dice. The conversation also covers why identity resiliency keeps landing last on the shopping list, what Locked Shields teaches about communication and identity strategy, a sobering prediction for 2027, and what identity practitioners can do today with ephemeral, auditable access. The episode closes with a podcaster gear chat and the difference between AI slop and AI enabled work.

Connect with Joe: https://www.linkedin.com/in/josephcarson/

Security by Default podcast: https://www.youtube.com/@SecuritybyDefaultPodcast

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com00:00 Intro from InfoSec World 2026 and Jeff's broken finger

02:33 Welcome back Joseph Carson

03:18 From AI vs AI to AI vs reality

05:02 CISO stories: rogue agents and the vibe-coding CFO

06:46 The rise of consumer agents

07:50 A three-tier framework for agent risk

10:52 Onboarding digital workers with a code of conduct

12:39 Identities or identifiers? Estonia's agent identity debate

15:34 Identity Under Attack: a Dungeons and Dragons style tabletop exercise

22:32 Bringing the exercise to conferences

24:49 What surprised Joseph: collaboration across roles

26:52 Common choices and why MFA comes first

28:16 Designing a budget that forces hard choices

29:29 Identity resiliency as an afterthought

31:24 AI as the Mario Kart mushroom

32:53 Lessons from NATO Locked Shields

35:49 Supply chain and third-party risk

37:18 Predictions for 2027

38:59 What identity practitioners can do now

40:23 Vibe coding and governance at AI speed

42:04 Podcast gear and AI-assisted production

48:02 AI slop vs AI enabled

52:17 About the Security by Default podcast

53:45 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Joseph Carson, Security by Default, InfoSec World 2026, Cyber Risk Alliance, agentic AI, AI agents, non-human identity, agent identity, digital workers, AI governance, vibe coding, tabletop exercise, Identity Under Attack, gamification, NATO CyCon, Locked Shields, MITRE ATT&CK, incident response, identity resiliency, MFA, privileged access, just-in-time access, ephemeral access, least privilege, supply chain risk, third-party risk, AI slop, podcasting