Examining that thesis I’d argue that AI is hitting growth limits, which isn’t a revelation given the RAM, SDD, HDD, and GPU shortages (among other component shortages). However the thing that should be examined is once the companies start to shift from rapid adoption to maturity is what are the downstream impacts as processes/companies become more standardized and matured? In today’s environment consolidation is where things usually move to when companies begin to mature after rapid adoption, which is something that we’ve definitely seen in the AI space as of late. What I’m further curious about though is the second order impacts, because I think those are just beginning to be understood and wrestled with.

We’re starting to see consolidation in the IAM space as it relates to IAM in that management and tool based companies are being acquired such as Crowdstrike acquiring SGNL. As there is already tool, data, and asset sprawl, so too shall there be AI and agent sprawl. Dealing with the agent sprawl challenge will require a substantial amount of time, effort, and energy.

As it relates to IAM, budgets are already stretched thin for companies in a number of sectors as David Llorens points out on the latest Identity at the Center podcast. A lot of companies have aspirations of what they want to achieve with IAM (having good telemetry, regularly rotated keys, etc…). Llorens points out that there’s got to be a baseline (MFA), and then configuration and process maturity can come from there (e.g. tracking impossible travel, conditional access, risk signals, etc…).

IAM is definitely riding the AI wave at this point and is growing as a result. Some of the growth is good, others will take more time to figure out, but at the very least IAM will continue to be a core part of cybersecurity and the way things operate.

Why

This writeup covers how I went through and set up a Salesforce integration using a developer Okta and Salesforce account.

One of the things that I’ve wanted to delve into more with IAM is actually setting up useful IAM integrations across apps, users, and functionality. Reading through various reddit accounts, posts, and comments, I realized that I could set up an Okta developer account and try out various features and integrations (such as Salesforce). Although I’ve touched on why I wanted to carry out this project I think it also showcases a number of things that blue teams touch on when setting things up from configurations, to documentation, and working through various requirements (either from the business, GRC, or the client).

Some Background

In order to get this set up I spent about $10 for an organizational email (AKA: an email that’s not outlook, gmail, yahoo, etc…) and created a Salesforce and Okta dev account for both of them. It’s also helpful here to delve into SAML vs OIDC vs OAUTH 2.0. The short version is that Security Assertion Markup Language (SAML) is a standard for exchanging AuthN and AuthZ information between and IDp and a service provider that is XML based to enable SSO read the SAML standard here.

OAUTH 2.0 is a more modern standard RFC 6749 that’s better able to interact with modern web frameworks, APIs, etc… being more lightweight and with more granular control. The shortcoming of OAUTH 2.0 is that it’s an AuthZ standard and OpenID Connect standard is built on top of OAUTH2.0 to allow for easy identification.

Why Work With an Older Standard?

SAML is still widely used in a number of integrations and being able to understand the SAML integration and AuthN/AuthZ workflow more helps understand pitfalls and potential trouble spots as well as still being useful for IAM overall.

Setup

Having gone through and set up Okta and Salesforce dev accounts, the first general thing we need is users that we’re going to have access the systems/applications in question. Luckily Okta makes this pretty easy in being able to add people or groups and specify various characteristics including name, email, username, activation, etc…

From the central Okta dashboard we can also start setting account management policies and rules and getting into the details if we want. While going through the details is useful to know where things can get messy and complicated, for this writeup we’ll continue on with getting Salesforce set up and connected.

With Okta, the integration is fairly straightforward with app integrations and SSO options and luckily Salesforce makes it easy on their side as well with identity and SSO settings.

Troubleshooting

One of the issues that I ran into was that despite the fact that I had everything set up correctly on the Okta side, I did have to re-check my settings on the Salesforce side as when I tried to login to one of the users I set up previously I ran into an SSO error.

The way I went about troubleshooting was my usual methodology of “Read, Search, Ask” which can be further refined into “Narrow down the problem, Identify a potential solution, Try something (and hope it works), Repeat as needed”.

The initial Salesforce error message wasn’t very useful so I opted to dive into the logs, and I noticed that the login was hitting the Okta side of things but not the Salesforce side, so I dug a bit further into the Salesforce side and noticed that I had copied/pasted an incorrect link leading to the SSO error.

After fixing the issue the example user was able to login and I could verify it from both the Okta and Salseforce logs.

Lessons

1. Have good documentation. It makes everything infinitely easier and helps not only you, but anyone who may come after you.

2. It’s easy to get lost in configuration details. While there is no cutting, the addage of “check config twice, implement once” fits nicely here as I likely would have avoided my issue had I double checked the configs.

3. Analyze an issue from all sides.

Conclusion and Future Expansions

Overall this was a fun project and a fun dive into implementing practical IAM/SAML. I know that I want to build on this with future integrations and concepts such as JML, SCIM, and connecting it to AD if I can.

• Finish Critical Analysis Project
• Take SC900
• Educational Outreach

On Deck for Next Week:

• Continue DC Outreach
• DC916 Project

I think most people think of IAM/identity as an afterthought when it is a central to not just IT, but everyday life. Be it authenticating and authorizing to our phones, our computers, web apps, identity is integrated into every facet of modern life. As such it’s concerning to see so many treat identity and the components of identity representation (email, phone number, PII/PHI, etc…) as things that can be thrown away. Identity as infrastructure isn’t just referring to the IT world, but the ways in which we interact with each other, because without identity it is difficult if not impossible to constitute everyday life.

It’s because IAM helps answer the representation of some of these fundamental questions and daily interactions that I love identity and access management so much.

From the financial side of things I think it’s becoming increasingly clear that the head start lead from OpenAI is starting to erode as noted by Microsoft losing confidence in them by pursuing other options for AI models, along with Nvidia backing off some of its funding agreements. This in conjunction with the opportunity costs of layoffs, ostensibly due to AI, means that orgs are prioritizing what they see as potential short term promises of gains, when they’ve gutted large swaths of their workforce for nothing. Incessant cutting is not a strategy for growth, it’s a strategy for financialization and looking good to investors. The name of the game at this point is sustainability, and most orgs don’t seem to have a path to profitability or solid revenue.

On the physical side of things, power, HVAC, cooling, and, memory, even public sentiment are going to be major headwinds. So many of the AI providers are looking to get power connections, contracts, and power availability that NoVA (which has the most data centers per capita) is turning against data centers with politicians, neighborhoods, and environmental groups all aligned against new data centers going up. Even in places outside of NoVA residents and politicians are skeptical of data centers as the tax breaks lead to a temporary increase in construction jobs, and then relatively few permanent data center jobs. Having to get so many skilled contractors in HVAC and cooling not to mention fresh water resources to carry away all of the heat is proving to be yet another bottleneck. All of this doesn’t include that DRAM, HDD, and graphics chips contracts extend out for months to where capacity is already obligated for years in some cases increasing prices of a number of goods, further turning public sentiment against AI.

Bottom line: There will be a “Minsky moment”(1), at which point cash will drain from the AI market leaving us to see who is sustainable (Warren Buffet put this in far more colorful terms), but overall there will be something useful to come out of this be it code or offboarding some level of knowledge work. The question is, how much longer can this rampant speculation keep up? My uneducated guess and timeline puts it at 18 to 36 months from early 2026, based on nothing but speculation, much like the AI market.

1. A Minsky moment is a sudden, major collapse of asset values marking the end of an extended period of bullish speculation, excessive risk-taking, and high leverage. Coined from economist Hyman Minsky’s theory, it describes how long periods of economic stability encourage unsustainable debt (Ponzi borrowing), leading to a inevitable market crash.

The other part that was interesting was noting that there are workforce constraints in that there aren’t enough IAM practitioners. I personally believe that’s because there’s no good pipeline into IAM as IAM is a somewhat niche and obfuscated subfield of cloud/SaaS. With the growth of AI, so too will IAM grow. Also the conversation around Identity/Security Posture Management was also interesting as it’s an additional framework that can help enhance current IAM capabilities by allowing for additional IAM governance of entities as previously discussed.

I also read Guidepoint “Security’s The State of Identity and Access Management (IAM) Maturity”, and had some thought on it (notes found below). My key takeaways are namely that I’m surprised at how manual everything still is within IAM (though how ‘manual’ something is, is up for debate/discussion) along with how few PAM implementations there are (and how many PAMs are tied to a single primary account). The report shows that most orgs are in early to mid maturity for implementing IAM, and that the VAST majority of orgs are investing in AI, but I don’t think they’re ready, either from a framework, technology, or telemetry perspective, on how to handle AI. It’s also curious how many orgs are apparently using biometrics, but I suspect that’s because those orgs are government, government adjacent, or have regulatory requirements.

Bottom line is that AI investment will change things, especially in IAM, and how we work to authN and authZ non-human identities is likely going to need to change with the times, because it feels like IAM is being reactive in this case rather than proactive as I haven’t seen many solutions out there dealing with AI IAM (not to say they don’t exist, but I haven’t seen the full spectrum of potential solutions).

### The State of Identity and Access Management (IAM) Maturity

- The defenition of "high performers" feels incredibly generic and incredibly variable because I am skeptical of self-reporting efficacy

High performers in this research are those organizations that self-report their IAM technologies and investments are highly effective (23 percent)

- The fact that less than half of orgs use Identity verification solutions is concerning as there have been a number of impersonation attacks both AI based and based on "fake IT" professionals.
- Less than half of orgs relying on automated solutions to check for compromised passwords would seem to indicate a substantial number of orgs who are still on prem
- Another difference I'm curious about is the distinction between "IT Security" and IAM in this instance, but the slightly less than half (45%) of orgs saying that there's an issue of lack of resources shows the continued trend of security as a cost center/after thought
- There's a continued rise in machine/non-human accounts, and large swaths of them appear to be on a case-by-case or manual basis (~72% have policies set up for non-human accounts)
- The vast majority are performing access reviews via IAM platforms, most are using spreadsheets or custom workflows which is surprising, which also leads into the fact that most JML is manual
- PAM is still lacking as about half find IAM/PAM platforms effective for their needs
- I think this also brings up the question of what constitutes "manual" within the tech/IAM space.  Is a ticket that fires off a request and is presented to an IAM analyst to approve/disapprove it "manual".  How much automation is needed to count towards automation?
- Phishing is still a big issue impacting approximately a quareter of respondents, but leaked creds compromise a third of the issue as well
  - Does simply having usernames leaked qualify, because does a username + password constitute a full credential or is just the username enough?

- One of the impacts that the report lists is "decline in reputation" and "decline in trustworthiness" which are separate and distinct, however I'm curious as to how those would be quantified and or drilled down on in a deeper analysis.
- I'm just honestly more surprised that costs of consultants/attourneys, and regulatory fines aren't higher on the impacts list, but loss of workforce productivity impacting about 40% of folks is pretty dang impactful.
- Over half of orgs say that they lak the technologies, and in-house expertise to implement identity based solutions which speaks to a large opportunity for IAM expertise.  But I also think it's closely tied with just UNDER half saying that it's lack of resources keeping them from implementing solutions and a full third saying executive support/not a priority is an opportunity space as well.
- IAM = User experience, I think this is key because of how frustrating standard passwords can be, but I'm also suprprised by how much org change drives IAM security investment, as the previous point of not having in house experience would seem to be driven by constant organizational changes and instability.  Improved user experience though can drive down costs not just in terms of monetary value, but time cost, opportunity cost, ease of integration etc...
- Lifecycle management is still a big issue from BOTH a JML persepctive and an AuthN and an AuthZ perspective
- How much will AI and agent based AI systems drive IAM to manage non-human accounts?  What's the telemetry like for AI based systems using IAM and getting access?
- More and more what I'm getting from this report is that there are still a lot of pain and friction points in IAM and user access in terms of telemetry, logs/access reviews, and features/usability.  Because access reviews still being done manually is surprising utilizing spreadsheets etc...
- So apparently there are refreshes in moving to the cloud/SaaS, but how effective and impactful will that be?  What are the underlying problems that will still exist, there's a shiny new SaaS/IAM toy, but does it fix the problems needed?
- The thing that also keeps repeatedly popping up is how many orgs rely on manual processes.
- PAM apparently still isn't much of a thing in the IAM space as almost half of orgs have priv access assigned permanently.
- Ok, so it seems like the IAM space is pretty fragmented AND that processes aren't really in place for orgs, ESPECIALLY in light of only ~20% of orgs having fully implemented passwordless authN.
- Since a barrier to implementing passwordless AuthN, how can it be framed as a cost savings, especially in light of the previous findings that security incidents cost money in terms of legal expenses, loss of reputation, etc...?
- Also I'm curious as to what security risks orgs are finding with Passwordless auth?  Complexity being a barrier makes sense with lack of in-house expertise.
- At least most orgs have MFA (in some capacity)
- The fact that half of orgs are using biometrics in some capacity is surprising given the other findings, because I'm wondering what the cost for implementation and management of that in and of itself is along with how they got buy in from management.  Also, some of these make me think a good portion of the orgs surveyed were government or government adjacent.
- With a lot of the frameworks and tools that are mentioned IGA, ISPM, ITDR, etc... I notice that a lot of respondents say they will be implemented in X time, but no org responded saying "we will not be implementing this", that seems like a real limitation in the questionaire.
- Wow, 94% of respondents are going to invest in AI in some capacity, that's an incredible vote of confidence in AI from orgs, or they're just afraid of missing out.
- Passwords and lack of security is a bottleneck I hadn't considered, passwords as tech debt, weird.  But I'm definitely more concerned about half of respondents not having the necessary security measures in place for Customer based IAM.
- The orgs that have effective tools and investments experiencing fewer security incidents seems like a fairly obvious finding, but what were the identity based security incidents in those orgs that WERE well resourced enough AND had the right tools?
- I think the foundation of "high performers" in this case is really just a proxy for those orgs that have management buy in and are well resourced enough.  How do you reach the orgs that don't have those advantages, and what wins can be offered to them?  Because from what I'm seeing it seems like the easiest win is automated password checking.
- As a strange result, I'm wondering why 'high preformers' aren't using temporary privleged access assignments or secondary accounts and primary account privleged access is a thing.
- Again, 'high performers' adopting new technolgies and frameworks doesn't seem to be shocking given their impled support and resources.
- Wow, a 3.7% response rate is pretty rough and I'm not sure how representative that is.

• Finish Critical Analysis Project
• Take SC900
• Educational Outreach

On Deck for Next Week:

• Continue DEF CON 2026 outreach
• Pay Relic
• MGS Analysis?
• DC916 Project
• Taxes

Some of the key things that I learned in this podcast were that the modern conception of computer passwords started in 1961 at MIT for the shared computer time system, and as a result the first password breach occurred in 1962 at MIT because a student wanted more computer time, so they printed out all of the passwords.

In learning about passwords, it was also interesting learning about the major changes in computers and how IAM/security has changed with it, namely from mainframes, to decentralized systems, to the cloud, to AI, and the challenges that come with them.

The old challenges still remain of having to manage everything, especially with the rise of AI systems/agent based AI. It’s also not surprising that the vast majority of attacks are identity based and not so much around cool 0 days, because why should I create a door, when someone already has a key for me that I can steal as the though process goes according to Teixeira.

Seeing the move away from passwords was also nice to learn in this episode as more and more are adopting passwordless solutions since passwords have been a common pain point.

One of the other fun things to hear discussed was the issue around machine identities and how different companies manage machine access/identity. For Teixeira, he recommended associating a person with a machine so that the owner can take responsibility and maintain any issues that happen with access or anything else.

I know even in my own job we’ve had machines that try to access resources and end up locking out service accounts or valid human interactions, so that pain is very real. In my case, the machine kept repeatedly trying a password that had been updated, but the machine didn’t have the new one loaded, so the system it was trying to access saw it as a brute force attack after so many attempts and locked the account it was trying to use out. Unfortunately, the account was a service account that not only the machine used, but also real people.

Some parting advice that Teixeira was to not go in with any assumptions when trying to solve an issue, because so many analysts want to reinforce their assumptions as opposed to actually working the problem.

As we move more into the AI era, it will be interesting to see how IAM adapts (and the endless stream of acronyms the IAM discipline comes up with as a result)

• Finish IAM DC916 project
• Educational Outreach
• Finish DC916 slides

On Deck for Next Week:

• Pay parking ticket
• SC300
• BSides SF Plans
• Start planning Def Con 2026

• Finalized DEF CON plans
• Read chapters 0 and 1 from Zero to Zero Day
• Went through Microsoft’s AI Red Teaming Course
• Completed Module 2 of the AZ-900