Fourteen percent of AI agents go live with full approval. The rest are running anyway — chaining tasks, spawning sub-agents, crossing system boundaries at machine speed with more access than any human employee would be granted. The identity stack can tell you who logged in. It cannot tell you whether the agent spawned from that login should be querying that database right now.

Mark Van Oppen is CRO at SecureAuth, which has been in identity infrastructure for twenty years and is now building what they call continuous authority: real-time, action-level governance across every identity type — workforce, customer, partner, and non-human agent. Mark spent fifteen years in core infrastructure and four years in customer identity before joining two months ago to run GTM for what he sees as the most structurally important category emerging in enterprise security.

In this episode: why CISOs who believe they have identity covered are right about the old definition and completely exposed to the new one, how a fintech executive who vibe-coded a capacity planning app accidentally started forecasting which employees might become pregnant, why unique monthly active users is the wrong metric when one human can spawn a hundred agents overnight, and how SecureAuth creates urgency with buyers who believe agentic AI is still eighteen months away.