Seven years ago, KuppingerCole Analysts introduced the Identity Fabric concept and it has shaped how organizations structure identity management ever since. In this episode, Matthias sits down with Martin Kuppinger, co-founder and distinguished analyst at KuppingerCole Analysts, to revisit the origins of the Fabric paradigm, explain why it still holds today, and preview where it's headed next into cybersecurity, AI security, and beyond.

Key Topics:

✅ Why the Identity Fabric concept emerged in 2019 — tool sprawl, siloed IAM, and the collapse of the perimeter
✅ What "fabric" actually means: a capability-driven layer connecting all identities to all services
✅ Why capabilities should define tools — not the other way around
✅ How the fabric concept scales to cybersecurity and AI security architectures
✅ The fabric in practice: maturity assessments, requirements analysis, and target operating models
✅ A look ahead to 2040: why the core principles are built to last

"The job of identity management is to provide seamless access for everyone and everything to every service" — seven years on, that definition still holds. Find out why in this episode.

📅 This is the first episode of a new series on the fabric paradigm, covering Identity Fabric, Cybersecurity Fabric, and AI Security Fabric.

Build or buy, it sounds like a simple question, but for most organizations, it's one of the most consequential and poorly structured decisions they make. In this episode, Matthias sits down with analyst and advisor Phillip Messerschmidt, who turned his hands-on advisory experience into a structured framework for getting the make-or-buy decision right every time.

Key Topics:

✅ Why "we can build it cheaper" is almost always a biased and incomplete argument
✅ How the originating perspective (business unit, IT, security) shapes — and distorts — the decision
✅ The most common and costly mistakes organizations make when going the build route
✅ When buying is clearly the better path: expertise gaps, speed, scalability, and vendor roadmaps
✅ Why security and risk must be part of the decision from day one — not an afterthought
✅ A structured, holistic framework for making the right make-or-buy call

"This cheap solution can quickly turn into a security risk, an open attack, a breach — and much more cost than thinking about risk by design." Sound familiar? This episode is for you.

Alert overload, 24/7 coverage gaps, and human threat actors who never stop — the SOC has problems that traditional SOAR and rule-based systems simply can't solve. In this sponsored videocast, KuppingerCole analyst Matthew Gardiner and Rick Bosworth, Head of Product Marketing at Torq, dig into the findings of KuppingerCole's Emerging AI SOC Leadership Compass and explore what it actually takes to build an AI-powered security operations center.

Key Topics:

✅ Why rule-based SOAR has hit a wall — and how AI agents address what it can't
✅ The autonomy dial: why full automation isn't the goal and how to build trust incrementally
✅ Integrations, RAG, and MCP: the new data infrastructure powering AI agents in the SOC
✅ DIY SOC vs. managed providers: how agentic AI is reshuffling the build-vs-buy decision
✅ Where to start: alert triage, phishing, and typosquatting as low-risk entry points
✅ Guardrails, transparency, and the non-deterministic challenge of AI-driven security

"AI agents hate people because they're slow" — but full autonomy isn't the answer either. Find out how leading SOC teams are finding the right balance between speed and control.

This videocast is sponsored by Torq — featured in KuppingerCole's Emerging AI SOC Leadership Compass. Read the report, then watch this session to hear the findings brought to life.

IGA is often dismissed as a mature, stable market but that couldn't be further from the truth. In this episode, Matthias sits down with Nitish Deshpande, to explore how identity governance and administration is being reshaped by NHIs, AI-driven intelligence, deployment sovereignty, and a wave of challenger vendors.

Key Topics:

✅ How IGA has evolved from static, siloed tools to integrated, multi-identity platforms
✅ Non-human identities: IGA vendors are now covering NHI governance — and customers are demanding it
✅ Where IGA still falls short: role mining, anomaly detection, policy simulation, and workflow automation
✅ The deployment model debate: SaaS vs. on-premise vs. hybrid — and the feature parity problem
✅ EU sovereignty as a competitive differentiator for European IGA vendors
✅ What's coming next: real-time governance, access intelligence, and a new IGA report category

44 vendors evaluated, a surge of newcomers, and a market quietly reinventing itself — the KuppingerCole IGA Leadership Compass is out now and covers everything discussed in this episode.

Four weeks after EIC 2026 in Berlin, Matthias Reinwarth and Phillip Messerschmidt sit down to reflect on what the European Identity and Cloud Conference revealed about the state of identity and access management and what it means for the year ahead. Spoiler: agentic AI dominated, but it wasn't the only story.

Key Topics:

✅ Agentic AI as a new class of insider threat — autonomous, non-deterministic, and without ethics
✅ Data-centric defense vs. agent discovery: protect the vault, not the crowd
✅ Why dynamic authorization and behavior analytics are the IAM industry's urgent next step
✅ Data sovereignty and geopolitics: eroding trust in non-European SaaS vendors
✅ AuthZEN wins the EIC Award — a standard built before anyone knew the problem it would solve
✅ Martin Kuppinger's closing keynote: "Everything we failed to solve in the past decades bites back now"

"An agent behaves like a human insider threat — but without any sense of right or wrong." If your IAM program isn't ready for that, this episode is required listening.

Business relationships are complex and traditional IAM wasn't built for them. In this episode, Matthias Reinwarth sits down with Principal analyst John Tolbert, author of KuppingerCole Analysts' first-ever B2B IAM Leadership Compass, to explore why Business-to-Business Identity and Access Management is emerging as its own distinct market and what it takes to get it right.

Key Topics:
✅ Why B2B IAM sits between workforce IAM and CIAM — and why neither alone is sufficient
✅ Delegated administration: handing identity governance to partner and supplier organizations
✅ Federation, lifecycle management, and the risks of trusting external HR processes
✅ "Know Your Business" — vetting organizations, sanctions screening, and org-level trust
✅ Fine-grained authorization: why RBAC falls short and ABAC/RBAC are taking over
✅ Agentic AI in B2B IAM: agents acting on behalf of external organizations

Supply chains with thousands of partner organizations, freelancers with hour-long access windows, and AI agents acting on behalf of external companies B2B IAM has to handle all of it. KuppingerCole Analysts' first B2B IAM Leadership Compass is out now read it alongside this episode to get the full picture of an emerging market you can't afford to ignore.

Speed and security are no longer separate concerns. In this videocast, Osman Celik sits down with Andrey Leskin, CTO of Qrator Labs, to break down what Content Delivery Networks really are in 2026 and why they've become a critical piece of modern security infrastructure, not just a performance tool.

Key Topics:

✅ What CDNs are and why they're no longer optional for competitive organizations
✅ How CDN and DDoS mitigation differ — and where they overlap
✅ Cache busting, HTTP floods, Slowloris and other real-world attack vectors
✅ Why "security-first CDN" is fundamentally different from "CDN with security bolted on"
✅ What CISOs and infrastructure leaders should look for when evaluating CDN solutions
✅ How to measure CDN value from day one: round trip time and time to render

A CDN without security is just a bigger target — find out why building security in from the ground up changes everything.

Privileged Access Management has outgrown the vault. In this episode, Matthias sits down with lead analyst Alejandro Leal, author of KuppingerCole's newly released PAM Leadership Compass, to explore how the definition of privilege itself has changed, what NHIs and agentic AI mean for PAM, and why deployment sovereignty is now a boardroom conversation.

Key Topics:

✅ How the definition of "privilege" has shifted from admin accounts to dynamic runtime identity capabilities
✅ PAM convergence with IGA, CIEM, ITDR, SIEM, and SOAR — the end of the standalone PAM product
✅ Non-Human Identities (NHIs) and agentic AI: the silent accumulation of machine privilege
✅ Just-in-time access: the gap between concept and operational reality
✅ Deployment sovereignty: who controls the keys to the kingdom — SaaS, on-prem, or hybrid?
✅ AI and ML in PAM: separating genuine innovation from marketing inflation

"Most enterprises can tell you the number of employees they have — very few can tell you the number of machine identities." If that sounds familiar, this episode is for you.

Not all cyber threats target your systems, some target your reputation, your customers, and your brand. In this episode, Matthias Reinwarth sits down with research analyst Osman Celik to unpack three closely related but distinct markets: Attack Surface Management (ASM), Digital Risk Protection (DRP), and Brand Protection — and help organizations figure out which one they actually need.

Key Topics:

✅ What Attack Surface Management is and its four subcategories (CAASM, EASM, TPRM, DRP)
✅ How Digital Risk Protection monitors dark web, social media, and hacker forums
✅ What Brand Protection adds on top of DRP — from takedown services to counterfeit detection
✅ DRP vs. Brand Protection: lightweight vs. full-spectrum — and when you need which
✅ Why brand reach matters more than company size when assessing risk
✅ What KuppingerCole research is available now — and what's coming in August

Someone may be selling counterfeit versions of your product right now — or impersonating your brand online. DRP and Brand Protection tools exist to catch exactly that.

Check out KuppingerCole's Brand Protection Buyer's Compass here.

Shadow IT was manageable. Shadow AI was concerning. Shadow agents? That's a whole different problem.

300 episodes already? Time flies when you're having fun! In this 300th Episode of the KuppingerCole Analyst Chat, Matthias sits down with Distinguished Analyst Martin Kuppinger to unpack one of the most urgent, and underestimated, security challenges facing organizations right now: employees building and deploying their own AI agents, with no governance, no oversight, and no accountability.

Key topics:

✅ What "shadow agents" are and why they're fundamentally different from shadow IT or shadow AI
✅ Why vibe coding means anyone, not just developers, can now deploy autonomous agents inside your systems
✅ How AI agents massively expand the attack surface through prompt injection, data exfiltration, and uncontrolled access
✅ Why discovery and resource-side controls must happen in parallel and why neither alone is enough
✅ What organizations can actually do to gain control without just shutting everything down

The bottom line: there's a thin line between agents that help your business and agents that harm it. Right now, most organizations can't tell the difference.