Podcast 🎧
Our CRO Christian Bartels joined host Joseph Carson on Segura's Security by Default podcast to talk about the question every security team gets asked: who has access to what? In 43 minutes they covered why identity visibility matters, how AI agents change the risk, and why good controls pay for themselves.
Listen on Apple Podcasts, Spotify and all major podcast apps, or on the episode page.
Even mature teams miss the full picture
Christian sees two kinds of organisations. Smaller companies are often hybrid, moving from on-premise Active Directory to Entra ID, with no overview yet. Once you pass around 100 employees, a spreadsheet stops working.
Large enterprises are further along, with several IAM and IGA tools and multiple directories. They still lack a 360-degree view of who can access what. As Christian puts it: "If you cannot measure it, you cannot control it."
The pressure is highest in regulated sectors: financial services, software and service providers under supply-chain rules, defence and the public sector.
Connect every source, then just ask
That is the gap an Identity Visibility and Intelligence Platform (IVIP) fills. Elimity, headquartered in Belgium, has worked on it for more than seven years, with customers across Europe and North America. It connects with the systems you already run and brings every account and permission into one view.
Business teams no longer have to queue up access questions for the identity team either. With Elimity's MCP connection, they ask their own AI assistant, such as Microsoft Copilot, Mistral or Claude, who has access to what, and the answer comes straight from the identity data.
AI agents inherit everything
Agents act on behalf of a user, so they inherit all of that user's access. And an agent does not care whether a request makes sense in context. Christian's example: a question about a colleague's salary or sick leave. If the access is there, the agent will find the answer. In a listed company, the same gap can leak price-sensitive information and create insider-trading risk.
Joseph added that non-human identities have outgrown tools that were built for people. Before you can govern agents, you need to know what each identity can reach.
Controls are life insurance, and a business enabler
Security budgets are under pressure. Some organisations only move after an audit finding, when a regulator sets a deadline to fix the issues. Others have raised the topic for years without budget.
Christian calls good controls "a kind of life insurance" for the CISO and management. There are only two kinds of companies, he says: those that have been breached and those that have not been breached yet. When it happens, you want to show the board, the regulator and your insurer that you did your homework. Insurers can refuse to pay out when they see negligence.
Joseph framed identity security as a business enabler rather than a cost: it speeds up onboarding and mergers and acquisitions. Christian described a customer with many acquired entities that gives each one freedom within a frame, while the central team keeps visibility of the risk.
Listen to the full episode
The conversation also covers audit preparation, where identity security is heading and the books Christian recommends. Listen on Apple Podcasts, Spotify or the episode page.
Thanks to Joseph and the Segura team for having us.