ID Talk: RSAC Debrief with Frost & Sullivan’s Danielle VanZandt

The latest episode of the ID Talk podcast features a lively and insightful conversation with Danielle VanZandt, Research Manager and Program Director for Security at Frost & Sullivan, fresh from this year’s RSAC (formerly the RSA Conference). Co-hosted by Alex Perala and Tony Bitzionis, along with newcomer Dave Barclay making his ID Talk debut, the conversation explored key developments in identity security, machine identity, and the increasingly complex role of AI in cybersecurity.

VanZandt outlines two major research areas that guided her time at RSAC: cyber-physical system security (a modern framing of operational technology security) and emerging developments in identity security. She highlights the conference’s growing emphasis on post-password authentication methods, noting the decline in prominence of traditional password managers in favour of more comprehensive identity governance strategies. While biometric authentication did not dominate the show floor, it was part of broader conversations around multi-factor authentication, passkeys, and secure onboarding processes for distributed workforces.

“Passkeys are going to be big, but it depends on the industry,” VanZandt asserts. She cites workforce identity management as a key area where passkeys are gaining traction, describing use cases in which large, distributed organizations have streamlined employee verification and credential distribution using passkeys and structured workflows to ensure proper identity assurance.

VanZandt also draws attention to machine identity, sometimes referred to as non-human identity (NHI), as a rising priority in identity management. As more organizations deploy AI agents and automated scripts across IT systems, traditional IAM tools struggle to track and manage their credentials and privileges. This opens new vectors for cyberattacks, particularly if inactive or orphaned AI agents are left with unchecked access. “You need a machine identity system that can verify what these agents are supposed to be doing and flag anomalies,” she explains.

AI was a dominant topic throughout the event, with attendees and vendors leaning into the trend. VanZandt observes that much of the industry has embraced “AI-washing,” branding traditional automation or machine learning as generative AI. Still, she notes signs of a maturing understanding. In particular, she points to growing interest in agentic AI, which refers to autonomous AI agents assigned to specific, recurring tasks. “Think of it like a Clippy that does the job without being asked every Monday by 5 p.m.,” she says. These agents have potential to assist in areas ranging from HR onboarding to security operations, but they also raise new challenges in access control and lifecycle management.

Deepfakes are another area of concern, not as headline-grabbing demos but as real-world threats. VanZandt notes that remote workforce onboarding is particularly vulnerable to deepfake actors impersonating job applicants in order to gain access to enterprise systems. Fortunately, identity verification processes, including hardware tokens and layered authentication procedures, are increasingly being designed with these attack vectors in mind.

Geopolitical threat intelligence also featured prominently at the conference. VanZandt emphasizes the growing importance of contextual awareness in cyber threat analysis, particularly in the wake of workforce reductions at U.S. federal cybersecurity agencies such as CISA. “Without geopolitical context, it’s hard to prioritize threats or understand who is behind them,” she observes. She also expresses concern that gaps in public-private threat intelligence sharing could emerge as a result of these staffing changes.

Throughout the episode, VanZandt underscores the continued need for human oversight. While AI agents and automation are playing a larger role in security operations, “there will still be security operations teams behind it,” she says. “They may be augmented by agents, but it won’t be a full replacement.”

For those interested in the full conversation – including RSAC’s lighter moments, like puppies, goats, and even a Grave Digger monster truck sighting – the episode is available through the media player below, or wherever you get your podcasts.

–

May 7, 2025 – by the ID Tech Editorial Team