Robert Mckay

I think it's pretty easy to look at these numbers and conclude that security leaders are in the wrong, but I see a different problem. In my experience, most #security teams are actually good at preventing the attacks they’ve modeled, rehearsed, and bought tools for. The issue is that they're trying to solve outdated problems. #Ransomware keeps winning because it doesn’t play by any assumptions. It sneaks in through #identity sprawl, standing access that has discreetly outlived its purpose, and exceptions everyone agreed were “temporary.” Confidence isn’t the real problem. Overconfidence in static controls in a very dynamic identity environment usually is.

There's a lot about this stat that I find pretty concerning. One of the biggest issues I see is that if #IAM spend is justified mainly by user experience, it usually means identity is being positioned as a productivity tool instead of a control plane. That framing shapes every downstream decision—how much risk is acceptable, how exceptions get handled, how temporary access quietly becomes permanent, etc. UX should absolutely be part of the conversation, but it can’t be the reason the conversation exists. Identity is where trust is established, enforced, and continuously re-evaluated. If security isn’t the primary driver there, we’re just deferring complexity until it shows up as an incident.

When we started Webmethod, the goal was never to sell tools. It was to help organizations make sense of identity, access, and risk in environments that keep getting more complex. Most of the problems we’re brought in to solve aren’t caused by a lack of technology. They come from fragmented identity programs, unclear ownership, and security controls that don’t scale as the business grows. That’s true whether we’re working with a federal agency or a commercial enterprise. Our work centers on building practical identity and access governance: programs that align with real risk, real compliance requirements, and how systems are actually used. That includes IAM strategy and execution, identity governance, privileged access management, and targeted security assessments that give teams a clear path forward. We’re also intentional about how we partner. As a trusted Microsoft and IBM partner, we help clients use platforms like Defender for Identity, IBM Verify, and WatsonX in ways that fit their environment, not force-fit architectures that look good on paper but fail in practice. Cybersecurity isn’t about doing everything at once. It’s about getting the fundamentals right and building from there. That’s the work we focus on every day.

The more interconnected our systems become, IT, OT, cloud, edge, AI, the more I’m convinced that identity is the real backbone of enterprise resilience. Who is accessing what, when, and for what purpose? That question shows up in banking, factories, hospitals, public services, energy grids, everywhere. And the answer keeps getting harder as we move from managing “users” to managing humans, machines, workloads, and now AI agents all operating side by side. Yet most identity models still rely on assumptions from another era: static roles, long-lived access, periodic reviews. That breaks the moment an AI agent can make thousands of decisions in a day. For me, resilience comes down to two questions: Can you trust the identity behind every action? And can you verify that trust continuously? If not, the rest of the architecture doesn’t matter. The tools are getting better, adaptive access, stronger governance, AI-driven insight, but none of it works without clean identity data, clear ownership, and a model that adapts as fast as the environment changes. We’re not defending a perimeter anymore. We’re governing an entire ecosystem of identities. The organizations that treat identity as a strategic layer, not background plumbing, are the ones that will move with confidence.

We’ve spent years telling people, “If you see something, say something,” and the data from Verizon's 2025 Data Breach Investigations Report shows that to an extent, it works. Recent training really does lift #phishing reporting rates. But that being said, the same data also makes it clear that clicking behavior barely changes, even with more training. To me, that says that most clicks aren't a failure of training inherently. More often than not, they're a design failure. When people are overwhelmed, rushed, or juggling too many tools, they default to whatever gets them to the next task fastest. If we want fewer clicks, we have to make the secure choices the easier choices.

What a massive wake-up call. #Identity is the control plane for everything we build. If you can’t see which accounts exist, who has what rights, or which identities are stale, you’re effectively navigating with half your instruments offline. That's how seven out of 10 IT and security leaders operate. To change that, I think we need to start with inventory and end with engineering. We need to begin by mapping every identity—human, machine, and agent. Then, we need to ask two of the simplest questions: Who can do what, and whether or not they need that access. When you pair that visibility with continuous risk scoring and automated remediation, you stop discovering problems and start preventing them. Visibility alone isn’t the finish line, but without it, you can’t prioritize. Making the investment in identity telemetry now can help you convert an abstract risk into something measurable and actionable.

During mergers and acquisitions(M&A), there's no shortage of risks that go overlooked, overhyped, or totally misunderstood. One of the most historically misunderstood ones, in my experience, has been #identity sprawl. And that's a dangerous one. Speed has always been, and will always be, important in #IAM. What more organizations began to realize over time, however, is that something essential was being sacrificed for speed: Visibility. Speed without visibility gets you nowhere productive. You may get a few temporary fixes, but you'll never be able to make any lasting, informed decisions. I dive into this more in this clip here, and I'd love to hear your thoughts.

In almost every #security conversation I have, cloud, endpoint, access control, it eventually comes back to identity. Not in a theoretical way, but in a very practical, “why does this matter to the business” way. What leaders struggle with isn’t the technology. It’s prioritization. What gets fixed first? What gets deferred? And how do you justify it in business terms, not security jargon? I talked about this in a recent conversation and why identity ends up being the common thread in all of those decisions. Sharing the clip here for anyone thinking through the same problem.

It's not always great to make assumptions in life, but in #cybersecurity, there are some you have to build your systems around. Assume you're never 100% safe. Assume that at some point, human error will create an opening. Assume that if access isn’t limited, unknown entities can move deeper into your environment than you ever intended. I dive a bit more into this short clip here—give it a watch and let me know your thoughts!

If the fact that 74% of IT leaders admit that identity is an afterthought to them makes you uncomfortable, it should. It explains a lot of the incidents we see, quite frankly. When identity is tacked on at the end of a project, it becomes a gap. Roles aren’t mapped, credentials are scattered, and automation never materializes. It leaves an open door for attackers who know exactly where to look. Identity needs to be part of the conversation from day one. Ask early and definitively who needs access, under what conditions, and how that access will be revoked. Treating identity as a planning item drastically changes the outcomes. Breaches can do permanent damage if identity isn't central.