The Identity Blueprint

This episode gives you the exact mechanics for achieving day-one cross-org access with Okta and Ping: how to bridge an acquired company's on-prem Active Directory without touching it, how namespace collisions actually get resolved, and the full authentication chain that gets a legacy app working with zero code changes.

In this episode, Ernie and Josée run the same day-one M&A scenario we covered on Microsoft Entra, this time thr...

This episode gives you the actual playbook for the risk you inherit in an M&A deal: how to migrate overlapping access groups without a naming collision, how to forensically expose shadow IT tenants before they become a backdoor, and why data migration servers keep becoming the entry point attackers actually use.

In this episode, Ernie and Josée map the full M&A identity risk landscape — starting with the Marriott-Starw...

This episode gives you the exact integration mechanics for Day One of an M&A: how to bring an acquired company's identities into your Entra ID tenant without a multi-year Active Directory consolidation project, and without opening a single inbound firewall port.

In this episode, Ernie and Josée tear down three real integration scenarios — starting with the classic case of acquiring a legacy, on-prem-only organization. We t...

By the end of this episode, you'll know exactly how Okta and Ping handle the same identity challenges Microsoft solves with Entra — so you can evaluate either platform on real mechanics instead of vendor promises.

In this episode, Ernie and Josée run the same stress test from the Microsoft episode through Okta and Ping: attribute-level source-of-authority switching down to a single field, the SPNEGO handshake that lets a cloud...

By the end of this episode, you'll know exactly how a source-of-authority cutover happens without service disruption, and how to lock down every sensitive admin group so standing privilege — the thing attackers actually rely on — simply doesn't exist anymore.

In this episode, Ernie and Josée go deep on the actual mechanics: the metadata flip that switches an object's source of authority without touching a single running ...

This episode gives you a working, accurate model of hybrid identity in 2026: where authority actually lives, how it's protected end to end, and exactly where your remaining legacy footprint still needs attention. No guessing, no assumptions — just the real architecture, so you can defend it properly.

In this episode, Ernie and Josée open Season Two — Beyond the Domain — by tracing exactly how an identity gets creat...

Your dashboard says everything is fine. Intrusion detection normal. Firewall active. MFA compliance at 98%. Meanwhile, somewhere in your environment right now, credentials are being harvested and nobody's metric is moving. That is not a security program. That is an expensive illusion of one.

In this episode, Ernie and Josée decode Phase 7 of the IAM engagement blueprint: operationalization and metrics. Drawing from SailPoint, CyberA...

The most dangerous assumption in any identity rollout is that the hard part is technical. It isn't. The hard part is the manager who needs access right now and doesn't care how it gets done. The administrator who knows the bypass is wrong but creates it anyway. And the organization that spent millions on the architecture and nothing on planning for either of them.

In this episode, Ernie and Josée tear apart Phase 6 of the IAM engage...

Most organizations buy identity technology one piece at a time. A directory here. An MFA solution there. A PAM tool when the auditors ask for it. The result is nine disconnected layers that were never designed to work together — and an architecture that fails the moment it's tested.

In this episode, Ernie and Josée decode Phase 5 of the IAM engagement blueprint: the technology architecture and three-year roadmap. Nine distinct...

Your employee submitted their resignation on Friday. By Monday morning their access was still fully active. Every system. Every application. Every privilege they ever accumulated.

In this episode, Ernie and Josée go deep on Phase 4 of the IAM engagement blueprint: process and lifecycle design. The joiner, the mover, the leaver — every transition point in the human identity lifecycle where access gets granted, recalculated, and...

Season 1, Episode 4: You automated your practices. You accelerated your procedures. Yet you're still failing your audits. Your platform isn't fixing your identity problem — it's accelerating it. And right now, you're operating blindly when you should be seeing everything.

In this episode, Ernie and Josée break down Phase 3 of the IAM engagement blueprint: the policy and governance framework. Drawing from the Identity Managemen...

Season 1, Episode 3:  Identity isn't a technology problem. It's a strategy problem. And until your executive team agrees on where you're going, every platform you buy and every policy you write is just expensive guesswork.

In this episode, Ernie and Josée map out Phase 2 of the IAM engagement blueprint: Identity Strategy and Target State Design. From building an executive vision that gets the CFO to write the check, to designin...

Season 1, Episode 2: You can spend millions securing the front door. Vault-grade authentication. Biometric access controls. Armed monitoring around the clock. And an attacker will walk right past all of it — through the forgotten maintenance tunnel you didn't know existed. In this episode, Ernie and Josée execute Phase 1 of the IAM engagement blueprint: the identity security autopsy. A keystroke-level discovery process that s...

Season 1, Episode 1: One forgotten password. One orphaned VPN account with no MFA. That's all it took to shut down half the fuel supply of the United States East Coast. In this episode, Ernie and Josée unpack the seven-phase IAM Program Engagement Blueprint — the complete, sequenced framework for taking an enterprise from identity chaos to a governed, mathematically verifiable security program. From executive scoping to conti...