Robert Mckay

I think it's pretty easy to look at these numbers and conclude that security leaders are in the wrong, but I see a different problem. In my experience, most #security teams are actually good at preventing the attacks they’ve modeled, rehearsed, and bought tools for. The issue is that they're trying to solve outdated problems. #Ransomware keeps winning because it doesn’t play by any assumptions. It sneaks in through #identity sprawl, standing access that has discreetly outlived its purpose, and exceptions everyone agreed were “temporary.” Confidence isn’t the real problem. Overconfidence in static controls in a very dynamic identity environment usually is.

There's a lot about this stat that I find pretty concerning. One of the biggest issues I see is that if #IAM spend is justified mainly by user experience, it usually means identity is being positioned as a productivity tool instead of a control plane. That framing shapes every downstream decision—how much risk is acceptable, how exceptions get handled, how temporary access quietly becomes permanent, etc. UX should absolutely be part of the conversation, but it can’t be the reason the conversation exists. Identity is where trust is established, enforced, and continuously re-evaluated. If security isn’t the primary driver there, we’re just deferring complexity until it shows up as an incident.

When we started Webmethod, the goal was never to sell tools. It was to help organizations make sense of identity, access, and risk in environments that keep getting more complex. Most of the problems we’re brought in to solve aren’t caused by a lack of technology. They come from fragmented identity programs, unclear ownership, and security controls that don’t scale as the business grows. That’s true whether we’re working with a federal agency or a commercial enterprise. Our work centers on building practical identity and access governance: programs that align with real risk, real compliance requirements, and how systems are actually used. That includes IAM strategy and execution, identity governance, privileged access management, and targeted security assessments that give teams a clear path forward. We’re also intentional about how we partner. As a trusted Microsoft and IBM partner, we help clients use platforms like Defender for Identity, IBM Verify, and WatsonX in ways that fit their environment, not force-fit architectures that look good on paper but fail in practice. Cybersecurity isn’t about doing everything at once. It’s about getting the fundamentals right and building from there. That’s the work we focus on every day.

The more interconnected our systems become, IT, OT, cloud, edge, AI, the more I’m convinced that identity is the real backbone of enterprise resilience. Who is accessing what, when, and for what purpose? That question shows up in banking, factories, hospitals, public services, energy grids, everywhere. And the answer keeps getting harder as we move from managing “users” to managing humans, machines, workloads, and now AI agents all operating side by side. Yet most identity models still rely on assumptions from another era: static roles, long-lived access, periodic reviews. That breaks the moment an AI agent can make thousands of decisions in a day. For me, resilience comes down to two questions: Can you trust the identity behind every action? And can you verify that trust continuously? If not, the rest of the architecture doesn’t matter. The tools are getting better, adaptive access, stronger governance, AI-driven insight, but none of it works without clean identity data, clear ownership, and a model that adapts as fast as the environment changes. We’re not defending a perimeter anymore. We’re governing an entire ecosystem of identities. The organizations that treat identity as a strategic layer, not background plumbing, are the ones that will move with confidence.

We’ve spent years telling people, “If you see something, say something,” and the data from Verizon's 2025 Data Breach Investigations Report shows that to an extent, it works. Recent training really does lift #phishing reporting rates. But that being said, the same data also makes it clear that clicking behavior barely changes, even with more training. To me, that says that most clicks aren't a failure of training inherently. More often than not, they're a design failure. When people are overwhelmed, rushed, or juggling too many tools, they default to whatever gets them to the next task fastest. If we want fewer clicks, we have to make the secure choices the easier choices.

What a massive wake-up call. #Identity is the control plane for everything we build. If you can’t see which accounts exist, who has what rights, or which identities are stale, you’re effectively navigating with half your instruments offline. That's how seven out of 10 IT and security leaders operate. To change that, I think we need to start with inventory and end with engineering. We need to begin by mapping every identity—human, machine, and agent. Then, we need to ask two of the simplest questions: Who can do what, and whether or not they need that access. When you pair that visibility with continuous risk scoring and automated remediation, you stop discovering problems and start preventing them. Visibility alone isn’t the finish line, but without it, you can’t prioritize. Making the investment in identity telemetry now can help you convert an abstract risk into something measurable and actionable.

During mergers and acquisitions(M&A), there's no shortage of risks that go overlooked, overhyped, or totally misunderstood. One of the most historically misunderstood ones, in my experience, has been #identity sprawl. And that's a dangerous one. Speed has always been, and will always be, important in #IAM. What more organizations began to realize over time, however, is that something essential was being sacrificed for speed: Visibility. Speed without visibility gets you nowhere productive. You may get a few temporary fixes, but you'll never be able to make any lasting, informed decisions. I dive into this more in this clip here, and I'd love to hear your thoughts.

In almost every #security conversation I have, cloud, endpoint, access control, it eventually comes back to identity. Not in a theoretical way, but in a very practical, “why does this matter to the business” way. What leaders struggle with isn’t the technology. It’s prioritization. What gets fixed first? What gets deferred? And how do you justify it in business terms, not security jargon? I talked about this in a recent conversation and why identity ends up being the common thread in all of those decisions. Sharing the clip here for anyone thinking through the same problem.

It's not always great to make assumptions in life, but in #cybersecurity, there are some you have to build your systems around. Assume you're never 100% safe. Assume that at some point, human error will create an opening. Assume that if access isn’t limited, unknown entities can move deeper into your environment than you ever intended. I dive a bit more into this short clip here—give it a watch and let me know your thoughts!

If the fact that 74% of IT leaders admit that identity is an afterthought to them makes you uncomfortable, it should. It explains a lot of the incidents we see, quite frankly. When identity is tacked on at the end of a project, it becomes a gap. Roles aren’t mapped, credentials are scattered, and automation never materializes. It leaves an open door for attackers who know exactly where to look. Identity needs to be part of the conversation from day one. Ask early and definitively who needs access, under what conditions, and how that access will be revoked. Treating identity as a planning item drastically changes the outcomes. Breaches can do permanent damage if identity isn't central.

Really interesting stats from @wef's 2025 Global Cybersecurity Outlook report. To me, it paints a pretty clear picture of both where we are as an industry and where we still need to go. #Upskilling existing employees is the most common approach, and honestly, rightly so. Those closest to your systems already understand your environment and culture. That being said, the other numbers point to a bit of a challenge. We can’t close a widening skills gap by fishing in the same small pond. Apprenticeships and cross-disciplinary hiring should be treated like the innovative strategies they are. They bring in people who think differently, which is exactly what #cybersecurity needs to keep up with threats that never think the same way twice. Investing in talent has a lot more to do with just training alone. It requires businesses to build systems that reward adaptability and make learning part of the job.

Far too many businesses don't realize that without strong identity controls, every account becomes a potential master key. Once credentials are stolen or abused, attackers rarely stop at the first unlocked door. They move laterally, escalate privileges, and turn one mistake into a full compromise. #IAM isn't just some compliance headache. It's the difference between an isolated incident and a system-wide #breach. If IAM still doesn't seem worth it to you after hearing that, it will after that breach has cost you potentially millions of dollars.

A doubling of third-party #breaches in a year tells me something we don’t talk about enough: trust is too often assumed, not verified. Every vendor relationship is an extension of your attack surface, yet so many organizations still rely on static questionnaires or one-time assessments, as if #risk were frozen in time. In reality, those risks evolve daily. The numbers make it clear that supply chain security isn’t optional anymore. It’s a core competency that needs the same continuous monitoring and rigor as internal security.

You'll never catch me pretending to know everything about anything, even fields I have plenty of experience with. In the spirit of not knowing everything, I want to share a few things I've noticed now, nine months into 2025, that definitely weren't on my bingo card. I don't want to just say "how fast AI has advanced," because its continued growth isn't necessarily surprising. I will say, however, that I didn't expect such extreme mindset shifts in such a short period of time. Federal and enterprise leaders moved from ‘curious about AI’ to ‘we need a defensible AI policy—yesterday" in what felt like the blink of an eye. #Identity also hasn't evolved the way I thought it would, but in a very different way. I wouldn't have guessed how much identity continues to anchor every conversation. Whether it’s #ZeroTrust, hybrid work, or #AI governance—it always comes back to who’s accessing what, when, and why. There have been plenty of other surprises along the way, but those are a few of the biggest off the top of my head. I'd love to hear anything that's been a bit unexpected to you too.