#454 - Sponsor Spotlight - HYPR

Bojan Simic, co-founder and CEO of HYPR, returns to Identity at the Center for a Sponsor Spotlight conversation with Jim McDonald. Bojan traces HYPR's path from passwordless authentication to a broader set of identity assurance controls and explains how assurance differs from verification across the full employee lifecycle. He describes what organizations find when they look for worker impersonators, from remote employees outsourcing their jobs to North Korean operatives, and why verification has to continue past day one. The conversation then turns to AI agents: why IAM teams are becoming the HR of AI, how agent identity differs from human identity, why humans can't manually govern agents at scale, and why securing MCP alone misses the full context of an agent's session. Bojan also covers what is slowing passwordless adoption, adaptive risk, alert fatigue, and how identity teams and the SOC can work together. This episode was made possible with support from HYPR.

Connect with Bojan: https://www.linkedin.com/in/bojansimic

Learn more about HYPR: https://www.hypr.com/idac

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at idacpodcast.com

00:10 Sponsor Spotlight intro and welcome back Bojan Simic

02:36 HYPR's evolution from passwordless to identity assurance

04:44 How the pace of identity projects has changed

06:01 Agentic AI moves from theory to reality

08:19 Identity assurance vs. identity verification

10:02 Why workforce identity verification is on the rise

13:01 AI-powered social engineering crosses language barriers

14:30 Continuous verification beyond onboarding

17:06 Balancing verification with user experience

18:36 The business problem behind AI agent governance

22:42 How agent identity differs from human identity

24:50 Who owns agent identity? IAM as the HR of AI

27:00 Governing agents at scale and keeping humans in the loop

29:23 Why endpoint control matters for AI agents

31:48 What securing MCP alone can miss

33:20 Deterministic and probabilistic controls

35:00 What is holding passwordless back

37:26 Pilots and letting perfect be the enemy of good

39:25 Advice for leaders on adaptive risk

42:02 Signals that matter and avoiding alert fatigue

43:36 Identity teams and the SOC

45:53 Lighter note: early mornings in New York, family, and the Yankees

50:36 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Bojan Simic, HYPR, Sponsor Spotlight, identity assurance, identity verification, workforce identity verification, continuous verification, worker impersonation, North Korean IT workers, deepfakes, social engineering, help desk security, AI agents, agentic AI, agent identity, AI agent governance, non-human identity, NHI, MCP, Model Context Protocol, endpoint security, blast radius, least privilege, access reviews, passwordless, MFA, FIDO, adaptive risk, adaptive authentication, alert fatigue, SOC, identity threat detection, IAM