KuppingerCole Analysts AG is an international, independent analyst organization offering technology research, neutral advice and events in Identity Management, Cybersecurity and Artificial Intelligence.
Analyst Chat #319: The Hardest Problem in Cybersecurity - Securing AI Agents
Securing and governing AI agents is, according to Matthew Gardiner, the hardest problem in cybersecurity harder than securing the internet itself. In this episode, Matthias discusses with Matthew why, explore the six-category framework KuppingerCole Analysts has developed to address it, and dig into the first and most critical building block: AI Visibility and Observability Platforms.
Key Topics:
Why agentic AI is harder to secure than the internet non-determinism, autonomy, and scale
Threat actors using agents too: how the attack surface is accelerating on both sides
The six-category security and governance framework for agentic AI crawl, walk, run
AI Visibility and Observability Platforms: why discovery comes first and what it actually covers
Organizational alignment: why security teams shouldn’t take the blame for every agent failure
Authority vs. access: why what an agent can do matters more than what account it uses
🤖 “When the internet was rolled out, we had time to catch up. Agents roll into a world where businesses are already completely dependent on IT and there are hundreds or thousands of them doing different things.” Matthew Gardiner on why this time really is different.
📊 KuppingerCole Analysts’ AI Visibility and Observability Platform research is live and the AI Security Fabric is landing in days. Watch this episode, then dive into the research at kuppingercole.com.
5 Oct 2026
Analyst Chat #318: Before You Build - IAM Customization Governance in the AI Era
AI can build your IAM connector in an afternoon. But was the connector ever the bottleneck? In this episode, Matthias invited Patrick Teichmann, lead advisor at KuppingerCole Analysts, to talk about his newly published advisory note on IAM customization governance and ask the harder question: what happens when the cost of building disappears, but the cost of maintaining doesn't?
Key Topics:
Why AI removes the development bottleneck in IAM — but exposes the real one: requirements definition
The danger of saying yes too easily: how AI makes it tempting to build what should never be built
Security risks in AI-generated IAM code: what the research actually shows
A seven-step framework for evaluating any IAM customization before writing a single line
The customization registry: how to build transparency and governance into what already exists
When to stop customizing and ask whether the platform itself is the wrong tool
⚠️ "AI makes code cheap but the bottleneck in IAM was never primarily creating the code." Patrick Teichmann on why removing the development barrier without fixing requirements definition is a recipe for a new generation of Lotus Notes.
📄 Patrick's advisory note on IAM Customization Governance is published on the KuppingerCole Analysts website now; watch this episode first, then dive into the research.
29 Sept 2026
Analyst Chat #317: MCP Is Just Another API, and That's the Bad News
MCP servers are showing up on the internet without authentication, malicious tool definitions are being injected into trusted projects, and three security teams are defending the same environment without sharing a single threat signal. In this week's episode, Matthias sits down with Alexei Balaganski, Lead Analyst and CTO at KuppingerCole Analysts, to dig into the real MCP security problem and why the answer isn't an MCP security product.
Key Topics:
✅ The LocalAI attack: 23 unprotected MCP servers, root access in minutes, military data exposed
✅ Is MCP a new security problem or just a new label for old ones?
✅ The Deadbugs attack: how tool descriptions were silently poisoned to manipulate AI agents
✅ Who is responsible for MCP security: Anthropic, the vendor, or you?
✅ Tool poisoning, prompt injection, and the gaps between AppSec, NetSec, and endpoint teams
✅ Monday morning recommendations: what to actually do about MCP security right now
🔐 "Models reason, APIs act, and identity grants the authority to act" Alexei Balaganski's one-line summary of why MCP security cannot be solved by a single tool or a single team.
📅 MCP is a symptom, not the disease, join KuppingerCole Analysts at the upcoming AIdentity & NHI Impact Day (https://www.kuppingercole.com/events/nhiid2026), CIAM Impact Day (https://www.kuppingercole.com/events/ciamid2026), and Identity-Centric Cybersecurity Summit (https://www.kuppingercole.com/events/icc-summit-2026) events in Germany to continue this conversation in person.
Who has been a guest on KuppingerCole Analysts
Names identified in recent episode analyses. Showing up to five guests.
Alexei Balaganski
Jonathan Care
John Tolbert
Christie Pugh
Patrick Teichmann
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
YouTube views
146,168
Score snapshot 15 Sept 2025
Apple Podcasts (US)
5.0 / 5
2 ratings
Spotify
5.0 / 5
4 ratings
Podcast Authority Score: 65 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
66
Social presence
0
YouTube
86
Engagement
76
Host of KuppingerCole Analysts?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
