The Identity Blueprint

Ask to move one workload slider to Intune — just the Wi-Fi policy — and Microsoft silently drags your entire antivirus and BitLocker management along with it, whether you're ready or not. This episode is what actually breaks when you migrate off Group Policy, and why some of it isn't optional. In this episode, Ernie and Josée trace why there's no cloud version of SYSVOL — the file share every Group Policy Object depends on — and why Microsoft never built one on purpose: the protocol itself ca...

Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead. In this episode, Ernie and Josée trace w...

The attacker never had a password. They just asked a piece of hardware a simple question, and it handed over the keys to 700 storage buckets — because nobody had drawn a hard line between proving who someone is and deciding what they're allowed to touch. In this episode, Ernie and Josée break down the real architectural divide behind that failure: Microsoft Entra ID as the passport office that verifies who you are, and AWS IAM as the mechanical locksmith that's never once asked. We trace how ...

For twenty years, every server and every application in your environment had a password somewhere — a service account, a computer account — managed by a human who was supposed to rotate it on schedule and usually didn't. That model quietly became obsolete the moment infrastructure started spinning up and disappearing in minutes instead of living for years, and most organizations are still running critical systems on it anyway. In this episode, Ernie and Josée trace how managed identities elim...

You just merged networks with a company that might already be compromised — and they can't tell you, because they don't know either. That's day one. Not a checklist item. A live, unknown risk sitting inside a network you now own. Then it gets worse: the person responsible for deciding who keeps access is a manager staring at a list of strangers, with zero context, under pressure to not break payroll. So they approve everything. That's how a breach nobody caught turns into a breach nobody's wa...