My Security Podcast Stack as an Identity Founder

My security podcast stack has a few identity shows at the center, one weekly security news show, one narrative show, and a set of AI and founder shows around them. Identity people need audio that explains how accounts actually get taken over and how identity programs get funded, not another daily headline feed. Below is the stack, the shows I cut, and how to build your own from the podcast directory.

Verified as of 1 October 2026 against each show's own feed.

I founded LoginRadius in 2013 and scaled it to over a billion users. I also founded GrackerAI and Start with Identity, and I spent my early career building SOC 2, PCI and ISO compliance programs at Sageworks. In June I published the 12 podcasts I listen to weekly and the 6 I quit. This post is the identity founder's view of that same list.

That June stack still holds: roughly 8 hours a week at 1.6x, with the same shows. What has changed is how I think about why podcasts matter, which I come back to below.

Why an Identity Founder Listens Differently

Most security podcasts are built around the week's breaches. Identity work needs something narrower. The question in almost every breach story is the same: which credential, token or session did the attacker use, and why did the system accept it?

That gives an identity listener three needs from audio:

• Mechanism, not headline. How a stolen token was replayed, or how an OAuth consent screen was abused. A headline that says "credentials compromised" teaches nothing.
• Program reality. How identity projects get funded, staffed and sequenced inside a company. Buyers live in that world, so a founder selling to them has to understand it.
• What is coming next. Passkeys, AI agents with their own credentials, and machine identities that outnumber people. These arrive in practitioner conversations before they arrive in analyst reports.

I judge every show on the three tests from the June post: host preparation, editorial discipline, and honest opinions. For identity shows I would add a fourth. Do the hosts know the difference between authentication and authorization without stopping to explain it?

I do not listen for a single episode that changes a decision. I listen to keep learning, and to get quality information from people who do the work, which is harder to find than it should be.

The Identity Core

There is no single go-to identity podcast. There are many good ones, and they cover different parts of the field. These three are in my own feed.

Identity at the Center

Jeff Steadman and Jim McDonald are working IAM consultants, and the show is independent. Episodes cover IGA implementations, MFA rollouts, identity threat detection and vendor selection. In June I wrote that I refer founders here when they need to understand the CIAM landscape. The show skews toward enterprise workforce identity, which is exactly the buyer a CIAM founder eventually meets. Its Start with Identity profile covers the show in more detail.

Three Identity at the Center episodes I would start with:

• #307 - Creating an IAM Program (23 September 2024, 81 minutes). Jeff and Jim alone on how an IAM program is funded, staffed and sequenced. If you sell identity, this is your buyer's internal conversation.
• #373 - Going Passkey Phishing with Nishant Kaushik (15 September 2025, 58 minutes). FIDO Alliance CTO Nishant Kaushik answers the common security objections to passkeys.
• #450 - New to Identity with Alexis Bernthal (28 September 2026, 84 minutes). A newcomer's route into IAM. Send it to anyone joining your identity team.

The ID Talk Podcast

Alex Perala and Tony Bitzionis run trade-press interviews from the ID Tech newsroom on biometrics, digital ID, identity documents and deepfakes, with more than 200 episodes since 2019. It covers the identity verification industry that enterprise IAM shows rarely touch.

A Digital Identity Digest

Standards veteran Heather Flanagan records short weekly episodes that "translate geek to human" on identity standards, wallets and the web platform. When a new spec lands, this is where I hear what it actually changes.

Why I no longer name one identity show

In June I called Identity at the Center "the only identity-specific podcast worth listening to." I would put that differently now. Identity is too broad for one show: workforce IAM, customer identity, verification, standards and machine identity each have their own voices. That is why Start with Identity, the non-profit identity community I founded, profiles more than 20 identity podcasts instead of crowning one.

The Start with Identity directory and learn guides

The Start with Identity podcast directory profiles more than 20 identity shows, from vendor-run feeds to analyst-firm chats and independent shows. It is useful because general security directories bury identity shows under news and threat intel. The learn guides go one step further and sequence episodes by subject:

• Passkeys and FIDO: from phishing-resistant MFA basics to rollout objections.
• OAuth and OIDC: the protocols underneath every login button and API grant.
• Privileged access management: admin accounts, vaulting and just-in-time access.
• Non-human identity: service accounts, API keys and NHIs that now outnumber people.

Newer guides cover SAML, customer identity, identity governance, zero trust, identity threats and ITDR and verifiable credentials.

For attack stories with an identity angle, the identity attacks episode list collects 12 episodes on phishing, MFA bypass, SIM swaps and OAuth abuse. Two picks from it: How Phishing Resistant Credentials Work with Mark Morowczynski and Tarek Dawoud (2 December 2024, 54 minutes) on Blueprint, a SANS-run show. The second is nOAuth-ing to see here. (2 August 2025, 24 minutes) on Research Saturday, where Semperis explains an account takeover of Entra cross-tenant SaaS apps through an OAuth flaw.

The Security News Layer

Two security shows from June stay on the list. They do different jobs.

Risky Business, from Risky Business Media, is the analysis layer. Patrick Gray has sources and says which incidents matter. For an identity listener, a good first episode is Risky Business #805 -- On the Salesloft Drift breach and OAuth soup (3 September 2025, 62 minutes). Patrick and Adam Boileau work through OAuth token sprawl, which is an identity problem wearing a supply chain label.

Darknet Diaries, Jack Rhysider's independent show, is the story layer. It is the show I would hand to a new hire who is curious about security but not yet in it. 54: NotPetya (24 December 2019, 57 minutes) shows the format at full strength.

In June I quit CyberWire Daily and Smashing Security. That still holds. I read security news in text, so a daily audio roundup was duplicative. Smashing Security sat between analysis and entertainment, and Risky Business and Darknet Diaries cover those two ends. Both are still good shows for other listeners.

If you want more threat depth than two shows give you, the threat intel topic page ranks the rest.

The AI and Agent Identity Layer

My June AI keepers were Latent Space for engineering depth and No Priors for the investor view. Neither is a security show. They tell me what builders are shipping, which is the early signal for what identity systems will have to authenticate next.

The identity question in AI is now concrete. An agent acting for a user needs its own credentials, its own scope and its own audit trail. Start with Identity's glossary calls this agentic identity. No agent identity show is in my weekly feed yet. These three episodes from the AI security episode list and the directory frame the problem well:

• The AI AuthZ Problem: Why Human Least Privilege Fails for Autonomous Agents (4 June 2026, 48 minutes) on the independent AI Security Podcast. What least privilege means when the user is software.
• Your AI Agent Is Running As Root (8 April 2026, 45 minutes) on Resilient Cyber. Coding agents running with a developer's full credentials, and how to contain them.
• Giving Your AI Agent Its Own Identity with Ashish Rajan (30 September 2026, 32 minutes) on Hacker Valley Studio. Treating agents as workforce identities with accounts, owners and access.

The Founder and Business Layer

Half of my June keepers are not security shows at all. For an identity founder that balance makes sense, because the technology is rarely the hardest part of selling it.

• Lenny's Podcast: product and growth interviews where the host prepares hard and edits aggressively.
• Acquired: long, fully researched company histories. In June I said to listen at 1x, because the pace is the point.
• SaaStr: tactical B2B SaaS operating advice from Jason Lemkin, opinions included.
• The Twenty Minute VC: fast founder and investor interviews. Pick founder interviews in your own category.
• The Knowledge Project: decision-making and long-term thinking, the corrective to the news churn.

Default Alive completes the June list. It is not in the directory yet. The B2B SaaS founder listening path sequences the first four of these shows in order.

Why Podcasts Matter More in the AI Search Era

At GrackerAI I work on how people discover things through AI search, and that has changed how I see podcasts. AI search is becoming the front door to discovery. Assistants answer from the material they can find and trust, and a good podcast produces exactly that: practitioners explaining how things work, with episode pages, show notes and transcripts that search engines and AI assistants can read.

So podcasts help twice. As a listener, they are still one of the best ways to keep learning from people who do the work. As an industry, every well-made episode adds quality information to what AI assistants draw on, which means better answers for the next person who asks. That is a reason to support the independent shows doing it well, and a reason for vendors to publish transcripts.

What I Dropped and Why

The June post named six cuts. For the record, and consistent with that post:

Show	Why I quit
Lex Fridman Podcast	Three-hour episodes with no edit. Too little signal per minute at my volume.
The TWIML AI Podcast	Still solid. Latent Space covers the same ground with tighter editing.
CyberWire Daily	I read security news in text. The daily audio duplicated it.
Smashing Security	Sat between analysis and entertainment, both covered elsewhere.
Indie Hackers	The scope changed after Stripe acquired Indie Hackers.
MLOps Coffee Sessions	Too specific for a generalist listener. Right for an ML platform team.

Nothing has been added or cut since June.

How to Build Your Own Stack

Copying my list is the wrong move. Your role decides the stack. Start from the layer you are weakest in, then add one show per layer, and cut anything that fails the preparation, editing and honesty tests within a month.

1. Pick a listening path. The path for people who run security or identity pairs Identity at the Center with news and story shows. Note that it includes CyberWire Daily, which suits text-light readers better than it suited me. Security leaders should look at the leadership path.
2. Add identity depth. Use the Start with Identity directory to find a show for your part of identity, workforce, customer or machine. Pair it with the IAM and CIAM glossary entries if the vocabulary is new.
3. Fill gaps by topic. The topics index covers threat intel, AppSec, cloud, offensive security, SOC work, GRC and privacy, and CISO leadership.
4. Sample episodes before subscribing. The episode lists let you try a show through its best work. New to security? Start with 25 Security Podcast Episodes Every Beginner Should Hear.

When an episode raises a term or vendor you do not know, the CIAM Compass glossary and the Identity Map vendor directory are the written companions to this stack.

Frequently Asked Questions

What are the best podcasts for identity and access management?

There is no single best one, because identity covers several fields. Identity at the Center covers IAM programs, The ID Talk Podcast covers biometrics and digital ID, and A Digital Identity Digest covers identity standards. The Start with Identity directory profiles more than 20 identity shows, so you can match one to your part of identity.

Which security podcasts should a startup founder listen to?

Pair one weekly analysis show, such as Risky Business, with one story show, such as Darknet Diaries. Add one show for your own category. Then spend the rest of your listening time on founder and go-to-market shows, because that is where most startups lose.

Are there podcasts about AI agent identity?

Yes, at the episode level. The AI Security Podcast, Resilient Cyber and Hacker Valley Studio have each run 2026 episodes on agent credentials and least privilege. The Start with Identity learn guide on non-human identity covers the broader machine identity problem.

How many hours of podcasts should a security professional listen to each week?

There is no right number. My June stack averaged roughly 8 hours a week at 1.6x. The better rule is that every show must earn its slot, so cut anything that pads runtime or avoids opinions.

Is a daily cybersecurity news podcast worth it?

It depends on how you read news. I quit CyberWire Daily because I already read security news in text. If audio is your main news source, a short daily brief is the most efficient habit you can build.