Hybrid Identity Protection Podcast

What’s it like to be at the center of the storm that is a cyber crisis? You can prepare as much as you want, but you don’t really know until you’re in it.Recorded live at Black Hat 2026, this episode features Tim Brown, General Partner and CISO in Residence at Team8 and former CISO of SolarWinds. Tim shares the story of the week he learned the SEC was charging him personally—and then had a heart attack. He explains why CISOs need to confirm Board support in writing before a crisis hits, why recovery is critical for managing stress, and what startup founders get wrong about CISOs.Tim led SolarWinds through the aftermath of one of the most significant cyberattacks in history. He is also a Distinguished Engineer, one of only six Dell Fellows worldwide, and appears in Semperis' new documentary Midnight in the War Room.Guest Bio Tim Brown has spent over 25 years at the intersection of security, technology, and leadership. As CISO of SolarWinds, he guided the company through the aftermath of one of the most significant cyberattacks in history—and became one of the most credible voices in the industry on what organizations can learn from the experience of a breach.In February 2026, Tim became a Partner and CISO in Residence at Team8—one of the world's leading cybersecurity venture groups—where he works with founders from ideation through product growth.Beyond his CISO role, Tim is a Distinguished Engineer, one of only six Dell Fellows worldwide, a former CTO, and a former Chief Product Officer. He is an active advisor to multiple security companies across the funding lifecycle.Guest Quote “When you think about it, you stress your muscles, you allow them to recover, then you stress them again, and they get stronger. So, although we can't control stress, we can absolutely control recovery.”Timestamps 01:04 Meet Tim Brown 01:46 The SEC Charges and Tim’s Heart Attack 03:36 How CISOs Can Protect Themselves 05:19 A Sarbanes-Oxley for Security 06:25 The CISO Role Is Still Young 08:04 Stress Isn't the Problem 11:17 How Small Breaks Make a Big Difference 12:44 What Founders Get Wrong About CISOs 15:34 Tim’s Feature in Midnight in the War Room 17:04 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the identity-driven cyber resilience and crisis management company trusted by the world’s largest enterprises and government agencies to protect critical identity systems. Purpose-built for multi-cloud and hybrid identity environments—including Active Directory, Entra ID, Okta, and Ping Identity—Semperis helps organizations prevent, detect, respond to, and recover from identity-based cyberattacks. Visit semperis.com to learn more.Links Connect with Tim on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about SemperisMidnight in the War Room tells the story of cyber defenders on the front lines. See this pioneering documentary at an upcoming screening near you: https://www.semperis.com/midnight-in-the-war-room/events/

NTLM is an antique authentication protocol. It’s older than Active Directory. It’s easily exploited. And it’s being used in your forest all the time—very possibly without your knowledge.Recorded live at the 2026 Hybrid Identity Protection Conference in Nashville, this episode features Linda Taylor, Principal Software Engineer at Microsoft. Linda explains why NTLM's security weaknesses and constant stream of reported vulnerabilities make it costly and risky to maintain. Even so, Kerberos still quietly falls back to it through local accounts, IP address connections, and hard-coded apps. Linda offers security teams a pathway out, walking through the new enhanced NTLM auditing in Windows Server 2025 and making the case that getting rid of NTLM is everyone's problem.Linda joined Microsoft as an intern the year Active Directory shipped and spent 16 years as an Escalation Engineer in Microsoft Enterprise Support before moving to the Windows Server AD development team. She now leads work on NTLM deprecation and helped deliver AD security features that shipped in Windows Server 2025.Guest Bio A Principal Software Engineer with 22 years in the Active Directory field, Linda started at Microsoft when AD shipped in 2000 as a university student intern. She spent 16 years in Microsoft Enterprise Support (CSS) as an Escalation Engineer working directly with customers solving and debugging deeply technical Active Directory problems. Six years ago, she realized her dream of making an even bigger impact on AD and joined the Windows Server Active Directory development team.Linda has been working on AD bug fixes, security updates, and designing and implementing new AD and security related features that shipped in Windows Server 2025 and beyond.Guest Quote “I want people to know that reducing NTLM is everyone's responsibility. It's not just the responsibility of the AD guy, Microsoft, or one team in your organization.”Timestamps 01:29 Meet Linda Taylor 02:57 What Is NTLM? 03:46 Why Microsoft Deprecated NTLM 06:18 Enhanced NTLM Auditing in Windows Server 2025 08:20 What an NTLM Usage Poll Revealed 10:50 IAKerb and LocalKDC 14:45 NTLM Off by Default 16:07 Why NTLM Is Everyone's Problem 17:06 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the identity-driven cyber resilience and crisis management company trusted by the world’s largest enterprises and government agencies to protect critical identity systems. Purpose-built for multi-cloud and hybrid identity environments—including Active Directory, Entra ID, Okta, and Ping Identity—Semperis helps organizations prevent, detect, respond to, and recover from identity-based cyberattacks. Visit semperis.com to learn more.Links Connect with Linda on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about Semperis

Passkeys are now the default authentication method in Entra ID. If you’re responsible for Entra ID identity, the question you face is not “Should I care about passkeys?” but “How do I move forward without breaking the user experience—or the business?”This episode features Nathan McNulty, Principal Security Solutions Architect at Patriot Consulting, and Eric Woodruff, Chief Identity Architect at Semperis, who explain Microsoft's September 1 change and the looming retirement of SMS and voice in February 2027. They uncover the quirks of registration campaigns, debate the tradeoffs between device-bound and synced passkeys, and emphasize that passkeys only protect users once weaker fallback methods are removed. They close with a new risk: attackers registering their own passkeys to keep access to an account.The takeaway: Passkey shift is a planning problem to start now, not when SMS officially goes away.Nathan is a Microsoft MVP who has consulted hundreds of organizations. Before that, he built a security program from scratch at a school district of roughly 50,000 users. Eric is a Microsoft MVP for Security with over 25 years in IT and cybersecurity, including time at Microsoft—and he led the passkey rollout at Semperis.Guest BiosNathan McNulty Nathan McNulty is a Microsoft MVP and Principal Security Solutions Architect for Patriot Consulting where he helps clients securely implement Azure, Entra, Defender, and Intune. He started his career on helpdesk for a civil engineering firm before becoming their Enterprise Desktop Administrator. He later took a role as the Client Architect for a large school district of roughly 50K users where he became their cloud architect and security architect, spending several years building their security program from scratch. He has also worked with industrial control systems and several non-profits and consulted for hundreds of organizations across many sectors.Eric Woodruff With over 25 years in IT and cybersecurity, Eric Woodruff has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Senior Premier Field Engineer, and spent almost 15 years in the public sector, 10 of them as a technical manager.Eric is a Microsoft MVP for security, recognized for his expertise in the Microsoft identity ecosystem. His security research has also been recognized by Microsoft, most notably for his findings dubbed “UnOAuthorized.” Eric is a strong proponent of knowledge sharing and spends a good deal of time sharing his insights and expertise at conferences as well as through blogging. Eric further supports the professional security and identity community as an IDPro member, working as part of the IDPro Body of Knowledge committee.Guest Quotes “Instead of looking at how do I postpone this or how do I still make this work for some of my users, try to focus on the ones that we know we can fix and try to get them over to using passkeys.” - Nathan McNulty“In the end, the tech bit is always the easy part, right? It's turn a few knobs and dials. It's the people part that is the challenge.” - Eric WoodruffTime stamps 01:44 Meet Nathan McNulty and Eric Woodruff 02:49 Microsoft Makes Passkeys the Entra ID Default 06:01 Why Retaining Weaker Methods Undermines Passkeys 08:36 The Cost and Risk of SMS Authentication 12:12 What Changes for Existing Tenants 14:52 Device-Bound vs. Synced Passkeys 19:40 Taking Control of Registration Campaigns 22:19 Communicating a Passkey Rollout 24:36 What Passkey Sign-In Looks Like for Users 28:16 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.Links Connect with Nathan on LinkedInConnect with Eric on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about Semperis

Recorded live at Black Hat 2026, this episode features Sarah Gosler, Managing Director and Head of Cyber Resiliency and Human Defense at Wells Fargo. Sarah explains why humans are the largest attack surface and how—when AI has industrialized social engineering and cybersecurity is an "everybody problem"—the role of the CISO has shifted to encompass both the technical and the operational. Sarah makes the case that the more automated attacks get, the more the human side of defense matters.Before Wells Fargo, Sarah was Global Head of Cyber Human Defense and Readiness Products at BNY Mellon, where she built the firm's first commercial cyber product and earned two patents for a dynamic wargaming system. A former chief marketing officer, she brings a user-experience lens to cyber defense and is a featured cast member in Semperis’ new documentary Midnight in the War Room.Guest Bio Sarah Gosler is a senior cybersecurity executive focused on cyber resiliency and the human dimension of institutional risk. Her work is grounded in a simple premise: systems break — what matters is whether the organization holds.As Managing Director and Head of Cyber Resiliency & Human Defense at Wells Fargo, Sarah leads initiatives that strengthen how the firm prepares for and responds to cyber incidents. She integrates advanced wargaming, human defense strategy, and behavioral science to enhance institutional coordination, executive decision-making, and organizational performance under stress.Previously, at the Bank of New York, she built and scaled the firm’s global Cyber Human Defense program and pioneered its first commercial cyber readiness product, earning two patents in cyber wargaming and advancing industry approaches to social engineering resilience.Sarah is a frequent keynote speaker, media contributor, and published author of white papers on the psychological and organizational dimensions of cyber risk. She is widely recognized for bridging technical resilience with executive leadership and dynamics — shaping how financial institutions address cyber as both a technological and human challenge.With more than two decades at the intersection of finance, technology, and organizational performance, Sarah continues to influence the global conversation on institutional resilience, crisis leadership, and the evolving human front line of cyber defense.Guest Quote “I'm such a big advocate of making sure people don't say that humans are the weakest link. Humans represent the largest attack surface of any company. And so, if you think about it, if that's the biggest attack surface, but you're calling it the weakest link, you're really setting yourself up to fail.”Time stamps 00:30 Meet Sarah Gosler 03:46 Why Weakest Link Is the Wrong Framing 06:18 A Marketing Approach to Cybersecurity 07:30 The Cyber Villains Series 10:02 Cyber Is an Everybody Problem 14:36 Deepfakes on the Rise 15:32 Safe Words as a Cyber Defense 16:41 Sarah's Video Game Creation at BNY Mellon 20:09 The Industrialization of Social Engineering 23:21 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.Links Connect with Sarah on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about SemperisMidnight in the War Room tells the story of cyber defenders on the front lines. See this pioneering documentary at an upcoming screening near you: https://www.semperis.com/midnight-in-the-war-room/events/

This episode features Wylie Shanks, a cybersecurity consultant who leads an OT cybersecurity program for a large North American energy company's business unit.Wylie has spent more than twenty-five years working with critical infrastructure organizations, designing, defending, and recovering environments that span enterprise IT through industrial control systems. In this conversation, he walks Sean Deuby through the Purdue model level by level, then explains what changed when Windows servers, domain controllers, and vendor-managed accounts moved into environments built to run for decades without interruption. Wylie and Sean cover why safety and availability outrank everything else on the plant floor, why MFA and patch cycles that work in IT can be unworkable in OT, how forest architectures set up twenty years ago constrain organizations today, and how new resilience mandates in the US and Canada are pushing operators to prove they can run disconnected for 90 days. This episode makes the case that OT security is less about importing IT controls than about translating between two groups of experts who have never had to speak the same language. Guest Bio Wylie Shanks is a cybersecurity consultant who currently leads an OT cybersecurity program for a large North American energy company's business unit. With over twenty-five years of experience working with critical infrastructure organizations, he designs, defends, and recovers environments spanning enterprise IT to industrial control systems. His expertise spans security architecture, incident response, privileged access management, and cyber risk management, translating complex challenges into practical, auditable solutions. Wylie holds numerous certifications, including GIAC Security Expert (GSE), ISSAP, GIAC Response in Industrial Defense (GRID), and GIAC Cyber Incident Leader (GCIL). Guest Quote "Safety, of course, is critical. That's one of the differences between, say, an IT and an OT environment is in OT, there can be lives at stake. The environment can be impacted. You have different concerns about reliability and safety." Time stamps 02:40 Meet Wylie Shanks: 25 Years in Critical Infrastructure 04:59 Defining the OT Environment 05:51 Walking Through the Purdue Model 08:45 Explaining OT with a Thermostat 12:11 Ranking Safety, Reliability, and Integrity 13:39 Revisiting Stuxnet 15:21 Why MFA Breaks on the Plant Floor 18:36 Finding Windows and Active Directory in OT 21:29 Applying PAM and Least Privilege 27:14 Comparing AD Forest Architectures 31:19 Earning Trust with Plant Operators 35:41 Meeting New Resilience Mandates 40:49 Mapping the Threat Vectors 44:49 Facing AI-Assisted Attacks 47:41 Learning from Colonial Pipeline 53:15 Making Resilience Measurable 56:42 Conclusion and Final Thoughts Sponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world's leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more. Links Connect with Wylie on LinkedIn Connect with Sean on LinkedIn Don't miss future episodes Learn more about Semperis

This episode features Marc Jason Grens, President of Chaintrax. Marc has led Chaintrax for twelve years, growing it from a compliance and anti-money-laundering firm in cash-to-crypto services into a licensed blockchain forensics practice after entering the ransomware payment business in 2017. He has since advised on more than 4,000 incidents. In this episode, Marc explains why ransomware victims decide to pay, why that payment can violate US sanctions law if it isn't vetted first, and why tracking the money afterward is how law enforcement works to recover it. This episode makes the case that paying a ransom is only the beginning of a compliance and recovery process, not the end of one. Guest Bio Marc Grens is the President of Chaintrax,  which has been providing cutting-edge financial, technological, and consulting services for the payments and incident response industry for the last 12 years. He is a serial entrepreneur with more than 15 years of experience in the investment industry. Prior to Chaintrax, Marc held senior positions at Charles Schwab, HighTower Advisors, and Alpha Strategies. He received his M.B.A. from the Kellstadt Graduate School of Business at DePaul University in 2010, and a B.A. from Illinois State University. Marc is an active angel investor and serves on multiple advisory boards of companies in the Chicago tech community. Sponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more. Links Connect with Marc on LinkedIn Connect with Sean on LinkedIn Connect with Jeff on LinkedIn Don't miss future episodes Learn more about Semperis HIP Conference 26 is coming to Nashville, September 8–10, 2026. Join us to explore this year's theme, Redefining Resilience, at the world's premier practitioner-led conference focused on securing hybrid identity environments. If you love the conversations on the HIP Podcast, this is where the community comes together in person. Learn more and register at https://www.hipconf.com/.

This episode features Chris Steinke, Director of Product Strategy at Semperis.Chris has spent more than 20 years across cybersecurity, digital identity, infrastructure, and operations, including leadership roles at American Express and Early Warning Services (Zelle) and early work at MightyID, where he helped bring one of the industry's first dedicated identity resilience platforms to market.In this episode, Chris explains why moving identity to the cloud creates a single point of failure, why backup and recovery alone aren't enough, and why the next frontier is making trust portable, so applications aren't locked to a single identity provider.This episode reframes identity resilience as a continuity problem: not just recovering after an outage but keeping the business running through one.Guest Bio Chris Steinke is Director of Product Strategy at Semperis and a technology executive with more than 20 years of experience in cybersecurity, digital identity, infrastructure, and operations. Throughout his career, including leadership roles at American Express and Early Warning Services (Zelle), he has helped organizations build resilient digital ecosystems and defend against large-scale identity threats. As an early pioneer at MightyID, Chris helped bring one of the industry's first dedicated identity resilience platforms to market.Today, his work focuses on the future of digital trust, including identity resilience, multi-IdP architectures, and trust portability - the next evolution in ensuring business continuity in an identity-centric world.Guest Quote “We spent years making identities portable, and that's what we did really at the start. We were worried about the identities. So, the next challenge is how do we make trust portable?”Time stamps 02:11 Meet Chris Steinke: 20+ year Technology Executive 03:10 Why Identity Resilience Matters 08:43 Hidden Risks in Cloud Identity 15:52 Multi-IdP Failover Playbooks 23:06 Applications Are the Hard Part 31:46 The IRON Framework 37:35 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.LinksConnect with Chris on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about SemperisHIP Conference 26 is coming to Nashville, September 8–10, 2026.Join us to explore this year's theme, Redefining Resilience, at the world's premier practitioner-led conference focused on securing hybrid identity environments.If you love the conversations on the HIP Podcast, this is where the community comes together in person. Learn more and register at https://www.hipconf.com/.

This episode features Philip Keibler, Vice President and CISO at Meijer, one of the nation's largest privately held retailers.With nearly three decades of security leadership, including CISO roles at Bass Pro Shops and Finish Line, Phil brings a rare long-view perspective on what the job actually requires day to day. He also talks about his feature in Semperis' upcoming documentary Midnight in the War Room, premiering at Black Hat on August 5.In this episode, Phil explains why CISOs who struggle to get budget usually have a storytelling problem, how he defines success in a role where stopping every attack is impossible, and what it takes to lead a team through an active incident. He also dives into why fundamentals are what actually address most of an organization's risk.This episode makes the case that the hardest parts of the CISO job are rarely technical, and that mastering the basics matters more than chasing the newest tool.Guest Bio Philip Keibler has spent nearly three decades at the intersection of technology, risk, and business building information security programs that work in the real world.As Vice President and Chief Information Security Officer at Meijer, Phil leads security for one of the nation's largest privately held retailers, overseeing the protection of supply chains, customer data, and critical operations across hundreds of locations in the Midwest.Phil's career spans industries where the stakes are high and the margin for error is low. Before joining Meijer in 2015, he served as CISO at Bass Pro Shops and previously held the CISO role at Finish Line. Earlier in his career he led security at Herff Jones, bringing security discipline to the manufacturing sector. He began his career at EDS and spent years consulting in the Aerospace sector where he got his start in security.What sets Phil apart is not just longevity, it is perspective. He has watched information security evolve from a reactive, audit-driven function into a proactive capability that enables business velocity. His approach centers on integrating security into how organizations operate, not as a checkbox, but as a competitive advantage that lets teams move fast while managing risk in practical ways.Beyond the day-to-day, Phil is a passionate contributor to the broader security community. He has served as a guest lecturer on cybersecurity and data privacy at the University of Chicago Law School, sits on the Institute for Cybersecurity Education and Research Advisory Board at Grand Valley State University, serves on the IT Advisory Committee at Kent County Technical Center, and is a board member the Meijer Credit Union. He is also featured in Midnight in the War Room, a Semperis documentary examining the human reality behind enterprise cyber defense.Phil has held his CISSP certification since 2009, attained his MBA from Davenport University, and a career's worth of operational experience across retail, aerospace, insurance, and manufacturing.Guest Quote “A successful CISO understands that it's not about prevention, it's about resilience, it's about recovery, and it's about identifying those things in your program that you can do incrementally better every single day. We're in the pursuit of perfection, but we understand we'll never get there.”Time stamps 02:46 Meet Philip Keibler: From Sysadmin to Security 04:35 Becoming a CISO 06:20 What CISOs Really Do 08:50 Defining Success and Resilience 10:41 Storytelling to the Board 13:29 Semperis' Midnight in the War Room 17:47 Team Care and Crisis Leadership 21:47 Advice for CISOs 24:24 The Case for Mastering the Fundamentals 31:02 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.Links Connect with Phil on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about SemperisHIP Conference 26 is coming to Nashville, September 8–10, 2026.Join us to explore this year's theme, Redefining Resilience, at the world's premier practitioner-led conference focused on securing hybrid identity environments.If you love the conversations on the HIP Podcast, this is where the community comes together in person. Learn more and register at https://www.hipconf.com/.

This episode features Andre Priebe, Chief Technology Officer at iC Consult Group, the world's largest independent provider of identity security services.Andre has spent more than two decades leading IAM projects for large-scale enterprises across workforce, customer, and device identity domains. As CTO, he steers iC Consult's Centers of Excellence, service portfolio, and vendor strategy, and advises strategic customers on shaping their identity programs.In this episode, Andre explains why the gap between identity security awareness and actual maturity is growing every day, and how AI is making it faster and easier for attackers to find the weaknesses organizations already know they have. He breaks down why recovery is the most underestimated phase of the NIST cybersecurity framework and what it really costs when organizations haven't prepared for it.This episode is a candid look at the state of identity security from someone who sees it across hundreds of organizations every year.Guest Bio Andre Priebe serves as the Chief Technology Officer at iC Consult Group, a vendor-independent system integrator specializing in Identity & Access Management and Identity Security with a global team of over 850 employees. Boasting more than two decades of experience managing IAM projects focused on workforce, customer, and device identities within large-scale enterprises, Andre steers the Centers of Excellence, the service portfolio, and vendor strategy at iC Consult.Andre's role involves a deep focus on emerging approaches, trends, and technologies within the IAM sector, assessing their business value for iC Consult's clientele. He is an innovator with a patent in DevOps-related IAM methodologies, and he holds a B.Sc. and an MBA.Guest Quote  “Threat actors, for them, it's easier than ever before, faster, more efficient to identify that kind of technical debt, the weaknesses. They are not going for your latest Entra ID, conditional access, configuration with all the fancy stuff in place to really make sure that nobody else accessing that resource. No. They're going for the old systems, for old protocols, for areas that might be out of control, out of visibility. Third parties, contractors, unmanaged devices.”Time stamps 0:40 Meet Andre Priebe: Veteran IAM Expert 2:43 The State of Identity Security Awareness 4:51 The Reality of Technical Debt 6:16 How AI Is Changing the Attack Landscape 10:37 Zero Trust Is Mandatory but Almost Nobody Has Achieved It 15:06 What Customers Are Actually Asking About Now 19:19 Planning for Identity Recovery 26:08 The Most Underestimated Part of Recovery 29:56 Return to Trustworthiness vs Return to Operations 39:42 AI Agents and Non-Human Identities 44:02 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.LinksConnect with Andre on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about SemperisHIP Conference 26 is coming to Nashville, September 8–10, 2026.Join us to explore this year's theme, Redefining Resilience, at the world's premier practitioner-led conference focused on securing hybrid identity environments.If you love the conversations on the HIP Podcast, this is where the community comes together in person. Learn more and register at https://www.hipconf.com/.

This episode features Tim Wolf, Senior Solutions Architect at Semperis, and Tim Springston, Principal Product Manager for Recovery Solutions at Semperis.Tim Wolf spent years as a Microsoft Premier Field Engineer helping enterprise customers architect identity solutions at scale. Tim Springston brings 25 years in identity and security and served as Microsoft's product manager for Azure AD recoverability, including direct involvement in building the Entra ID shared responsibility model documentation.In this episode, they walk through what the shared responsibility model actually means for Entra tenant data, how token-based attacks sidestep phishing-resistant authentication, and what happens when a threat actor hard-deletes objects and locks you out.They examine where Microsoft's new Entra ID Identity Resilience Recovery feature stops short, and why planning your recovery before anything goes wrong is the only call to action that matters.Guest BiosTim Wolf Tim Wolf is a Senior Solution Architect at Semperis. Tim's mission is protecting identities. Currently at Semperis, Tim ensures the resilience of Active Directory and Entra ID. Their background includes years as a Microsoft PFE, implementing Zero Trust and modern Authentication like Fido at an enterprise scale. Tim is an active speaker at multiple conferences, advocating for secure and automated identity architectures.Tim Springston Tim Springston is Principal Product Manager for recovery solutions at Semperis. He has over 25 years' identity and security experience with education, government, and Fortune 500 organizations from around the world. In his 25 years at Microsoft, he led services and support for Active Directory and later for Microsoft's cloud identity platform as it evolved from Windows Azure AD to Azure AD. At Microsoft, he was a recurring speaker at internal TechReady conferences and external events. Prior to Semperis, Tim was Microsoft's product manager for Azure AD (now Entra ID) recoverability and Sophos' IAM product manager for the Sophos Central cybersecurity platform.Guest Quotes  “The first step in resiliency is not just having a backup plan or a backup tool or capabilities to put things back. You need to know what's important to your organization. If you know what's important, you know what to put back, you know when it's broken.” - Tim Springston “If Entra ID is going down... This is business critical today. You're not available to sign in to Teams, to SharePoint, to Salesforce, to your business critical application.  So to really understand Entra ID is business critical.” - Tim WolfTime stamps 0:40 Meet Tim Wolf and Tim Springston 2:32 The Microsoft Shared Responsibility Model for Entra ID 6:22 How Entra ID Tenants Are Being Attacked 8:45 Token-Based Attacks Explained 12:26 What Happens When a Threat Actor Takes Over Your Tenant 19:05 Microsoft's New Entra ID Recovery Solution 25:24 The Difference Between Accidents and Adversaries 28:54 Semperis’ Disaster Recovery for Entra Tenant 39:27 Hard Delete and Tenant Cloning Limits 45:30 Resiliency Playbooks and Testing 49:58 Conclusion and Final ThoughtsSponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.Links Connect with Tim Wolf on LinkedInConnect with Tim Springston on LinkedInConnect with Sean on LinkedInDon't miss future episodesLearn more about Semperis